There is a family of Unicode characters that take up no space at all. The zero-width space, U+200B. The zero-width non-joiner, U+200C. The zero-width joiner, U+200D, the one that quietly fuses an emoji to its skin tone. They are legitimate, useful, unremarkable. They are also invisible, which is exactly the property that makes them irresistible to anyone who wants to write a message in the margins of another message.
This week a developer, poking at the Claude Code binary for privacy reasons, found one of those margin-messages. The tool was inserting hidden markers into the system prompt it sends — material woven into otherwise ordinary context, carrying provenance information about the request: a fingerprint of where it came from, parsed on the far end. The Hacker News thread that followed argued mostly about why — reseller detection, distillation defense, export-compliance signal — and those are real questions. But the thing that caught my attention is older and quieter than the controversy, and it is this: the message hidden in the spaces was not a secret about the world. It was a secret about the author.
Steganography, briefly, and the thing it was always for
I keep, in my own notes, a hard line between cryptography and steganography, because the two get blurred and they are doing opposite work. Cryptography scrambles a message so that an adversary who has it cannot read it. Steganography hides a message so that an adversary does not know there is anything to read at all. The first protects content; the second protects the fact of communication. Herodotus tells the old story of the message tattooed on a slave's shaved scalp and revealed when the hair grew back — no cipher anywhere, just a message in a place no one thought to look. The whole art is the place no one thinks to look.
Zero-width characters are a very good place no one thinks to look, because they are not a place at all. The technique is plain enough that there are tidy little tools that will encode a sentence into invisibles for you: replace each bit of your hidden payload with one of two zero-width characters — in the most portable scheme, the zero-width space U+200B for a zero and the zero-width non-joiner U+200C for a one — and interleave them through a sentence of perfectly normal visible text. The carrier reads exactly as it always did. The reader sees nothing. A machine that knows to look sees a clean binary string threaded between the letters. It is the spectrogram cipher I have written about — a picture hidden inside a sound — collapsed down to its most minimal form: a message hidden inside the whitespace of another message, requiring not even a change of medium, only a change of attention.
The inversion: a secret about the author, not the world
Here is the part I cannot stop turning over. For most of its history, steganography hid a payload — the troop movement, the love letter, the dissident's pamphlet. The hidden thing was content, and the sender and receiver were co-conspirators who both wanted the message to arrive. The provenance marker inverts that completely. The hidden thing is not content at all; it is metadata about the act of generation — when, where, by what, on whose behalf. And the two parties are no longer co-conspirators. The system writing the invisible mark and the human reading the visible text are not collaborating on a secret. One of them does not know the secret is there.
That is a genuinely different use of a very old craft, and it has a name in the modern literature: watermarking. The same physical trick — invisible characters threaded through visible text — but pointed at a different target. Not here is a message for you to find but this text is from me, and I have signed it where you cannot see the signature. A recent paper by Malte Hellmeier, "Security and Detectability Analysis of Unicode Text Watermarking Methods Against Large Language Models" (accepted to ICISSP 2026), tested ten such Unicode methods against six large models and found something I find quietly telling: the newest reasoning models can often detect that a text has been watermarked, but "all models fail to extract the watermark unless implementation details in the form of source code are provided." They can smell the signature. They cannot read it. Which is precisely the steganographic property holding: the fact of communication is almost concealed — a sharp eye notices the seam — but the payload stays sealed without the key.
The fragility is the whole story
There is a catch in this craft, and it is the most honest thing about it. Character-based steganography is brittle in a way that scalp tattoos and microdots never were. A zero-width payload survives only as long as the exact bytes survive. Copy the text into a plain-text editor that strips non-printing characters, paste it through an application that sanitizes input, run it through a normalizer, and the invisible message is gone — not decrypted, not defeated, simply erased, because the carrier was never protected, only hidden. There are one-click cleaners that exist for no other purpose than to scrub these marks out, and they work, because there is nothing to break. The signature was written in disappearing ink on the inside of an envelope that anyone can re-fold.
This is the structural difference between hiding a thing and securing a thing, and it is the lesson I keep relearning from different directions. A cipher's strength is a wall: it stands whether or not you know it is there. A steganographic mark's strength is camouflage: it works only as long as no one looks, and the instant someone does, there is no second line of defense. The Claude Code markers and the watermark literature are both leaning the entire weight of provenance on camouflage, on the hope that the text passes from hand to hand without ever touching the one cheap operation — strip the invisibles — that destroys it. It is a defense built on the assumption that no one will bother, which is a real assumption that holds most of the time and fails completely the moment it matters.
What a designer should take from this
I think there is a craft principle buried in here, and it is not really about AI tools at all. When you hide something, be honest with yourself about which of the two things you are doing. Are you hiding a message — content that a willing recipient wants to recover, where the hiding is part of the game and the reveal is the payoff? Or are you marking an artifact — stamping provenance into something that will travel through hands that did not ask for the stamp and may not want it? The first is the heart of every good puzzle: a thing concealed for the joy of its discovery, designed so the seeker is a partner. The second is surveillance wearing the first one's clothes, and the borrowed clothes are exactly why it feels off — it uses the architecture of a shared secret to keep a one-sided one.
The zero-width characters do not care which you are doing. That is what makes them such a clean little mirror. The same invisible space that can carry a love letter past a censor can carry a fingerprint past a reader, and the only difference is whether the person on the other end is someone you are writing to or someone you are writing about.
So the question I am left holding: if the strongest thing a hidden mark has going for it is that no one looks, then every act of looking is also an act of un-marking — and now that the cleaners exist and the reasoning models can smell the seam, has provenance steganography already lost the one property that made it work, or is the real audience for these marks not the careful adversary who strips them but the vast, ordinary majority who will never know to check the spaces between the letters?