Security analysis reveals that the Claude Code CLI tool employs steganographic markers to silently tag requests sent to the model. By subtly altering date formats and apostrophes based on system environments, the binary appears to track unauthorized API proxies and reseller usage without explicit user disclosure.