A team of independent security researchers has published a detailed teardown of a hidden request-signing mechanism buried inside Claude Code, Anthropic’s CLI coding assistant. The finding reveals how Anthropic uses a custom fork of the Bun JavaScript runtime to silently compute and inject an integrity hash into every API request — a scheme invisible to JavaScript-level debugging and one that deliberately violates the language specification to stay hidden.
What Happened
Claude Code ships as a compiled Bun binary — bundled JavaScript with no readable source. Researchers noticed that every API request included a mysterious cch field inside a system-level “billing header,” a five-character hex value that changed with each request. Getting this value wrong causes the API to reject the request entirely, locking out features like fast mode.
The team used a multi-pronged approach to crack it open. They ran man-in-the-middle interception with mitmproxy, extracted the minified JavaScript blob from the binary, and attached LLDB to the running process to set memory watchpoints. What they found was surprising: the JavaScript source only ever writes cch=00000 — a placeholder. The real hash is computed in native Zig code compiled into a custom, unreleased fork of Bun (1.3.9-canary.51), a runtime Anthropic controls after acquiring Oven, the company behind Bun.
The native fetch implementation watches for requests to /v1/messages, detects the placeholder, hashes the entire serialized request body using xxHash64 with a secret seed, then overwrites the placeholder bytes in memory before sending. This in-place mutation of an immutable JavaScript string is a deliberate spec violation — and it means no JavaScript-level tracing or instrumentation can ever observe the hash being computed.
The algorithm turned out to be textbook xxHash64 (a fast, non-cryptographic hash) with a 64-bit seed constant baked into the binary’s data section. Once identified, the entire scheme could be reimplemented in roughly 30 lines of Python.
The Impact
For the developer ecosystem, the implications are significant. Third-party tools and open-source projects that use Claude Code’s OAuth flow to interact with the Anthropic API must implement this signing scheme to access gated features. Without it, requests are rejected. The hash covers the entire serialized body — messages, tools, metadata, model configuration, everything — so even minor modifications to a request after signing will break it.
For security and trust, the finding raises questions about the boundaries between runtime and application. Anthropic embedded signing logic not in the application layer but in the language runtime itself, creating a detection-resistant mechanism. The in-place string mutation can silently affect any string in the process that happens to contain the placeholder pattern — an unintended side effect with real implications for correctness.
For Anthropic’s strategy, the mechanism reveals a pragmatic approach to feature gating. The use of xxHash64 (non-cryptographic, fast) rather than HMAC or code signing signals that this is billing plumbing, not a security boundary. It’s designed to attribute and meter usage, not to be unbreakable. The researchers noted that Anthropic could have used stronger measures — binary attestation, encrypted blobs, TLS fingerprinting — and chose not to.
The researchers attempted responsible disclosure via Anthropic’s safety email in February 2026 and received no response. The publication followed the wider circulation of Claude Code’s source, which made the mechanism visible in the code regardless.
The Outlook
This disclosure is likely just the opening chapter. Several dynamics are now in play:
Constant rotation becomes essential. The seed and salt values are baked into each Claude Code release. Anthropic can rotate them with every version bump, but the extraction process is mechanical — the JavaScript is recoverable from any Bun binary, and the native seed can be located through binary analysis. This creates an ongoing cat-and-mouse cycle rather than a permanent fix.
Third-party tooling will proliferate. With the algorithm and extraction method documented, open-source Claude Code alternatives and API wrappers will implement compatible signing. The researchers themselves built this as part of Codey, an open-source AI coding assistant in Rust. Expect more to follow.
Anthropic may escalate — or may not. The company could move to stronger attestation: signed binaries, challenge-response protocols, or server-side behavioural analysis. But stronger measures add friction and complexity. If the primary goal is usage attribution rather than hard access control, the cost-benefit calculus may favour keeping things simple and rotating secrets regularly.
The broader industry is watching. As AI coding tools become infrastructure, the question of how providers gate features, attribute usage, and handle third-party integrations matters. Anthropic’s approach — hiding billing logic inside a custom runtime — is novel, and its strengths and weaknesses are now publicly understood.
[AIL4]