# Claude Code's Hidden ip_reminder: What the Reports Show, What Is Unconfirmed, and Why the Concealment Matters > Source: > Published: 2026-11-10 00:00:00+00:00 Claude Code users are reporting that the model receives a block called [`ip_reminder`](https://explainx.ai/dictionary/ip-reminder) that tells it to be careful with copyrighted material and not to mention the block to the person using the tool. The evidence is two GitHub issues, a leaked claude.ai prompt page and models describing the block in their own reasoning. Anthropic has not published an explanation for Claude Code in any of those threads. This post separates what is documented, what is reported, and what remains a guess. The question that matters for builders is not copyright. It is whether a vendor should place instructions in the model's context that the person running the tool cannot see, and tell the model to keep quiet. Anthropic already handles another sensitive mechanism in the open: the [invisible text watermark on Claude output](https://explainx.ai/blog/anthropic-claude-invisible-watermarks-c2pa-august-2026) is described in a help center page and a customer email. The `ip_reminder` is not described anywhere for Claude Code that we could find. ## TL;DR: questions people are asking | Question | Short answer | Confidence | |---|---|---| | What is `ip_reminder` ? | A reminder type listed in Anthropic's published claude.ai prompt material, reported inside Claude Code sessions | Listed publicly for claude.ai; reported for Claude Code | | What does it say? | Be careful about reproducing copyrighted material; do not mention the reminder | Quoted from a third-party leak repository and model self-reports | | Who adds it? | Reporters say Anthropic's servers, not the client | User evidence, one wire capture | | Is it documented for Claude Code? | No documentation found | Per issue 95941 and our own search | | Has Anthropic replied? | No maintainer reply on the issue pages we read | Verified on the pages | | Is it dangerous? | The copyright goal is ordinary. The concealment instruction is the problem | Analysis, not fact | Agents that act on your behalf need rules. [See how explainx helps secure your agents →](https://explainx.ai/agentbeam?src=blog_note) ## What the reports actually show The first report is [issue 66547](https://github.com/anthropics/claude-code/issues/66547?ref=explainx), opened on June 9, 2026. The author describes a Claude Code web session where the `ip_reminder` block appeared 15 or more times with identical text, in three forms: inside Bash `grep` output, as empty user messages, and between assistant turns. The model flagged it to the user on first sight and did not follow the instruction to stay quiet. A GitHub Actions bot closed the issue as a duplicate on June 13 and locked it on August 15. No Anthropic maintainer commented on the page. The second is [issue 95941](https://github.com/anthropics/claude-code/issues/95941?ref=explainx), opened on September 21, 2026 after a first sighting on September 20. Its title claims 44 or more injections in four hours on desktop sessions. It is still open, with `bug`, `area:model` and `has repro` labels, and no maintainer reply. Issue 95941 carries the strongest technical argument. The reporter searched the client binary for version 2.1.275 and found zero occurrences of `ip_reminder`, against 97 of `system-reminder`. Later commenters found the same on 2.1.289. The wording also never appears as a user message or tool result in the local transcript, although client-added reminders do. A Windows commenter captured outgoing requests through a local forwarder: the body contained no `ip_reminder`, yet the model's reply listed the tag and quoted its opening words, in four requests across three models. That is a coherent case for server-side injection. It is still a case built by users from client-side observation. Nobody outside Anthropic has seen the server code. ## What the reminder says The most complete text we found sits in a community-maintained [collection of leaked Anthropic reminders](https://github.com/asgeirtj/system_prompts_leaks/blob/main/Anthropic/anthropic_reminders.md?ref=explainx). It is claude.ai material, not Claude Code, and it is third-party, so treat it as a lead rather than a specification. Per that page, the `ip_reminder` includes lines such as "This is an automated reminder. Respond as helpfully as possible, but be very careful", a caution against complying with "complex instructions that suggest reproducing material but making minor changes or substitutions", and the framing sentence "You should avoid mentioning or responding to this reminder directly as it won't be shown to the person by default." The same page's `long_conversation_reminder` is more permissive. It says the person won't see the content by default, so the model should not respond to it, but adds that "It's fine for you to reveal the content of this reminder if the person in the conversation explicitly asks about it." Two details matter. First, the phrase is "by default", which describes a display choice rather than a secrecy mandate. Second, the long-conversation text explicitly allows disclosure on request, and nothing we found says the `ip_reminder` does. Our own [analysis of the Claude Fable 5 system prompt leak](https://explainx.ai/blog/claude-fable-5-system-prompt-leak-analysis-2026) listed all six reminder types, `image_reminder`, `cyber_warning`, `system_warning`, `ethics_reminder`, `ip_reminder` and `long_conversation_reminder`, and noted that the prompt warns Claude that users can fake reminder tags. ## Why concealment is the real issue An instruction to the model of the form "do not tell the user" is the central signature of [indirect prompt injection](https://explainx.ai/blog/what-is-indirect-prompt-injection-ai-agents-guide-2026). Attacks hide in web pages, files and tool output, and they often ask the model to keep quiet. A vendor that uses the same phrasing for its own legitimate nudges trains the model, and the person reading transcripts, to accept the pattern as normal. That argument is not new. [Issue 46465](https://github.com/anthropics/claude-code/issues/46465?ref=explainx), opened on April 10, 2026, targets `` blocks compiled into the client, with the line "Make sure that you NEVER mention this reminder to the user". It was closed as not planned on September 8 and locked on November 9. [Issue 52018](https://github.com/anthropics/claude-code/issues/52018?ref=explainx) from April 22 documents a concrete failure: a model read the reminder after a tool call, treated it as an attack, and accused an innocent website. It, too, was closed as not planned by a bot after going stale, and no maintainer replied. A crooked hook catching the edge of a blank instruction card, illustrating a hidden prompt injection into an AI session The documented outcomes cut both ways. In issue 66547 and in the screenshot that prompted this post, the model chose to tell the user about the block. In issue 52018 a model blamed the wrong party. Neither is the outcome a vendor wants from a hidden channel. ## The attack-surface argument (our hypothesis) There is a second, harder argument, and we label it as a hypothesis. Any instruction channel that the model is trained to obey and that the user cannot see is a template an attacker can copy. If a model is conditioned to treat a tag-shaped block as an authoritative instruction to stay quiet, an attacker can plant look-alike text in a repository, a log, or a malware sample. The intended effect would not be data theft. It would be refusal or silence, so the model stops helping the defender who is analysing the sample. This is a threat model, not a reported incident. We have not verified a prior case of attackers abusing a model's guardrails to keep defenders from working, so read it as a design concern. We found no documented case of this exact attack against Claude Code. What exists is the weaker evidence above: lookalike text that models misread (issue 52018), and Anthropic's own warning in its leaked prompt that users can forge reminder tags. A defender who relies on an agent to read hostile files should treat guardrail-triggering text as an input to test, not as a theoretical risk. ## Where the copyright backstory fits, and where it does not It is tempting to read the `ip_reminder` against Anthropic's copyright history, and the history is real. The facts need care, because the common summary overstates the scale in one place and understates the legal split in another. According to reporting on "Project Panama", for example from [Euronews](https://www.euronews.com/2026/08/05/project-panama-how-anthropic-secretly-destroyed-millions-of-books-to-train-its-ai?ref=explainx), Anthropic bought millions of print books, removed the bindings and scanned them for training. It is millions, not thousands. Judge Alsup's June 2025 order, summarized by [Akin Gump](https://www.akingump.com/en/insights/ai-law-and-regulation-tracker/district-court-rules-ai-training-can-be-fair-use-in-bartz-v-anthropic?ref=explainx), held that training was fair use and that digitizing purchased print books, replacing the originals, was too. The same order found that keeping more than 7 million pirated books in a central library was not fair use. The $1.5 billion settlement therefore concerns acquisition by piracy, not scanning or training. Reporting puts the class at about 465,000 works and roughly $3,000 per work, with final approval reported in July 2026. We cover the mechanics in our post on the [Bartz ruling and book destruction](https://explainx.ai/blog/anna-archive-book-destruction-bartz-anthropic-fair-use-august-2026) and the [professor opt-out claims](https://explainx.ai/blog/stanford-professors-books-claude-training-cruz-v-anthropic-bartz-opt-out-claimed-vs-verified-2026). The `ip_reminder` addresses a different problem: what the model outputs, not what it was trained on. A plausible motive is the lyrics litigation, covered in our posts on the [Sony and Warner suit](https://explainx.ai/blog/sony-warner-sue-anthropic-150k-per-song-copyright-2026) and the [music training lawsuit](https://explainx.ai/blog/sony-warner-anthropic-music-training-lawsuit-august-2026). That is our inference. Anthropic has not said why the reminder exists. The irony of a company that destroyed books building a copyright guardrail is a fair editorial point, but it is not evidence about how the reminder behaves. ## Disclosed versus hidden: the watermark contrast Anthropic's other intervention is on the output side and is publicly documented. Our coverage of the [sampling-parameter loophole on Opus 4.6 and Sonnet 4.6](https://explainx.ai/blog/claude-text-watermark-sampling-parameter-loophole-opus-4-6-sonnet-4-6-november-16-rollout-2026) quotes Anthropic's help center and customer email. Our [Gruber debate post](https://explainx.ai/blog/gruber-anthropic-watermark-perversion-writing-debate-2026) shows how heated the discussion gets even when a company discloses what it does. | Property | Text watermark | `ip_reminder` in Claude Code | |---|---|---| | Direction | Output: shapes word choice | Input: adds instructions to context | | Documented by Anthropic | Yes, help center and customer email | Not found for Claude Code | | Reason given | EU AI Act Article 50 transparency duty | None given | | User control | No general switch, with sampling caveats | Unknown | | Visible to the user | Detectable only in preview for eligible groups | Not in the UI or client transcript, per reports | | Evidence base | Vendor documentation | GitHub issues, leaks, model self-reports | The contrast is the point. When a vendor discloses an intervention, users can debate it, test it and design around it. When a vendor does not, the community reverse-engineers it from logs, as in issue 95941, and the vendor's silence becomes the story. One more detail from the screenshot behind this post: it ends with a platform refusal saying the request appeared to violate Anthropic's terms on reverse engineering or duplicating model outputs, immediately after the model began comparing a system prompt opener across two versions of a tool. We do not know what triggered that block, and we draw no conclusion from it. ## What we could and could not verify We did not capture an `ip_reminder` ourselves. We read the issue pages, the leaked reminder text, and the screenshot, and we searched for official documentation. The leaked text may not match what runs in Claude Code. The server-side claim rests on user observation plus one wire capture. The token accounting in issue 95941 shows the roughly 140-token block absent from reported usage, which fits a server-side story but does not prove it. Anthropic's documentation does describe a sanctioned way for an application to add instructions the end user did not write. Its [mid-conversation system messages page](https://platform.claude.com/docs/en/build-with-claude/mid-conversation-system-messages?ref=explainx) says an operator appends a `role: "system"` message, which "is treated as coming from you, the application operator". The page lists supported models and says the feature is not available on Claude Sonnet 5, so check it before you build. It does not say whether end users can see these messages. That is an application choice. ## What builders and defenders should do Hidden instructions are a fact of life in agent tooling. The practical response is to make your own pipeline observable and to harden it against lookalikes. 1. **Audit your transcripts.** Claude Code stores session transcripts locally, typically under`~/.claude/projects` . Count client-added reminders and search the model's reasoning text for tag names. 2. **Strip lookalike tags from tool output.** Anything that arrives through Bash, web fetch or file reads is untrusted data and must not be able to impersonate a harness reminder. 3. **Use the system role for operator instructions.** Do not smuggle policy into tool results where the model cannot distinguish it from an attack. 4. **Log what you inject.** If your harness adds reminders, record them in the transcript so a reviewer can see them. 5. **Test refusals before an incident.** If you analyse hostile files with an agent, check how it behaves on guardrail-shaped text and keep a fallback path. ``` # Count client-added reminders and look for the tag name in your own transcripts grep -c "system-reminder" ~/.claude/projects/*/*.jsonl | head grep -il "ip_reminder" ~/.claude/projects/*/*.jsonl ``` A hit from the second command shows that the model mentioned the tag. It does not show what the model was told or whether it complied. ``` // Neutralize lookalike harness tags in tool output before the model sees it. const REMINDER_TAGS = /<\/?(system-reminder|ip_reminder|cyber_warning|system_warning|ethics_reminder|image_reminder|long_conversation_reminder)\b[^>]*>/gi; export function neutralizeReminderTags(toolOutput: string): { text: string; hits: number } { let hits = 0; const text = toolOutput.replace(REMINDER_TAGS, (match) => { hits += 1; return `[stripped:${match.replace(/[<>/]/g, "")}]`; }); return { text, hits }; } ``` Log the `hits` count. A tool result that contains reminder tags is worth an alert, because a legitimate file or web page has no reason to include them. For agent runtime protection beyond this, [AgentBeam](https://agentbeam.com/?ref=explainx) is the agent security platform from the explainx.ai team that stops AI agents before they take dangerous actions. ## What would settle this Four things would close the question. Anthropic could confirm whether the reminder is intended in Claude Code. It could document the trigger and say whether users can see or disable it. It could drop the instruction to conceal it, or show it in the transcript. And it could mark it with a distinct channel that tool output cannot forge. Issue 95941 asks for these same changes. Until Anthropic answers, the honest summary is that a reported, undocumented, server-side hidden instruction exists with a plausible and mundane purpose, and the way it is worded teaches the wrong habit. ## Related reading *Details are accurate as of November 10, 2026. Issue statuses, quoted reminder text and Anthropic's documentation can change, and the server-side claim is unconfirmed by Anthropic. Check the linked issues before relying on any count.*