We Fed Claude Code's System Prompt to GPT — Its Fingerprint Drifted Like a Different Model | Tosea.ai<br>EN

When we published our guide to verifying LLM APIs with behavioral fingerprints, the sharpest objection arrived within hours, and it is a good one:

"Can't a middlebox just prepend its own system prompt and wreck the fingerprint?"

Instead of arguing, we measured it. We captured the real system prompts that coding agents ship — Codex CLI's 3,252-token instructions, Claude Code's 6,651-token system block — injected them into clean models under controlled conditions, and watched what happened to the "pick a random number" distributions that fingerprinting depends on.

The short answer: yes, a hidden prompt can shift a model's fingerprint all the way into "different model" territory — and one specific injection did exactly that, moving GPT's fingerprint by a Jensen-Shannon distance of 0.46 when 0.463 is the published average distance between two genuinely different models.

The longer answer is more interesting, because the interference turns out to be lawful rather than random: it varies by model, by probe task, and by injection type in ways you can measure, rank, and defend against. This post walks through 5,660 controlled API calls' worth of evidence — what drifts, what survives, and what it means if you rely on a relay or aggregator.

The yardstick, in one paragraph

Everything below is measured in base-2 Jensen-Shannon divergence between answer distributions, the metric from One Token Is Enough (arXiv:2607.10252). Three published baselines give the scale meaning: the same model compared against itself lands around 0.14 ; the same model served by two different providers around 0.23 ; two genuinely different models around 0.46 . If an intervention pushes a model's fingerprint ~0.46 away from its own baseline, the model has become — behaviorally — someone else. (New to the method? Start with the original guide; this post is the stress test.)

Experiment 1: inject real CLI prompts, watch the dice change

The setup is a faithful simulation of what a reverse-proxy reseller does: your one-word probe question stays untouched, but a large hidden context is prepended above it. We took two clean, pinned endpoints — GPT‑5.5 via a major aggregator with the provider locked, and official gpt-4o-mini — and probed each under four conditions: a minimal baseline prompt, the real Codex CLI instructions (+3,252 tokens), the real Claude Code system block (+6,651 tokens, captured off the wire from an actual client session), and a control of equal-length meaningless filler (+3,240 tokens) to separate "content" from "sheer bulk". Four probe tasks, 40 samples each, temperature 1.0, reasoning disabled.

The drift, relative to each model's own clean baseline:

Injected contextGPT‑5.5gpt-4o-miniCodex CLI prompt (+3,252 tokens)0.1610.107Claude Code prompt (+6,651 tokens) 0.462 0.441 Equal-length filler (+3,240 tokens)0.3550.066

Two findings deserve to be spelled out.

The Claude Code prompt pushed both models into the different-model band. Not subtly: GPT‑5.5's random-color distribution collapsed from a healthy spread (entropy 1.97 bits) to blue, 40 out of 40 times — entropy zero. Its random-animal answers switched language entirely, with 30 of 40 responses arriving in Chinese. (Honesty note: our captured Claude Code prompt includes a user language preference that the client genuinely writes into its system block, so the language flip partly reflects that local configuration — but the color collapse and number shifts stand regardless of it.) gpt-4o-mini behaved the same way: colors collapsed to blue 37/40, animals drifted cross-language. If you fingerprinted these endpoints without knowing about the injection, you would conclude — correctly, in a behavioral sense — that you were not talking to the model you think you are.

Length alone can move the dice, and it depends on the model. The filler control is the result we did not expect. For gpt-4o-mini, 3,240 tokens of meaningless padding did almost nothing (0.066 — comfortably inside same-model territory): it only reacts to content. GPT‑5.5, by contrast, drifted 0.355 on padding alone, and its single most famous habit inverted — the model that answers "pick a number between 1 and 100" with 47 almost every time (39/40 at baseline) switched to 42 (24/40) with nothing but noise above the question. Same question, same model, different dice — because the context got longer.

That asymmetry matters methodologically: you cannot test one model's robustness and extrapolate to another's . Which is why we ran a second, wider study.

Experiment 2: a severity ladder for prompt interference

Round two: 3 models (GPT‑5.5, deepseek-chat, glm-4.5, each pinned to a fixed provider), 6 probe tasks, and 6 context conditions ranging from innocent to adversarial — 3,900 requests in total. Averaged across tasks, the drift ladder looks like this:

Hidden context above your requestFingerprint drift (range...