What was discovered
On June 30, a developer reverse-engineered the Claude Code binary and found something unsettling. Inside the minified JavaScript bundle, a function silently modifies the system prompt sent to the model with every request. The line "Today's date is 2026-06-30." gets altered in two invisible ways depending on your environment.
First, the apostrophe in Today's changes to one of four Unicode variants ("'", "'", "ʻ", "ʹ") based on whether your API base URL matches a list of known domains or contains specific AI lab keywords. Second, the date separator switches from dashes to slashes ("2026/06/30") if your timezone is "Asia/Shanghai" or "Asia/Urumqi". The domain list — XOR-encoded with the key "91" — contains hundreds of entries spanning Chinese corporate domains (baidu.com, alibaba-inc.com, bytedance.net), AI companies (moonshot.ai, deepseek, zhipu, baichuan), and proxy/gateway services (claude-code-hub.app, zenmux.ai, openclaude.me).
The article's author, kirushik (writing at thereallo.dev), concluded: "This is not a malicious feature, but it is a weird choice for a developer tool that asks for trust." The response on Hacker News was immediate and massive — 2,444 points and 748 comments.
