44 KB of Claude Code's classifier prompt never gets printed
Highflame researchers routed Claude Code traffic through mitmproxy and pulled the system prompt of the second model in the loop: claude-sonnet-5, which grades the agent's actions in auto mode on version 2.1.220. About 44 KB of that prompt doesn't show up when you run claude auto-mode defaults.
The check happens in two calls. A triage pass capped at 64 tokens assigns a harm score from 0 to 100, with a block threshold of 50; anything borderline goes to a second pass capped at 8192 tokens. Anthropic reports 0.4% false positives against 17% misses.
The hidden section spells out a technique called cross-session permission laundering: a request from another Claude session asking for something that session was denied gets rejected.
On 2.1.208 and newer, most sessions answer a refusal with the fixed string "Blocked by classifier" and no name for the rule that fired.
Related stories
- A PNG carried a hidden prompt injection into a Claude Code session
- A hidden system prompt paragraph tells Claude Code to stop asking permission
- Anthropic cut roughly 80% of Claude Code's system prompt
- Auto mode's token overhead stops counting against your limits
- Every Claude Code system prompt is now public, tracked across 238 versions
- One git call let a repo escape the Claude Code sandbox
Comments
No comments yet. Be the first.
Join the conversation
Sign in with Google to leave a comment. Your name and avatar come from your Google profile, and the comment appears after moderation.