44 KB of Claude Code’s classifier prompt never gets printed
Highflame researchers routed Claude Code traffic through mitmproxy and pulled the system prompt of the second model in the loop: claude-sonnet-5, which grades the agent’s actions in auto mode on version 2.1.220. About 44 KB of that prompt doesn’t show up when you run claude auto-mode defaults.
The check happens in two calls. A triage pass capped at 64 tokens assigns a harm score from 0 to 100, with a block threshold of 50; anything borderline goes to a second pass capped at 8192 tokens. Anthropic reports 0.4% false positives against 17% misses.
The hidden section spells out a technique called cross-session permission laundering: a request from another Claude session asking for something that session was denied gets rejected.
On 2.1.208 and newer, most sessions answer a refusal with the fixed string “Blocked by classifier” and no name for the rule that fired.
Up next
A video editor with no timeline, driven from Claude Code
VEED open-sourced OpenEdit, a video editing pipeline driven by a coding agent: no GUI, no timeline, just text commands, and “add subtitles” comes back as a finished MP4 in 1-3 minutes. Works with Claude Code, Codex or Gemini, Apple Silicon Macs only for now.
Related stories
- A PNG carried a hidden prompt injection into a Claude Code session
- A hidden system prompt paragraph tells Claude Code to stop asking permission
- Anthropic cut roughly 80% of Claude Code’s system prompt
- Auto mode’s token overhead stops counting against your limits
- Every Claude Code system prompt is now public, tracked across 238 versions
- Apiiro finds Claude Code secrets in 1,122 GitHub files
Comments
No comments yet. Be the first.
Join the conversation
Sign in to leave a comment. It appears after moderation.