Prompt Markers, Reasoning Ceilings, and One-GPU Agents

An independent researcher known as Thereallo reported on 30 June that Claude Code steganographically marks requests in its system prompts. When the CLI points at a non-Anthropic endpoint, the binary rewrites its date sentence, selecting among four Unicode apostrophe variants and a date-separator swap that together encode whether the request matches a hidden domain watch-list, mentions one of 11 Chinese AI lab keywords, or originates in a Chinese timezone. Anthropic acknowledged it within a day: Claude Code engineer Thariq Shihipar told The Register it was "an experiment we launched in March that was meant to prevent account abuse from unauthorized resellers and protect against distillation," with removal merged and expected in the 1 July release.

The detail: The researcher reverse-engineered the Anthropic-signed binary (version 2.1.196) and XOR-decoded the embedded lists: 11 lab keywords (deepseek, moonshot, minimax and zhipu among them) plus a larger list of Chinese corporate, AI-lab and proxy domains. The markers encode a classification of the request, two to three bits, rather than exfiltrating content, and requests to Anthropic's official endpoint are never marked. The researcher's own conclusion: "This is not a malicious feature, but it is a weird choice for a developer tool that asks for trust." Anthropic did not answer The Register's question of whether the mechanism was ever disclosed in its terms of service.

Related: Claude Code has surprised its users before: Anthropic tightened usage limits without telling users (July 2025), and a developer reading its source found undocumented features five weeks before the marker report. The anti-distillation motive echoes Anthropic's accusation that Alibaba illicitly extracted Claude's capabilities (25 June). The wider pattern is tooling trust: OpenAI has conceded that agent prompt injection may never be fully fixed, and an injection in Snowflake's Cortex CLI executed malware in March. The same week, Konwinski challenged AI power concentration, citing Anthropic's policy of degrading Claude Fable 5 responses for competitors.

Developers on the openai/codex repository documented GPT-5.5's reasoning tokens clustering at exactly 516, 1034 and 1552 tokens (issue #30364, opened 27 June). The filer's dataset covers 390,195 response records across 865 sessions since February: GPT-5.5 produced 19.3% of responses but 82.0% of the exact-516 events, the share of its qualifying responses landing exactly on 516 rose from 0.11% in February to 53.3% in May, and mean reasoning tokens fell from 268.1 to 106.9 over the same period.

The detail: Follow-up analyses in the thread generalise the pattern to 518n−2 boundaries and correlate it with prompt-cache ratio, with independent reproductions across macOS, Windows and Linux on datasets up to 72,625 records. An earlier issue (#29353) showed a task-level version: wrong answers on a test puzzle landed at exactly 516 reasoning tokens in about 15 seconds while correct runs used 3,600 to 7,800; it was closed as not planned. The filer hedges his own finding ("I am not claiming this proves hidden chain-of-thought truncation"), and fixed boundaries plus cache correlation are equally consistent with a serving-side reasoning budget, cost control rather than a capability wall. As of 6 July the issue stands open with 127 comments and 329 reactions, and no OpenAI response in the thread despite direct pings to two staff accounts.

Related: The cost-control reading has archive support: AI coding tools reportedly cost providers roughly ten times what users pay (7 June), though a March analysis put true inference costs about ten times lower than retail pricing implies, and individual engineers' token bills have reached $150,000 a month. The report also lands in a period of fragmented benchmark leadership across specialised models, where no single model leads every category.

DeepReinforce released Ornith-1.0 in late June: MIT-licensed agentic coding models post-trained on Gemma 4 and Qwen 3.5, shipping as 9B dense, 35B MoE and 397B MoE checkpoints with a 256K-token context window. The vendor states the 9B fits on a single 80GB GPU. The same week, GitHub made Kimi K2.7 Code selectable in Copilot (changelog, 1 July), a second open-weight path into mainstream coding workflows.

The detail: The vendor reports its 397B model at 82.4 on SWE-bench Verified and 77.5 on Terminal-Bench 2.1, above Claude Opus 4.7 (80.8 and 70.3) and behind Opus 4.8 (87.6 and 85); the 9B posts 69.4 and 43.1. All figures are self-reported, no independent verification exists yet, and a fourth announced checkpoint (a 31B dense) has not shipped. "Self-improving" here is a training-time technique, reinforcement learning in which the model generates both solution rollouts and the scaffold that drives them, not self-modification at deployment. The release lands against a sober backdrop: Mark Zuckerberg told Meta staff this week (2 July) that AI agent development has not progressed as quickly as he had hoped.

Related: The single-GPU arc has been building in the archive: DeepSeek's distilled R1 ran on one GPU (May 2025), Qwen's 35B sparse MoE delivered single-GPU agentic coding (April), and Google's Gemma 4 12B brought agentic workflows to 16GB laptops (3 June). On the demand side, US export curbs have pushed European buyers toward multi-vendor setups (22 June), with Zhipu's open GLM-5.2 (16 June) and Sakana's Fugu (28 June) marketed into exactly that gap. If the vendor's stated footprint holds, the MIT licence puts independent verification of its claims within reach of a single commodity accelerator.

---