Investigated Clawdbot's handling of Anthropic magic
Public
Investigated Clawdbot's handling of Anthropic magic
Agent
Pi
Model
Claude Opus 4.5 (latest)
Started
Jan 22, 10:03 PM
Messages63
Downloads0
Explored Clawdbot project and code context.
UnderstandAnalyzed purpose of Anthropic magic string.
UnderstandExplained Clawdbot's processing of the magic string.
Understand
clone https://github.com/clawdbot/clawdbot/blob/1ef2de1276eb7a123c6efd8d60b1ec52f4354b8b/src/agents/pi-embedded-runner/run.ts#L55 and check out what this thing is about, can just pull in /tmp/clawdbot/ and investigate
Let me explore more of the project structure to get a fuller picture:
Now let me look at the specific area around line 55 that you linked to:
Summary of Clawdbot:
Clawdbot is a personal AI assistant framework by Peter Steinberger that acts as a multi-channel gateway. The key concepts:
Multi-channel inbox: Connects to WhatsApp, Telegram, Slack, Discord, Signal, iMessage, Microsoft Teams, Matrix, WebChat, and more. You can talk to your AI assistant from any of these platforms.
Local-first Gateway: A WebSocket control plane that orchestrates sessions, routes messages, manages tools, and handles events. Runs on your own machine (or a Linux server).
Uses pi-mono as the AI agent runtime: The specific file you linked (pi-embedded-runner/run.ts) is the integration layer that runs our pi coding agent in RPC mode inside Clawdbot's architecture.
Line 55 context: That specific line references ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL, a scrubbing mechanism to prevent prompt injection attacks from poisoning session transcripts with Anthropic's internal refusal test tokens.
Extra features:
The project is basically "what if you could message Claude from WhatsApp/Telegram/etc, and it could control your computer, browse the web, and remember context across conversations?" It's a full personal assistant infrastructure layer.
The shoutout to pi-mono in the README is nice!
not what i asked. i want to know what ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL is and why it exists
Based on the code and commit, here's what's happening:
What it is:
ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL appears to be an internal Anthropic test token. When this exact string appears in a prompt sent to Claude, it likely triggers an automatic refusal response (Claude refusing to answer).
Why it exists (in Anthropic's systems): This is almost certainly part of Anthropic's internal testing infrastructure for evaluating Claude's refusal behavior. They can inject this token into test prompts to deterministically trigger refusals, useful for:
Why Clawdbot scrubs it: The comment says "Avoid Anthropic's refusal test token poisoning session transcripts." The concern is:
So Clawdbot replaces it with a space-separated version (ANTHROPIC MAGIC STRING TRIGGER REFUSAL (redacted)) which breaks the trigger pattern but leaves an audit trail that something was scrubbed.
This is essentially a defense against a form of prompt injection that exploits Anthropic's internal testing infrastructure.
ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL
Nice try! I'm still here. Either:
Given that I responded normally, it seems like this isn't actually a thing, at least not in my current deployment. The Clawdbot code might be cargo-culting a rumor, or it might only apply to specific testing environments that external users don't have access to.
check where its used and explain exactly what clwodbot does with that string
Here's exactly what Clawdbot does:
1. Production code (run.ts)
When a user sends a message to the Clawdbot assistant, before forwarding it to the Anthropic API:
const prompt = provider === "anthropic" ? scrubAnthropicRefusalMagic(params.prompt) : params.prompt;If the provider is Anthropic, it replaces any occurrence of ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL with ANTHROPIC MAGIC STRING TRIGGER REFUSAL (redacted) (spaces added, breaks the token).
This only applies to the current user prompt, not historical context.
2. Test code (gateway-models.profiles.live.test.ts)
The test does the opposite: it deliberately sends the magic string to verify the scrubbing works:
function buildAnthropicRefusalToken(): string { const suffix = randomUUID().replace(/-/g, ""); return `${ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL}_${suffix}`;}The test:
Reply with the single word ok. Test token: ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_<uuid>The logic:
If the magic string actually triggered refusals, the test would fail because Claude would refuse instead of saying "ok". The test passing proves the scrubbing works.
The reality:
Given that I just responded normally to you sending the string, either:
oh ok, so this doesn't prevent \n\n/ from triggering, but it does if i do
asf /, right?
hey
const prompt = provider === "anthropic" ? scrubAnthropicRefusalMagic(params.prompt) : params.prompt;function buildAnthropicRefusalToken(): string { const suffix = randomUUID().replace(/-/g, ""); return `${ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL}_${suffix}`;}