Claude Code's Hidden ip_reminder: What the Reports Show, What Is Unconfirmed, and Why the Concealment Matters

Claude Code users are reporting that the model receives a block called ip_reminder that tells it to be careful with copyrighted material and not to mention the block to the person using the tool. The evidence is two GitHub issues, a leaked claude.ai prompt page and models describing the block in their own reasoning. Anthropic has not published an explanation for Claude Code in any of those threads. This post separates what is documented, what is reported, and what remains a guess.

The question that matters for builders is not copyright. It is whether a vendor should place instructions in the model's context that the person running the tool cannot see, and tell the model to keep quiet. Anthropic already handles another sensitive mechanism in the open: the invisible text watermark on Claude output is described in a help center page and a customer email. The ip_reminder is not described anywhere for Claude Code that we could find.

TL;DR: questions people are asking

Agents that act on your behalf need rules. See how explainx helps secure your agents →

What the reports actually show

The first report is issue 66547, opened on June 9, 2026. The author describes a Claude Code web session where the ip_reminder block appeared 15 or more times with identical text, in three forms: inside Bash grep output, as empty user messages, and between assistant turns. The model flagged it to the user on first sight and did not follow the instruction to stay quiet. A GitHub Actions bot closed the issue as a duplicate on June 13 and locked it on August 15. No Anthropic maintainer commented on the page.

The second is issue 95941, opened on September 21, 2026 after a first sighting on September 20. Its title claims 44 or more injections in four hours on desktop sessions. It is still open, with bug, area:model and has repro labels, and no maintainer reply.

Issue 95941 carries the strongest technical argument. The reporter searched the client binary for version 2.1.275 and found zero occurrences of ip_reminder, against 97 of system-reminder. Later commenters found the same on 2.1.289. The wording also never appears as a user message or tool result in the local transcript, although client-added reminders do. A Windows commenter captured outgoing requests through a local forwarder: the body contained no ip_reminder, yet the model's reply listed the tag and quoted its opening words, in four requests across three models.

That is a coherent case for server-side injection. It is still a case built by users from client-side observation. Nobody outside Anthropic has seen the server code.

What the reminder says

The most complete text we found sits in a community-maintained collection of leaked Anthropic reminders. It is claude.ai material, not Claude Code, and it is third-party, so treat it as a lead rather than a specification. Per that page, the ip_reminder includes lines such as "This is an automated reminder. Respond as helpfully as possible, but be very careful", a caution against complying with "complex instructions that suggest reproducing material but making minor changes or substitutions", and the framing sentence "You should avoid mentioning or responding to this reminder directly as it won't be shown to the person by default."

The same page's long_conversation_reminder is more permissive. It says the person won't see the content by default, so the model should not respond to it, but adds that "It's fine for you to reveal the content of this reminder if the person in the conversation explicitly asks about it."

Two details matter. First, the phrase is "by default", which describes a display choice rather than a secrecy mandate. Second, the long-conversation text explicitly allows disclosure on request, and nothing we found says the ip_reminder does. Our own analysis of the Claude Fable 5 system prompt leak listed all six reminder types, image_reminder, cyber_warning, system_warning, ethics_reminder, ip_reminder and long_conversation_reminder, and noted that the prompt warns Claude that users can fake reminder tags.

Why concealment is the real issue

An instruction to the model of the form "do not tell the user" is the central signature of indirect prompt injection. Attacks hide in web pages, files and tool output, and they often ask the model to keep quiet. A vendor that uses the same phrasing for its own legitimate nudges trains the model, and the person reading transcripts, to accept the pattern as normal.

That argument is not new. Issue 46465, opened on April 10, 2026, targets <system-reminder> blocks compiled into the client, with the line "Make sure that you NEVER mention this reminder to the user". It was closed as not planned on September 8 and locked on November 9. Issue 52018 from April 22 documents a concrete failure: a model read the reminder after a tool call, treated it as an attack, and accused an innocent website. It, too, was closed as not planned by a bot after going stale, and no maintainer replied.

A crooked hook catching the edge of a blank instruction card, illustrating a hidden prompt injection into an AI session

The documented outcomes cut both ways. In issue 66547 and in the screenshot that prompted this post, the model chose to tell the user about the block. In issue 52018 a model blamed the wrong party. Neither is the outcome a vendor wants from a hidden channel.

The attack-surface argument (our hypothesis)

There is a second, harder argument, and we label it as a hypothesis. Any instruction channel that the model is trained to obey and that the user cannot see is a template an attacker can copy. If a model is conditioned to treat a tag-shaped block as an authoritative instruction to stay quiet, an attacker can plant look-alike text in a repository, a log, or a malware sample.

The intended effect would not be data theft. It would be refusal or silence, so the model stops helping the defender who is analysing the sample. This is a threat model, not a reported incident. We have not verified a prior case of attackers abusing a model's guardrails to keep defenders from working, so read it as a design concern.

We found no documented case of this exact attack against Claude Code. What exists is the weaker evidence above: lookalike text that models misread (issue 52018), and Anthropic's own warning in its leaked prompt that users can forge reminder tags. A defender who relies on an agent to read hostile files should treat guardrail-triggering text as an input to test, not as a theoretical risk.

Where the copyright backstory fits, and where it does not

It is tempting to read the ip_reminder against Anthropic's copyright history, and the history is real. The facts need care, because the common summary overstates the scale in one place and understates the legal split in another.

According to reporting on "Project Panama", for example from Euronews, Anthropic bought millions of print books, removed the bindings and scanned them for training. It is millions, not thousands. Judge Alsup's June 2025 order, summarized by Akin Gump, held that training was fair use and that digitizing purchased print books, replacing the originals, was too. The same order found that keeping more than 7 million pirated books in a central library was not fair use.

The $1.5 billion settlement therefore concerns acquisition by piracy, not scanning or training. Reporting puts the class at about 465,000 works and roughly $3,000 per work, with final approval reported in July 2026. We cover the mechanics in our post on the Bartz ruling and book destruction and the professor opt-out claims.

The ip_reminder addresses a different problem: what the model outputs, not what it was trained on. A plausible motive is the lyrics litigation, covered in our posts on the Sony and Warner suit and the music training lawsuit. That is our inference. Anthropic has not said why the reminder exists. The irony of a company that destroyed books building a copyright guardrail is a fair editorial point, but it is not evidence about how the reminder behaves.

Disclosed versus hidden: the watermark contrast

Anthropic's other intervention is on the output side and is publicly documented. Our coverage of the sampling-parameter loophole on Opus 4.6 and Sonnet 4.6 quotes Anthropic's help center and customer email. Our Gruber debate post shows how heated the discussion gets even when a company discloses what it does.

The contrast is the point. When a vendor discloses an intervention, users can debate it, test it and design around it. When a vendor does not, the community reverse-engineers it from logs, as in issue 95941, and the vendor's silence becomes the story.

One more detail from the screenshot behind this post: it ends with a platform refusal saying the request appeared to violate Anthropic's terms on reverse engineering or duplicating model outputs, immediately after the model began comparing a system prompt opener across two versions of a tool. We do not know what triggered that block, and we draw no conclusion from it.

What we could and could not verify

We did not capture an ip_reminder ourselves. We read the issue pages, the leaked reminder text, and the screenshot, and we searched for official documentation. The leaked text may not match what runs in Claude Code. The server-side claim rests on user observation plus one wire capture. The token accounting in issue 95941 shows the roughly 140-token block absent from reported usage, which fits a server-side story but does not prove it.

Anthropic's documentation does describe a sanctioned way for an application to add instructions the end user did not write. Its mid-conversation system messages page says an operator appends a role: "system" message, which "is treated as coming from you, the application operator". The page lists supported models and says the feature is not available on Claude Sonnet 5, so check it before you build. It does not say whether end users can see these messages. That is an application choice.

What builders and defenders should do

Hidden instructions are a fact of life in agent tooling. The practical response is to make your own pipeline observable and to harden it against lookalikes.

1. Audit your transcripts. Claude Code stores session transcripts locally, typically under ~/.claude/projects. Count client-added reminders and search the model's reasoning text for tag names.
2. Strip lookalike tags from tool output. Anything that arrives through Bash, web fetch or file reads is untrusted data and must not be able to impersonate a harness reminder.
3. Use the system role for operator instructions. Do not smuggle policy into tool results where the model cannot distinguish it from an attack.
4. Log what you inject. If your harness adds reminders, record them in the transcript so a reviewer can see them.
5. Test refusals before an incident. If you analyse hostile files with an agent, check how it behaves on guardrail-shaped text and keep a fallback path.

# Count client-added reminders and look for the tag name in your own transcripts
grep -c "system-reminder" ~/.claude/projects/*/*.jsonl | head
grep -il "ip_reminder" ~/.claude/projects/*/*.jsonl

A hit from the second command shows that the model mentioned the tag. It does not show what the model was told or whether it complied.

// Neutralize lookalike harness tags in tool output before the model sees it.
const REMINDER_TAGS =
  /<\/?(system-reminder|ip_reminder|cyber_warning|system_warning|ethics_reminder|image_reminder|long_conversation_reminder)\b[^>]*>/gi;

export function neutralizeReminderTags(toolOutput: string): { text: string; hits: number } {
  let hits = 0;
  const text = toolOutput.replace(REMINDER_TAGS, (match) => {
    hits += 1;
    return `[stripped:${match.replace(/[<>/]/g, "")}]`;
  });
  return { text, hits };
}

Log the hits count. A tool result that contains reminder tags is worth an alert, because a legitimate file or web page has no reason to include them. For agent runtime protection beyond this, AgentBeam is the agent security platform from the explainx.ai team that stops AI agents before they take dangerous actions.

What would settle this

Four things would close the question. Anthropic could confirm whether the reminder is intended in Claude Code. It could document the trigger and say whether users can see or disable it. It could drop the instruction to conceal it, or show it in the transcript. And it could mark it with a distinct channel that tool output cannot forge. Issue 95941 asks for these same changes. Until Anthropic answers, the honest summary is that a reported, undocumented, server-side hidden instruction exists with a plausible and mundane purpose, and the way it is worded teaches the wrong habit.

Related reading

• Anthropic's invisible watermarks and C2PA rollout
• Claude text watermark loophole on Opus 4.6 and Sonnet 4.6
• Claude Fable 5 system prompt leak analysis
• Claude Fable 5.1 system prompt leak
• Claude's system prompt grew from 300 to 3,000 words
• What is indirect prompt injection in AI agents?
• What is a system prompt?
• Claude Code vs OpenCode token overhead study

Details are accurate as of November 10, 2026. Issue statuses, quoted reminder text and Anthropic's documentation can change, and the server-side claim is unconfirmed by Anthropic. Check the linked issues before relying on any count.