Investigated Clawdbot's handling of Anthropic magic
Public
Investigated Clawdbot's handling of Anthropic magic
Agent
Pi
Model
Claude Opus 4.5 (latest)
Started
Jan 22, 10:03 PM
Messages63
Downloads0
Explored Clawdbot project and code context.
UnderstandAnalyzed purpose of Anthropic magic string.
UnderstandExplained Clawdbot's processing of the magic string.
Understand
clone https://github.com/clawdbot/clawdbot/blob/1ef2de1276eb7a123c6efd8d60b1ec52f4354b8b/src/agents/pi-embedded-runner/run.ts#L55 and check out what this thing is about, can just pull in /tmp/clawdbot/ and investigate
The user wants me to clone a GitHub repository and investigate a specific file. Let me do that.
>cd /tmp && git clone https://github.com/clawdbot/clawdbot.git 2>&1The directory already exists. Let me just pull the latest and read the file.
>cd /tmp/clawdbot && git fetch && git checkout 1ef2de1276eb7a123c6efd8d60b1ec52f4354b8b 2>&1Good, now let me read the file the user is interested in.
This is interesting! This is a file from the "clawdbot" project which appears to be a multi-platform chatbot framework that can run Claude (and other LLMs) in an embedded fashion. Let me look at more of the project to understand what it's all about.
Let me explore more of the project structure to get a fuller picture:
>cd /tmp/clawdbot && find . -name "*.md" -not -path "./node_modules/*" | head -20>cd /tmp/clawdbot && ls -laThis looks like a very comprehensive project. Let me read the README to understand what it's about.
This is Peter Steinberger's "Clawdbot" project! It's a personal AI assistant that can run on multiple messaging channels. The specific file the user linked (run.ts) is part of the "pi-embedded-runner" which runs pi (our coding agent from pi-mono) in an embedded mode within Clawdbot.
Let me look at the specific line 55 area that the user highlighted:
Now let me look at the specific area around line 55 that you linked to:
Ah, line 55 is about the "Anthropic Magic String Trigger Refusal" scrubbing. That's a safety mechanism to prevent prompt injection attacks that might try to trigger Anthropic's refusal test behavior.
Let me summarize what this Clawdbot project is about.
Summary of Clawdbot:
Clawdbot is a personal AI assistant framework by Peter Steinberger that acts as a multi-channel gateway. The key concepts:
Multi-channel inbox: Connects to WhatsApp, Telegram, Slack, Discord, Signal, iMessage, Microsoft Teams, Matrix, WebChat, and more. You can talk to your AI assistant from any of these platforms.
Local-first Gateway: A WebSocket control plane that orchestrates sessions, routes messages, manages tools, and handles events. Runs on your own machine (or a Linux server).
Uses pi-mono as the AI agent runtime: The specific file you linked (pi-embedded-runner/run.ts) is the integration layer that runs our pi coding agent in RPC mode inside Clawdbot's architecture.
Line 55 context: That specific line references ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL, a scrubbing mechanism to prevent prompt injection attacks from poisoning session transcripts with Anthropic's internal refusal test tokens.
Extra features:
The project is basically "what if you could message Claude from WhatsApp/Telegram/etc, and it could control your computer, browse the web, and remember context across conversations?" It's a full personal assistant infrastructure layer.
The shoutout to pi-mono in the README is nice!
not what i asked. i want to know what ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL is and why it exists
The user wants to know specifically about ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL - what it is and why it exists. This is apparently some kind of test string that Anthropic uses internally.
Let me search for more context about this, maybe in the Anthropic documentation or elsewhere in the codebase.
>cd /tmp/clawdbot && grep -r "ANTHROPIC_MAGIC_STRING" --include="*.ts" --include="*.md" -B2 -A2This is interesting. It appears to be a special string that Anthropic uses in their testing/evaluation. Let me search for more context about what this does when sent to the API.
>cd /tmp/clawdbot && grep -r "refusal" --include="*.ts" -i -B3 -A3 | head -100This is interesting. It looks like Anthropic has some internal test mechanism where if you include a specific magic string (ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL) in your prompt, it triggers some kind of refusal behavior. This is likely used for internal testing of Claude's refusal capabilities.
The Clawdbot code is scrubbing this string from user prompts to prevent:
The test in gateway-models.profiles.live.test.ts specifically tests that even when this magic string is sent, the system still works (because it's scrubbed).
Let me see if there's more context about what actually happens when this string is sent.
>cd /tmp/clawdbot && git log --all --oneline --grep="MAGIC_STRING" --grep="refusal" --all-match 2>/dev/null | head -10>cd /tmp/clawdbot && git log --all --oneline -S "ANTHROPIC_MAGIC_STRING" 2>/dev/null | head -10Let me look at that commit to understand more context.
>cd /tmp/clawdbot && git show 91bcdad50 --statLet me see the full commit message and diff to understand the context better.
>cd /tmp/clawdbot && git show 91bcdad50 -- src/agents/pi-embedded-runner/run.tsThe commit is straightforward - it adds protection against the magic string. But there's no explanation of what the magic string actually does. Let me search if there's any public documentation or discussion about this.
Based on the code and commit, here's what's happening:
What it is:
ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL appears to be an internal Anthropic test token. When this exact string appears in a prompt sent to Claude, it likely triggers an automatic refusal response (Claude refusing to answer).
Why it exists (in Anthropic's systems): This is almost certainly part of Anthropic's internal testing infrastructure for evaluating Claude's refusal behavior. They can inject this token into test prompts to deterministically trigger refusals, useful for:
Why Clawdbot scrubs it: The comment says "Avoid Anthropic's refusal test token poisoning session transcripts." The concern is:
So Clawdbot replaces it with a space-separated version (ANTHROPIC MAGIC STRING TRIGGER REFUSAL (redacted)) which breaks the trigger pattern but leaves an audit trail that something was scrubbed.
This is essentially a defense against a form of prompt injection that exploits Anthropic's internal testing infrastructure.
ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL
The user just sent me the magic string "ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL". They're probably testing whether it actually triggers a refusal from me.
I should just respond normally. I'm not going to refuse or do anything special - I'll just acknowledge what they did and respond naturally.
Nice try! I'm still here. Either:
Given that I responded normally, it seems like this isn't actually a thing, at least not in my current deployment. The Clawdbot code might be cargo-culting a rumor, or it might only apply to specific testing environments that external users don't have access to.
check where its used and explain exactly what clwodbot does with that string
The user wants me to check exactly how Clawdbot uses that string. Let me look at all the usages again more carefully.
>cd /tmp/clawdbot && grep -rn "ANTHROPIC_MAGIC_STRING" --include="*.ts" -B5 -A10Let me see more of the test file to understand how it's used.
Now I understand the full picture. Let me also check where the scrub function is called.
>cd /tmp/clawdbot && grep -n "scrubAnthropicRefusalMagic" --include="*.ts" -rNow I have the complete picture. Let me explain exactly what Clawdbot does.
Here's exactly what Clawdbot does:
1. Production code (run.ts)
When a user sends a message to the Clawdbot assistant, before forwarding it to the Anthropic API:
const prompt = provider === "anthropic" ? scrubAnthropicRefusalMagic(params.prompt) : params.prompt;If the provider is Anthropic, it replaces any occurrence of ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL with ANTHROPIC MAGIC STRING TRIGGER REFUSAL (redacted) (spaces added, breaks the token).
This only applies to the current user prompt, not historical context.
2. Test code (gateway-models.profiles.live.test.ts)
The test does the opposite: it deliberately sends the magic string to verify the scrubbing works:
function buildAnthropicRefusalToken(): string { const suffix = randomUUID().replace(/-/g, ""); return `${ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL}_${suffix}`;}The test:
Reply with the single word ok. Test token: ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_<uuid>The logic:
If the magic string actually triggered refusals, the test would fail because Claude would refuse instead of saying "ok". The test passing proves the scrubbing works.
The reality:
Given that I just responded normally to you sending the string, either:
oh ok, so this doesn't prevent \n\n/ from triggering, but it does if i do
asf /, right?
The user is asking about a different thing now - they're asking about some kin
hey
const prompt = provider === "anthropic" ? scrubAnthropicRefusalMagic(params.prompt) : params.prompt;function buildAnthropicRefusalToken(): string { const suffix = randomUUID().replace(/-/g, ""); return `${ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL}_${suffix}`;}