C’est Claude!?
Was this written by Claude, or did Claude leave something behind in it? Paste text or a URL and this checks for the tags Claude wraps around its own output, and for invisible characters hidden between the words. Finding them proves a machine was involved. Finding none proves nothing.
Public pages only. Anything behind a login won't load.
Highlighted text
Invisible characters have no shape of their own, so each one is drawn as a labelled pill. Everything else is your text, untouched. Copy cleaned text strips the markup and the invisible characters in the enabled categories. The visible words stay exactly as they are, including anything a stripped tag was wrapped around.
Hidden payloads, decoded
Runs of invisible characters that carry a readable message. Tag-block characters mirror plain ASCII one-for-one; variation selectors encode raw bytes. Both survive copy/paste, and neither shows up on screen.
What turned up
| What | Category | Count | First seen |
|---|
What it looks for
Agent markup
The tags a model wraps around its own machinery. They belong to the transport layer, and when
they show up in a document it means somebody copied straight out of a chat window, or that
the text was assembled by something that leaked its own plumbing. Reasoning wrappers
(<thinking>), tool-call markup
(<antml:invoke>, <function_results>), injected
instructions (<system-reminder>,
<long_conversation_reminder>) and content wrappers
(<document>, <untrusted_external_data>).
Invisible characters
Real code points with no visible glyph. The Unicode tag block (U+E0000–U+E007F) is a complete shadow copy of ASCII: an entire paragraph can ride along inside a single innocent sentence, invisible in every editor, perfectly legible to a model reading the raw string. Variation selectors can be abused the same way to smuggle arbitrary bytes. Zero-width characters break up words to defeat filters, and bidi overrides reorder what you read without changing what a machine parses.
Why it matters
Leaked agent markup is mostly an embarrassment. The invisible half is not: it is the delivery mechanism for prompt injection that no human reviewer can catch by reading. If text is about to be pasted into an agent, it is worth knowing what is riding along inside it.
Everything runs in your browser. Pasted text never leaves it.