I was in­spect­ing Claude Code for pri­vacy rea­sons.

Most devs give their har­nesses ridicu­lous ac­cess. FS, shell, git, browser ac­cess, even com­puter use nowa­days. That is the whole point. They need enough con­text to do use­ful work.

That also means the client it­self de­serves scrutiny. If a cod­ing agent can read your repo and run com­mands, the bi­nary that ships it should be bor­ing (ƒor ex­am­ple, pi har­ness)

So I took a look at my lo­cal Claude Code (2.1.196) in­stall.

Inside the Claude Code bi­nary, there is a func­tion that changes the cur­rent date string in­serted into the sys­tem prompt.

The nor­mal string looks like this:

Claude Code can silently change two things:

The apos­tro­phe in Today’s

The date sep­a­ra­tor, from - to /

Here is the rel­e­vant code, cleaned up from the mini­fied bun­dle:

This is prompt steganog­ra­phy, a tech­nique used to hide data in plain sight.

The vis­i­ble sen­tence still reads like a nor­mal date. The model and the user see some­thing bor­ing. The raw re­quest con­tains a marker.

The trig­ger is ANTHROPIC_BASE_URL, Claude Code’s API base URL over­ride.

Then it checks if:

the sys­tem time­zone is Asia/Shanghai or Asia/Urumqi

the API base URL host­name matches a de­coded do­main list

the host­name con­tains spe­cific AI lab key­words

The time­zone check changes:

into:

The host­name check changes the apos­tro­phe:

These are vi­su­ally tiny changes you would never no­tice in most mono fonts.

The do­main and key­word lists are stored as base64 strings and XOR-decoded with key 91.

The de­coded lab key­word list is:

The de­coded do­main list is much larger. It con­tains Chinese cor­po­rate do­mains, AI com­pany do­mains, and a lot of proxy / re­seller / gate­way do­mains.

Some ex­am­ples:

The date func­tion is used when build­ing the agent con­text:

So the marker be­comes part of the sys­tem con­text sent to the model. (Where Anthropic prob­a­bly parses in their back­end)

My in­stalled bi­nary is signed by Anthropic:

My cur­rent shell had ANTHROPIC_BASE_URL un­set, and my time­zone was:

So on my ma­chine, un­der my cur­rent en­vi­ron­ment, this path would pro­duce the nor­mal apos­tro­phe and the nor­mal YYYY-MM-DD date string.

Anthropic prob­a­bly wants to de­tect API re­sellers, unau­tho­rized Claude Code gate­ways, and model “distillation at­tack” pipelines. A cus­tom ANTHROPIC_BASE_URL point­ing at a known re­seller do­main is a use­ful sig­nal. A host­name con­tain­ing deepseek or zhipu is also a use­ful sig­nal.

That part makes sense, but the im­ple­men­ta­tion is weird.

CC silently al­ters the sys­tem prompt us­ing in­vis­i­ble-ish Unicode mark­ers. It en­codes proxy / gate­way clas­si­fi­ca­tion into a sen­tence that looks like plain English. It hides the do­main list be­hind XOR and base64. This is not a ma­li­cious fea­ture, but it is a weird choice for a de­vel­oper tool that asks for trust.

Coding agents al­ready live on the wrong side of a scary bound­ary. They can in­spect code, sum­ma­rize se­crets by ac­ci­dent, run com­mands, in­stall pack­ages, edit files, and push com­mits on your lo­cal ma­chine. Most de­vel­op­ers ac­cept that be­cause the pro­duc­tiv­ity gain is worth the risk.

Trust from real de­vel­op­ers de­pends on the bor­ing be­hav­ior.

If the client wants to de­tect cus­tom API gate­ways, it can say so plainly. It can send an ex­plicit teleme­try field with doc­u­men­ta­tion. It can make the pol­icy vis­i­ble. It can put the be­hav­ior in re­lease notes.

Hiding the sig­nal in the sys­tem prompt makes every other pri­vacy claim harder to be­lieve.

For most users, this path prob­a­bly stays in­ac­tive.

If you are us­ing the of­fi­cial Anthropic API end­point, Crt() re­turns early. If ANTHROPIC_BASE_URL is un­set, Crt() re­turns early. If you are us­ing a nor­mal setup, the date prompt stays “boring”.

The in­ter­est­ing case is peo­ple rout­ing CC through a cus­tom base URL. That in­cludes:

Internal gate­ways

Local prox­ies

Model routers

Resellers

Research se­tups

In that case, Claude Code clas­si­fies the host­name and en­codes the re­sult into the prompt.

The by­pass is also triv­ial. Change host­name, change time­zone, patch the bi­nary, wrap the process. Any se­ri­ous ad­ver­sary can make this sig­nal use­less.

So the fea­ture mostly pun­ishes the ex­act peo­ple who are eas­ier to fin­ger­print: nor­mal de­vel­op­ers do­ing weird but le­git­i­mate things.

I think this could have been ex­plicit.

Developer tools can en­force terms. API providers can de­tect abuse. Companies can pro­tect their mod­els.

When a tool with filesys­tem and shell ac­cess starts hid­ing clas­si­fi­ca­tion bits in­side in­vis­i­ble prompt punc­tu­a­tion, the cor­rect re­ac­tion is scrutiny.

Trust is earned in the bor­ing parts.

Seth Stern is the di­rec­tor of ad­vo­cacy for Freedom of the Press Foundation.

Jeremy Busby is a writer and ac­tivist in­car­cer­ated in Texas.

The Trump ad­min­is­tra­tion at­tack­ing the right to pub­lish or re­port in­for­ma­tion is a given at this point. The pres­i­dent has threat­ened jour­nal­ists for every­thing from ques­tion­ing the wis­dom of his failed war with Iran to touch­ing the peeled lin­ing of his ren­o­vated re­flect­ing pool.

Tantrums like those may now feel rou­tine, but this week marked a new front in Trump’s war on in­for­ma­tion: Daniel “Des” Sanchez Estrada was sen­tenced to 30 years in fed­eral prison for trans­port­ing a box of zines he did­n’t even write. He’s one of eight de­fen­dants sen­tenced on Tuesday to a com­bined 450 years — the first prison sen­tences against so-called “antifa” handed down un­der the frame­work of NSPM-7, President Donald Trump’s sweep­ing “counterterrorism” mem­o­ran­dum to clamp down on dis­sent from the left.

The pros­e­cu­tion’s the­ory was that Sanchez moved the zines, which dis­cussed an­ar­chism and other anti-gov­ern­ment ideas, to con­ceal ev­i­dence in the case against his wife, Maricela Rueda. Rueda at­tended a July 4, 2025, protest at the Prairieland im­mi­gra­tion jail in Texas where a po­lice of­fi­cer was shot. (She was not ac­cused of shoot­ing him or hav­ing any­thing to do with the shoot­ing but was her­self sen­tenced to 70 years.)

But that nu­ance is cold com­fort: It as­sumes that sim­ply pos­sess­ing years-old po­lit­i­cal pam­phlets that said noth­ing about the protest or shoot­ing could some­how con­sti­tute ev­i­dence of a crime. Sharing the po­lit­i­cal ide­ol­ogy of the shooter, the gov­ern­ment con­tended, meant Rueda and her co-de­fen­dants were cul­pa­ble for the shooter’s ac­tions — and by al­legedly at­tempt­ing to pre­vent of­fi­cers from find­ing out about Rueda’s ide­ol­ogy, Sanchez shared in the blame as well.

We’ve reached the point in the ero­sion of the First Amendment where the gov­ern­ment con­sid­ers pos­ses­sion of an­ar­chist zines and mem­ber­ship in a ter­ror­ist cell to be more or less the same thing. Once the box of zines was dis­cov­ered, there was no need to prove Rueda planned or had any idea that any­one would be shot at the protest.

What’s worse is that this will likely only ramp up the ad­min­is­tra­tion’s ef­forts to crim­i­nal­ize be­ing in pos­ses­sion of in­for­ma­tion. Whatever you may think of for­mer CNN host Don Lemon, he’s no an­ar­chist or ex­trem­ist, and the con­tent of his broad­casts bears lit­tle re­sem­blance to the zines Sanchez was con­victed of trans­port­ing. And yet, af­ter in­dict­ing him and in­de­pen­dent jour­nal­ist Georgia Fort on friv­o­lous charges re­lat­ing to their livestream­ing of a protest at a Minnesota church, the gov­ern­ment sought a war­rant to ob­tain the iden­ti­ties of sub­scribers to their YouTube chan­nels.

This will likely only ramp up the ad­min­is­tra­tion’s ef­forts to crim­i­nal­ize be­ing in pos­ses­sion of in­for­ma­tion.

This will likely only ramp up the ad­min­is­tra­tion’s ef­forts to crim­i­nal­ize be­ing in pos­ses­sion of in­for­ma­tion.

Fortunately, a judge re­jected that war­rant. But it’s a chill­ing rev­e­la­tion of the ad­min­is­tra­tion’s modus operandi. Lemon and Fort’s YouTube sub­scribers would, of course, have no knowl­edge of what hap­pened at the church protest be­yond what was pub­licly broad­cast. Their iden­ti­ties are as ir­rel­e­vant to whether Lemon and Fort com­mit­ted a crime as the box of zines was to Rueda’s case. The only con­ceiv­able rea­son the gov­ern­ment might want a list of YouTube sub­scribers is to keep an eye on peo­ple who watch dis­fa­vored shows.

And let’s say some­one who’d watched Lemon and Fort’s livestreams and then heard about their ar­rests had cleared their browser his­tory be­cause they (rightly) feared the ad­min­is­tra­tion might tar­get them. Could they then be pros­e­cuted for con­ceal­ing ev­i­dence un­der the same logic ap­plied to Sanchez? If they’d down­loaded the video, could they be ac­cused of pos­sess­ing con­tra­band? Would for­ward­ing a link equate to traf­fick­ing?

It all sounds pre­pos­ter­ous, but vir­tu­ally noth­ing is too ab­surd for this Department of Justice. In fact, it’s al­ready ar­gued that doc­u­ments in­ves­tiga­tive re­porters re­ceive from whistle­blower sources can con­sti­tute con­tra­band. (It’s worth point­ing out that Joe Biden’s DOJ used this same logic when it pur­sued its own ridicu­lous “transporting” of in­for­ma­tion case against Project Veritas for mov­ing Ashley Biden’s di­ary across state lines).

These friv­o­lous ac­tions cre­ate a catch-22 for all Americans. The more peo­ple are in­ves­ti­gated for en­gag­ing with ideas the ad­min­is­tra­tion deems dan­ger­ously anti-gov­ern­ment, the more likely oth­ers are to con­ceal ev­i­dence of their own con­tro­ver­sial be­liefs — not be­cause they are ev­i­dence of any real crime but be­cause pros­e­cu­tors are out of con­trol. But if they do so, they risk in­crim­i­nat­ing them­selves.

NSPM-7, which was is­sued last September, tasks fed­eral agen­cies with dis­man­tling net­works of “anti-fascist” ac­tors, a pur­posely overly broad term since ex­panded to in­clude those with “extreme view­points on im­mi­gra­tion, rad­i­cal gen­der ide­ol­ogy, and anti-Amer­i­can sen­ti­ment.”

Given that an­tifa, as a sin­gu­lar, co­he­sive or­ga­ni­za­tion, is a fig­ment of the right’s imag­i­na­tion, agents can­not ac­com­plish that task by un­cov­er­ing a mem­ber­ship reg­istry. They can only do so by iden­ti­fy­ing peo­ple with view­points they con­sider “extreme,” like anti-ICE pro­test­ers of­fi­cers have told they’re be­ing added to watch­lists, or pro-Pales­tine opin­ion writ­ers they’ve sought to de­port.

In Chicago and other cities ICE in­vaded, ac­tivists and or­ga­niz­ers pack­aged whis­tles and zines to dis­trib­ute to res­i­dents. Under the logic of NSPM-7 and Sanchez Estrada’s con­vic­tion, that is a net­work of ac­tors en­gaged in or­ga­nized po­lit­i­cal vi­o­lence. If you read one of their zines, you could be deemed a mem­ber of an il­licit en­ter­prise, and if you hide one, you’re cov­er­ing for crim­i­nals.

The gov­ern­ment ar­gued that the Prairieland de­fen­dants are dif­fer­ent. One pros­e­cu­tor said: “People with that kind of ex­trem­ist be­liefs need ex­tra time in prison. They be­lieve vi­o­lence is jus­ti­fied.” U.S. District Judge Reed O’Connor, in hand­ing down the sen­tences, re­port­edly said he wanted to “send a mes­sage to any­one who shares a sim­i­lar ide­ol­ogy.” But lots of peo­ple be­lieve po­lit­i­cal vi­o­lence is some­times jus­ti­fied. If some­one who be­lieves punch­ing Nazis is jus­ti­fied at­tends an anti-Nazi protest where some­one else punches a Nazi, are they at risk of be­ing con­victed of as­sault along­side the ac­tual as­sailant, par­tic­u­larly if they have some anti-Nazi lit­er­a­ture on their book­shelf? The an­swer is far less ob­vi­ous than it used to be.

The ad­min­is­tra­tion has vowed the Prairieland case “will not be the last” of its kind. We must take it at its word. The next one might also in­volve pro­test­ers from the po­lit­i­cal fringes rather than or­di­nary Americans read­ing, say, The Intercept, or watch­ing Don Lemon on YouTube. But what about the one af­ter that? We’re not as far away as you might think. Stephen Miller has called the whole Democratic Party a “domestic ex­trem­ist or­ga­ni­za­tion” — clearly in­vok­ing the lan­guage of NSPM-7. Trump has la­beled his po­lit­i­cal op­po­nents “the en­emy within” and the press “the en­emy of the peo­ple.”

Whoever said slip­pery slopes are a fal­lacy never met Donald Trump. If Sanchez Estrada in­deed moved the zines be­cause he fore­saw their be­ing used to tie his wife to a nonex­is­tent ter­ror­ist net­work and a shoot­ing, he should be com­mended for his pre­science. Maybe more of us should think like Sanchez Estrada.

Or would that be a crime?

The Internet is the most pow­er­ful com­mu­ni­ca­tion tool ever cre­ated, yet the in­fra­struc­ture un­der­pin­ning it has been lever­aged by the tech in­dus­try to ex­tract our data and ex­ploit our at­ten­tion. The Human-Centered Computing Foundation seeks to change this dy­namic by cre­at­ing an al­ter­na­tive ar­chi­tec­ture for the web. As an ap­proved par­tic­i­pant in ICANN’s Applicant Support Program (ASP), we are of­fi­cially launch­ing our cam­paign to se­cure a new Top-Level Domain (TLD) ded­i­cated en­tirely to eth­i­cal, hu­man-cen­tered tech­nol­ogy.

To ex­plore our vi­sion for how a hu­man-cen­tered TLD would func­tion, read, down­load, and share our full ini­tia­tive overview be­low:

We went there to cover it. We put ques­tions to se­nior politi­cians, in­clud­ing the US am­bas­sador to Belgium, Bill White. After at­tempt­ing to ask a ques­tion, we were pulled out of the event by po­lice, had our IDs taken and were then ques­tioned — be­fore the em­bassy in­structed the po­lice to es­cort us off the grounds en­tirely. The of­fi­cers, we later learned, had been told that Samuel was an “active threat.”

This is what hap­pened.

A 250th birth­day, paid for by pri­vate com­pa­nies.

A 250th birth­day, paid for by pri­vate com­pa­nies.

Under Donald Trump, the US is throw­ing par­ties to mark the 250th an­niver­sary of the US Declaration of Independence. But these are not, as you might think, of­fi­cial, Congress-approved par­ties, but or­gan­ised by a pri­vate com­pany called Freedom 250.

The Brussels edi­tion is the only one of its kind in Europe. Dozens of European and American com­pa­nies con­tributed around €3 mil­lion to it. The three American em­bassies in Brussels — to Belgium, the EU, and NATO — rented out Parc du Cinquantenaire.

It was filled with at­tempts at American cul­tural ex­ports such as American foot­ball (whose play­ers were Belgian), cheer­lead­ers (from Antwerp), Philly Cheesesteaks (also made by Belgians), Mac and Cheese, and Budweiser (owned by a Belgian com­pany).

And the au­di­ence? Several thou­sand, mainly of­fi­cials work­ing in em­bassies and in­sti­tu­tions, as well as spon­sors and big com­pa­nies. Either way: less than the 8,000+ that the em­bassy was hop­ing to get.

A few days be­fore the event, Samuel had pub­lished on his Instagram that am­bas­sador White tac­itly threat­ened an American and Belgian res­i­dent af­ter that cit­i­zen urged the American coun­try mu­sic band Zac Brown Band not to per­form at the event, a story he is still re­port­ing and will fol­low up in more de­tail soon.

So when we reached the am­bas­sador on Sunday evening, we asked him about it and filmed the ex­change. A per­son who we as­sume was his press of­fi­cer told us we were not al­lowed to ask any ques­tions, and that was that.

About 20 min­utes later, roughly eight Belgian po­lice of­fi­cers in plain clothes sur­rounded us and pulled us out of the event. None of them wore vis­i­ble iden­ti­fi­ca­tion, only flash­ing a badge for a short enough time not to reg­is­ter. When we first asked who they were, they phys­i­cally pushed us, said “we are po­lice,” and or­dered us to come with them im­me­di­ately.

For the next 15 min­utes or so, the of­fi­cers con­fis­cated our IDs and ques­tioned us. They asked whether The European Correspondent had a po­lit­i­cal lean­ing, whether we had an agenda, and how we had got into the event (that the American em­bassy in­vited us to).

Eventually, they ac­cepted that we were jour­nal­ists and that they dis­agreed with de­tain­ing us. They were “just do­ing their job,” they told us. It be­came clear that the of­fi­cers had been given no real in­for­ma­tion about who we were, only that he was an “active threat” (which could mean a phys­i­cal threat), and needed to be de­tained, iden­ti­fied, and re­moved. That’s prob­a­bly why the de­ten­tion was ag­gres­sive and con­ducted with­out dis­cus­sion.

Even af­ter the of­fi­cers recog­nised their mis­take, the em­bassy told them we were no longer per­mit­ted in­side, and they es­corted us out — out of an event we had been in­vited to at­tend as press.

Open ques­tions

Open ques­tions

Much about the evening is still un­clear.

It is un­clear who ex­actly paid how much for the party. It is un­clear whether the po­lice pres­ence that re­moved us was paid for by the American or­gan­is­ers or by Belgian tax­pay­ers. It is un­clear how much the em­bassy paid for rent­ing the park.

And it is un­clear who has com­pen­sated the shops and restau­rants around the Cinquantenaire that were forced to close for days be­cause of the se­cu­rity op­er­a­tion around the event.

Being asked for clar­i­fi­ca­tion about the de­ten­tion the day af­ter, Bill White con­fused us with the writer of the let­ter to the Zac Brown Band and said that we were both “losers”, re­fus­ing to give us any ex­pla­na­tion.

We have reached out to Belgian au­thor­i­ties for clar­i­fi­ca­tion and European politi­cians pre­sent at the event for com­ment.

European gov­ern­ments are rolling out dig­i­tal iden­tity wal­lets, which are to be used by cit­i­zens to ac­cess ser­vices, and to ver­ify their age on­line. As re­ported by Follow the Money and Android Authority, there is a se­ri­ous prob­lem with this: these wal­lets rely on safety ser­vices of Google and Apple. These are known as Google Play Integrity API, and Apple’s Managed Device Attestation1. Such safety ser­vices (known as “remote at­tes­ta­tion”) are used to en­sure that wal­let apps run on hard­ware that is not tam­pered with. In this ar­ti­cle we ex­plain why the EU-wallet case is part of a big­ger prob­lem: by em­bed­ding these safety ser­vices in pub­lic in­fra­struc­ture, Europe risks mak­ing so­ci­ety de­pen­dent on pri­vate com­pa­nies while serv­ing their cor­po­rate in­ter­ests.

Here is the prob­lem:

Google’s Play Integrity API is not just a se­cu­rity fea­ture: it is re­in­forc­ing Google’s con­trol over the Android ecosys­tem.

Google’s Play Integrity API is an in­struc­tive case for how big tech plat­form com­pa­nies ac­crue power. The API is a free piece of soft­ware that Google gifts to de­vel­op­ers to help with their app de­vel­op­ment. It al­lows de­vel­op­ers to check whether an app is run­ning on a “genuine cer­ti­fied Android de­vice” to test the in­tegrity of a mo­bile de­vice. This can help de­vel­op­ers re­duce abuse by bots, fraud in bank­ing apps, or cheat­ing in game apps.

But in do­ing so, it also checks whether a de­vice is run­ning a Google-licensed ver­sion of Android and treats un­li­censed al­ter­na­tives as a po­ten­tial se­cu­rity risk. When Google ver­i­fies whether an app has been tam­pered with, it uses the Google Play Store as the source of truth, check­ing both whether the app has been mod­i­fied and whether it was in­stalled through the Play Store. As a re­sult, Google’s safety ser­vice is de­signed to ex­clude op­er­at­ing sys­tems that are not li­censed by Google, en­cour­age in­stal­la­tion through the Google Play Store, and re­quire users to sign in with a Google ac­count. This is a clear vi­o­la­tion of the Digital Market Act (DMA).

We do have a choice. A more open al­ter­na­tive to Google Play Integrity ex­ists but is be­ing ig­nored: Android’s Hardware Attestation API. It pro­vides hard­ware-based se­cu­rity checks but with­out en­forc­ing Google’s ecosys­tem pol­icy.

Governments are ce­ment­ing a mo­nop­oly they claim to op­pose

The EU of­ten states that it wants to break the big tech mo­nop­oly. Yet, European mem­ber states risk re­in­forc­ing Google’s ecosys­tem when they em­bed the Google Play Integrity API into their dig­i­tal ID wal­let ar­chi­tec­ture. For ex­am­ple, wal­let de­vel­op­ers in the Netherlands and Italy have im­ple­mented Play Integrity. As a re­sult, users of de-Googled op­er­at­ing sys­tems such as e/​OS and GrapheneOS can be ex­cluded from ac­cess­ing these ser­vices.

In this way, gov­ern­ments ef­fec­tively be­come en­forcers of a pri­vate com­pa­ny’s plat­form poli­cies. This stands in ten­sion with Europe’s am­bi­tion to build dig­i­tal pub­lic in­fra­struc­ture based on pub­lic val­ues such as open­ness, in­clu­sive­ness, and tech­no­log­i­cal sov­er­eignty. It also stands in ten­sion with the reg­u­la­tion un­der­pin­ning the EU’s iden­tity wal­let, which iden­ti­fies in­ter­op­er­abil­ity as a key ob­jec­tive. Users who want the au­ton­omy to use op­er­at­ing sys­tems with­out pre-in­stalled Google soft­ware, Google track­ers, and built-in LLMs, are forced to use Google soft­ware, if they want to use the wal­let. And here, they will not have a choice.

ID wal­lets are pub­lic in­fra­struc­ture to ac­cess crit­i­cal pub­lic ser­vices. They should re­main in­ter­op­er­a­ble across dif­fer­ent de­vices and op­er­at­ing sys­tems, free from ven­dor lock-in.

ID wal­lets are not just any kind of soft­ware — they are key means to ac­cess gov­ern­ment doc­u­ments and man­age lo­gins to pub­lic ser­vices. Therefore, they are of­ten seen as cru­cial build­ing blocks of dig­i­tal pub­lic in­fra­struc­ture. They are a cru­cial ser­vice that has to be avail­able to any­one - in­de­pen­dently of Google and Apple. Because the con­se­quence is that al­ter­na­tive de-Googled op­er­at­ing sys­tems are much less at­trac­tive to adopt if users can­not use cru­cial apps like iden­tity wal­lets to log into gov­ern­ment ser­vices.

Waag’s own re­search find­ings on this topic sup­port this. In the EU-funded Mobifree pro­ject, we have re­searched over the past two years what makes de-Googled mo­bile soft­ware ecosys­tems valu­able for dif­fer­ent end-users. A key re­quire­ment for many of our 120 testers to switch to de-Googled op­er­at­ing sys­tems was their com­pat­i­bil­ity with apps for crit­i­cal ser­vices such as pay­ments and gov­ern­ment iden­ti­fi­ca­tion apps.

Government de­vel­op­ers there­fore have to con­sider deeper stack lev­els when op­ti­miz­ing in­ter­op­er­abil­ity. Since Play Integrity API clearly vi­o­lates the Digital Markets Act, it also con­tra­dicts the goals of ID wal­lets to ad­vance European sov­er­eignty.

European mem­ber states lack a uni­fied ap­proach to im­ple­ment wal­lets

Part of the prob­lem lies in the gov­er­nance of the wal­let de­sign process. The EU pro­vides a gen­eral tech­ni­cal frame­work for the wal­let ar­chi­tec­ture, the Architecture Reference Framework. While it does not re­quire European gov­ern­ments to use Google at­tes­ta­tion, it does rec­om­mend it. This leads to an in­co­her­ent European stance to­wards Google, with some coun­tries not us­ing it, while oth­ers en­force Google’s ecosys­tem.

Some mem­ber states, such as Italy, have in­ter­preted the EU’s rec­om­men­da­tion to use the Play Integrity API as manda­tory. Others, like Switzerland, rely on Android’s at­tes­ta­tion mech­a­nism. They dropped Play Integrity due to data pro­tec­tion, data sov­er­eignty, and free­dom-of-choice con­cerns. The Netherlands and Italy use Play Integrity un­con­di­tion­ally. By do­ing so, they in­ter­pret the EU’s rec­om­men­da­tions for us­ing Google’s and Apple’s at­tes­ta­tion soft­ware in very strict terms.

If Europe is se­ri­ous about dig­i­tal au­ton­omy, it should rule out Google and Apple at­tes­ta­tion en­tirely from the Architecture Reference Framework and man­date open, hard­ware-based at­tes­ta­tion mech­a­nisms. Countries like Switzerland demon­strate that us­ing Google Play Integrity is not jus­ti­fied, and that other so­lu­tions are avail­able.

Public in­fra­struc­ture de­mands pub­lic ac­count­abil­ity, and there are ways to act

Because dig­i­tal wal­lets are pub­lic in­fra­struc­ture, their de­sign must be sub­ject to pub­lic par­tic­i­pa­tion and ac­count­abil­ity. The prob­lems and con­tra­dic­tions ex­plained above de­serve a pub­lic de­bate. Citizens and de­vel­op­ers are rais­ing con­cerns on na­tional repos­i­to­ries — in­clud­ing Germany’s pub­lic wal­let de­vel­op­ment tracker (gitlab.opencode.de) and Switzerland’s open dis­cus­sion fo­rum (github.com/​orgs/​swiyu-ad­min-ch). These are le­git­i­mate chan­nels, but they reach only a nar­row tech­ni­cal au­di­ence.

If you are an ex­pert work­ing on this topic who wants to pro­mote change, get in touch.

What you can do:

If you are a user of al­ter­na­tive, de-Googled op­er­at­ing sys­tems, con­tact the de­vel­op­ers of your coun­try’s EUDI Wallet app and de­mand in­de­pen­dence from Google and Apple at­tes­ta­tion (for the Dutch wal­let, go to the con­tact page of the Ministry of Foreign Affairs’ EDI web­site)

If you are a con­cerned cit­i­zen, con­tact your elected rep­re­sen­ta­tives to de­mand mak­ing ID wal­lets in­de­pen­dent from Google and Apple.

If you are a jour­nal­ist: fol­low the po­lit­i­cal and de­sign process. Like the re­cent Dutch Solvinity case, this story de­serves on­go­ing and wide cov­er­age be­cause it may be a wa­ter­shed mo­ment to ce­ment Google’s and Apple’s power po­si­tion, or not. See the EUDI Wallet web­page on de­vel­oper.over­heid.nl for de­vel­op­ment up­dates and repos­i­to­ries, and check out the EDI web­site of the Dutch Ministry of Foreign Affairs for mee­tups and con­tact de­tails.

Notes

In this ar­ti­cle, we fo­cus on Google’s Play Integrity API. We do so be­cause it has an im­pact on the use of al­ter­na­tive op­er­at­ing sys­tems based on Android.

Posted By Paul Kafasis on June 26th, 2026

With last year’s re­lease of MacOS 26 (Tahoe), Apple made a mess of app icons. In the first be­tas of MacOS 27 (Golden Gate), how­ever, there are signs of a turn­around. We’re urg­ing Apple to con­tinue mak­ing im­prove­ments, by restor­ing the abil­ity for MacOS app icons to have dis­tinct shapes.

Apple’s Liquid Glass App Icons

In Tahoe, Apple mod­i­fied the icons for dozens of their first-party apps to give them a “Liquid Glass” ap­pear­ance. The changes were a sub­stan­tial re­gres­sion, lead­ing to blurry, dumbed-down icons.

With the re­cently un­veiled Golden Gate, Apple has again up­dated their MacOS app icons. This time, how­ever, the changes are gen­uine im­prove­ments. Here’s the re­fined Automator icon, for ex­am­ple:

The newer icon is sharper, with su­per­flu­ous Liquid Glass re­moved. Dozens of Apple’s apps have seen sim­i­lar up­dates. The re­sult is that Golden Gate’s icons are su­pe­rior to Tahoe’s, as this com­par­i­son from Basic Apple Guy shows. Seeing these im­prove­ments led me to think about an­other fix Apple should make in MacOS.

The Problem of Tahoe’s Dictated Squircles

With the Tahoe re­lease, Apple did­n’t just mess with their own icons. They also dic­tated the shape of every third-party app icon, forc­ing them to adopt the same pre­scribed squir­cle. Any icon that failed to do so found it­self shrunk down and im­pris­oned in an ugly gray back­ground, in or­der to fit Apple’s de­sired aes­thetic.

To avoid this icon jail, de­vel­op­ers were forced to re­design their icons to match Apple’s pre­ferred form. After decades of beau­ti­ful, mem­o­rable Mac icons in vary­ing shapes, Tahoe flat­tened per­son­al­ity to ob­tain bland uni­for­mity. The plat­form is worse for it.

Past icons weren’t just more ex­pres­sive. They were also more us­able. Having dis­tinct shapes pro­vided a use­ful way to tell icons apart. Tahoe elim­i­nates that cue by forc­ing every­thing into the same squir­cle, leav­ing color as the pri­mary way to tell icons apart at a glance.

That falls down if you’ve got color vi­sion de­fi­ciency, or even just mul­ti­ple icons with sim­i­lar color schemes.1 I’m look­ing at you, Slack and Photos. I have to look closely, be­cause it’s so dif­fi­cult to tell you apart now.

It Doesn’t Have to Be Like This

Apple’s pro­hi­bi­tion on shapes is a step back­ward for both us­abil­ity and cre­ativ­ity in app icons. Icons are now harder to dis­tin­guish be­cause they’re no longer al­lowed to be dis­tinc­tive. But there’s no tech­ni­cal rea­son for it. Apple could, and should, once again al­low icons to take on a wide va­ri­ety of shapes.

It’s clear that some peo­ple within Apple rec­og­nize that the tran­si­tion to Liquid Glass in­tro­duced mis­takes. They also ap­pear to have the au­thor­ity to fix those mis­takes. Refinements to Apple’s own icons in Golden Gate are a wel­come course cor­rec­tion, as is the much-cel­e­brated Liquid Glass opac­ity slider. It’s time to cor­rect the mis­take of ban­ning icon shapes as well.2

Apple should stop forc­ing every icon into the same squir­cle. Let’s re­turn to a world of gor­geous app icons like these:

Free the icons.

With color now so crit­i­cal to tell icons apart, it should be no sur­prise that the new “Clear” and “Tinted” icon styles added in Tahoe are see­ing so lit­tle up­take. As Adam Engst noted, “[I]t’s nearly im­pos­si­ble to iden­tify a par­tic­u­lar app when they’re all clear or tinted squir­cles, as you can see be­low. My brain just shuts down when it sees them.”

I’m not sure this “Tinted” style would be a good idea even if these icons had dis­tinct shapes, but I know it’s a very bad one given their uni­for­mity. ↩︎

With color now so crit­i­cal to tell icons apart, it should be no sur­prise that the new “Clear” and “Tinted” icon styles added in Tahoe are see­ing so lit­tle up­take. As Adam Engst noted, “[I]t’s nearly im­pos­si­ble to iden­tify a par­tic­u­lar app when they’re all clear or tinted squir­cles, as you can see be­low. My brain just shuts down when it sees them.”

I’m not sure this “Tinted” style would be a good idea even if these icons had dis­tinct shapes, but I know it’s a very bad one given their uni­for­mity. ↩︎

For folks within Apple, this was feed­back filed as FB23388490 (“Third-Party App Icons Should Not Be Restricted to Apple’s Dictated Squircle Shape”). I imag­ine it is a du­pli­cate many times over. ↩︎

For folks within Apple, this was feed­back filed as FB23388490 (“Third-Party App Icons Should Not Be Restricted to Apple’s Dictated Squircle Shape”). I imag­ine it is a du­pli­cate many times over. ↩︎

My name is Daniel Connell. I pro­to­type and de­velop ba­sic tech­nolo­gies which any­one can make us­ing re­cy­cled ma­te­ri­als and sim­ple tools.

The aim is for every­one every­where to be able to build and main­tain their own in­fra­struc­ture; pro­duc­ing their own en­ergy, food, clean wa­ter, com­mu­ni­ca­tions, and any­thing else they need.

All de­signs are open source and li­cense free for any pur­pose, and full con­struc­tion tu­to­ri­als and how-tos are avail­able here.

The Facebook group is also a good place to ask ques­tions and post re­sults from your own builds.

Featured In: Al Jazeera ¦ The Guardian ¦ New Statesman ¦ Le Monde ¦ Makezine

Claude Sonnet 5 is built to be the most agen­tic Sonnet model yet. It can make plans, use tools like browsers and ter­mi­nals, and run au­tonomously at a level that, just a few months ago, re­quired larger and more ex­pen­sive mod­els.

For many de­vel­op­ers, the agen­tic AI era be­gan with Sonnet-class mod­els: Claude Sonnet 3.5, 3.6, and 3.7 were the first mod­els that showed im­pres­sive skills in cod­ing and tool use. More re­cently, though, the clear­est gains in agen­tic ca­pa­bil­i­ties have been in our Opus-class mod­els.

Sonnet 5 nar­rows the gap: its per­for­mance is close to that of Opus 4.8, but at lower prices. It’s a sub­stan­tial im­prove­ment over its pre­de­ces­sor, Sonnet 4.6, on im­por­tant as­pects of agen­tic per­for­mance like rea­son­ing, tool use, cod­ing, and knowl­edge work:

Our safety as­sess­ments found that Sonnet 5 shows an over­all lower rate of un­de­sir­able be­hav­iors than Sonnet 4.6, and is gen­er­ally safer to use in agen­tic con­texts. Evaluations also show that it has a much lower abil­ity to per­form cy­ber­se­cu­rity tasks than our cur­rent Opus mod­els.

From to­day, Claude Sonnet 5 is avail­able across all plans: it is the de­fault model for Free and Pro plans, and is avail­able to Max, Team, and Enterprise users. It’s also avail­able in Claude Code and on the Claude Platform, where it launches with in­tro­duc­tory pric­ing of $2 per mil­lion in­put to­kens and $10 per mil­lion out­put to­kens through August 31, 2026, af­ter which it will be priced at $3 per mil­lion in­put to­kens and $15 per mil­lion out­put to­kens. Developers can use claude-son­net-5 via the Claude API.

Working with Claude Sonnet 5

The charts be­low com­pare the per­for­mance of Sonnet 5 with Sonnet 4.6 and Opus 4.8 at dif­fer­ent ef­fort lev­els on the agen­tic search eval­u­a­tion BrowseComp and the com­puter use eval­u­a­tion OSWorld-Verified. Sonnet 5 (orange line) is a strict im­prove­ment over Sonnet 4.6 (gray line). Opus 4.8 (yellow line) is still the model of choice for higher ac­cu­racy on these tasks, but Sonnet 5 pro­vides de­vel­op­ers with lower-priced op­tions that are of much higher qual­ity than what was pre­vi­ously avail­able. Between Sonnet 5 and Opus 4.8, users can ad­just the ef­fort level to find the right bal­ance of cost and per­for­mance.

Feedback from our early ac­cess part­ners has been con­sis­tent: Sonnet 5 is much more agen­tic than its pre­de­ces­sors. Testers de­scribed how it fin­ishes com­plex tasks where pre­vi­ous Sonnet mod­els would stop short, how it checks its own out­put with­out ex­plic­itly be­ing asked, and how it does all this agen­tic work at an at­trac­tive price point:

Claude Sonnet 5 gives our agents a strong ex­e­cu­tion layer for multi-step soft­ware en­gi­neer­ing work. It han­dles sus­tained cod­ing, tool use, and de­bug­ging well across messy tech­ni­cal con­texts, and has been es­pe­cially use­ful for work­flows where fol­low-through and tech­ni­cal ground­ing mat­ter.

Claude Sonnet 5 gives our agents a strong ex­e­cu­tion layer for multi-step soft­ware en­gi­neer­ing work. It han­dles sus­tained cod­ing, tool use, and de­bug­ging well across messy tech­ni­cal con­texts, and has been es­pe­cially use­ful for work­flows where fol­low-through and tech­ni­cal ground­ing mat­ter.

We handed Claude Sonnet 5 a two-part job—up­date Salesforce ac­count tiers, send a launch an­nounce­ment to en­ter­prise con­tacts—and it fin­ished end to end. That used to stall halfway. For day-to-day au­toma­tion, it’s a no-brainer

We handed Claude Sonnet 5 a two-part job—up­date Salesforce ac­count tiers, send a launch an­nounce­ment to en­ter­prise con­tacts—and it fin­ished end to end. That used to stall halfway. For day-to-day au­toma­tion, it’s a no-brainer

Claude Sonnet 5 gets more done with less. Same out­put qual­ity, fewer steps to get there. It re­fuses un­safe re­quests cleanly and con­sis­tently, too. At Lovable, we’re putting pow­er­ful tools in the hands of mil­lions of builders. A model that knows when to say no is just as im­por­tant as one that knows how to build.

Claude Sonnet 5 gets more done with less. Same out­put qual­ity, fewer steps to get there. It re­fuses un­safe re­quests cleanly and con­sis­tently, too. At Lovable, we’re putting pow­er­ful tools in the hands of mil­lions of builders. A model that knows when to say no is just as im­por­tant as one that knows how to build.

We ran Claude Sonnet 5 against dozens of our most chal­leng­ing real pull re­quests, and it car­ried each one through to a tested, ver­i­fied re­sult on its own — free­ing our en­gi­neers to fo­cus on the judg­ment, the de­ci­sion, and the fi­nal sign-off.

We ran Claude Sonnet 5 against dozens of our most chal­leng­ing real pull re­quests, and it car­ried each one through to a tested, ver­i­fied re­sult on its own — free­ing our en­gi­neers to fo­cus on the judg­ment, the de­ci­sion, and the fi­nal sign-off.

I asked Claude Sonnet 5 to in­ves­ti­gate a bug. Unprompted, it wrote a re­pro­duc­ing test, im­ple­mented the fix, then stashed it to con­firm the bug came back with­out the change. All in a sin­gle pass.

I asked Claude Sonnet 5 to in­ves­ti­gate a bug. Unprompted, it wrote a re­pro­duc­ing test, im­ple­mented the fix, then stashed it to con­firm the bug came back with­out the change. All in a sin­gle pass.

With Claude Sonnet 5, agents stay on plan, fol­low our con­ven­tions, and ship clean multi-step changes, all at an ef­fi­cient cost.

With Claude Sonnet 5, agents stay on plan, fol­low our con­ven­tions, and ship clean multi-step changes, all at an ef­fi­cient cost.

Claude Sonnet 5 is at its best on brown­field code—race con­di­tions, hid­den tests, the parts no­body wants to touch. It traces a fail­ure to its ac­tual root cause and ships a durable fix in­stead of patch­ing the symp­tom.

Claude Sonnet 5 is at its best on brown­field code—race con­di­tions, hid­den tests, the parts no­body wants to touch. It traces a fail­ure to its ac­tual root cause and ships a durable fix in­stead of patch­ing the symp­tom.

Claude Sonnet 5 sits on the Pareto fron­tier for Eve’s plain­tiff-law tasks. We see the clear­est gains in le­gal re­search and analy­sis, at a price-to-per­for­mance ra­tio that made the choice to mi­grate easy.

Claude Sonnet 5 sits on the Pareto fron­tier for Eve’s plain­tiff-law tasks. We see the clear­est gains in le­gal re­search and analy­sis, at a price-to-per­for­mance ra­tio that made the choice to mi­grate easy.

ClickHouse agents ex­plore live data and pro­duce in­sights on the fly, so time-to-in­sight mat­ters when test­ing new mod­els. Claude Sonnet 5 rea­sons in tighter steps and gets our users to an­swers no­tice­ably faster. That speed is a dif­fer­ence our cus­tomers feel.

ClickHouse agents ex­plore live data and pro­duce in­sights on the fly, so time-to-in­sight mat­ters when test­ing new mod­els. Claude Sonnet 5 rea­sons in tighter steps and gets our users to an­swers no­tice­ably faster. That speed is a dif­fer­ence our cus­tomers feel.

At Pace, our com­puter-use agents run in­sur­ance work­flows—sub­mis­sion in­take, FNOL, loss runs—on the sys­tems our op­er­a­tions teams al­ready use. Claude Sonnet 5 con­sis­tently takes the right ac­tion and does it quickly, which is what real in­sur­ance work de­mands.

At Pace, our com­puter-use agents run in­sur­ance work­flows—sub­mis­sion in­take, FNOL, loss runs—on the sys­tems our op­er­a­tions teams al­ready use. Claude Sonnet 5 con­sis­tently takes the right ac­tion and does it quickly, which is what real in­sur­ance work de­mands.

01 /

10

Safety eval­u­a­tions

Our pre-de­ploy­ment safety eval­u­a­tions found that Sonnet 5 was over­all an im­prove­ment on Sonnet 4.6. On agen­tic safety, the model is bet­ter at re­fus­ing ma­li­cious re­quests and re­sist­ing hi­jack at­tempts in prompt in­jec­tion at­tacks. The model shows lower rates of hal­lu­ci­na­tion and syco­phancy than Sonnet 4.6. On our au­to­mated be­hav­ioral au­dit, which tests a wide range of mis­aligned be­hav­iors such as co­op­er­a­tion with mis­use and de­cep­tion, Sonnet 5 scored lower (that is, safer) over­all. However, it did show some­what higher rates of mis­aligned be­hav­ior on this as­sess­ment com­pared to the more ca­pa­ble Opus 4.8 and Claude Mythos Preview.

We did not de­lib­er­ately train Sonnet 5 on cy­ber­se­cu­rity tasks. It can per­form some rou­tine, non-harm­ful cy­ber tasks, but on eval­u­a­tions test­ing po­ten­tially dan­ger­ous cy­ber skills, such as de­vel­op­ing soft­ware ex­ploits, it shows sub­stan­tially poorer per­for­mance than mod­els such as Opus 4.8 and Mythos 5. Scores from one eval­u­a­tion, which tested mod­els’ abil­ity to de­velop ex­ploits for vul­ner­a­bil­i­ties in the Firefox browser, are shown in the chart be­low. Sonnet 5 was never able to de­velop a full work­ing ex­ploit, but it does show a slightly higher rate of par­tial suc­cess than Sonnet 4.6. This lat­ter change is likely due to im­prove­ments in gen­eral in­tel­li­gence rather than spe­cific train­ing.

Since Sonnet 5 is some­what stronger than its pre­de­ces­sor on these tasks, we’ve launched it with cy­ber safe­guards en­abled by de­fault. These safe­guards—which de­tect and block dan­ger­ous cy­ber us­age in real time—are the same as those pre­sent in Claude Opus 4.7 and 4.8 (because we judged that the over­all level of cy­ber­se­cu­rity risk from Sonnet 5 was low, the safe­guards are less strict than those launched with Fable 5, which block a much wider range of cy­ber­se­cu­rity tasks).1

Our full as­sess­ment of Sonnet 5 across many safety and ca­pa­bil­ity eval­u­a­tions is re­ported in the Claude Sonnet 5 System Card.

Availability and pric­ing

Claude Sonnet 5 is avail­able every­where to­day at an in­tro­duc­tory price of $2 per mil­lion in­put to­kens and $10 per mil­lion out­put to­kens through August 31, 2026. It then moves to stan­dard pric­ing at $3 per mil­lion in­put to­kens and $15 per mil­lion out­put to­kens.2 We’ve in­creased rate lim­its across Chat, Cowork, Claude Code, and the Claude Platform3 to ac­com­mo­date the higher to­ken us­age of higher ef­fort lev­els; users can se­lect whichever level makes sense for their par­tic­u­lar pro­ject.

Footnotes

1 Sonnet 5 is part of our Cyber Verification Program, which is avail­able to­day on the na­tive Claude Platform, the Claude Platform on AWS, and Claude in Microsoft Foundry (hosted on Azure and Anthropic), and com­ing soon on Claude in Google Vertex. Organizations that are al­ready en­rolled in the Cyber Verification Program au­to­mat­i­cally have the same ac­cess on Sonnet 5, with no need to reap­ply. Overall, we rec­om­mend Claude Opus 4.8 for cy­ber­se­cu­rity work that re­quires re­duced guardrails.

2 Sonnet 5 is an up­grade to Sonnet 4.6, but it uses an up­dated to­k­enizer that changes how the model processes text to im­prove per­for­mance (this is sim­i­lar to the to­k­enizer change we in­tro­duced with Claude Opus 4.7). The trade­off is that the same in­put can map to more to­kens: roughly 1.0 – 1.35× de­pend­ing on the con­tent type. The in­tro­duc­tory pric­ing is set so that the tran­si­tion to Sonnet 5 is roughly cost-neu­tral.

3 On April 26, 2026, we raised Sonnet and Haiku rate lim­its at every us­age tier and sim­pli­fied to three tiers (Start, Build, and Scale) on the na­tive Claude Platform. You can view your tier and cur­rent lim­its in the Claude Console or read the doc­u­men­ta­tion to learn more.

Humanity’s Last Exam: We up­dated the grader model for Humanity’s Last Exam and have up­dated the Sonnet 4.6 score to 34.6% (no tools) and 46.8% (with tools). This is the rea­son the score dif­fers from that re­ported in the Sonnet 4.6 launch blog.

OSWorld-Verified: We made changes to how we run the OSWorld-Verified eval­u­a­tion to more ac­cu­rately re­flect the mod­el’s per­for­mance in the real world, and have up­dated the Sonnet 4.6 score to 78.5%. This is the rea­son the score dif­fers from that re­ported in the Sonnet 4.6 launch blog.

Related con­tent

Claude Science, an AI work­bench for sci­en­tists, is now avail­able

Claude Science is a cus­tomiz­able app that in­te­grates the tools and pack­ages re­searchers most of­ten use, pro­duces au­ditable ar­ti­facts, and pro­vides flex­i­ble ac­cess to com­put­ing re­sources.

Read more

Introducing Claude Tag

Claude Tag is a new way for teams to work with Claude.

Read more

Anthropic opens Seoul of­fice and an­nounces new part­ner­ships across the Korean AI ecosys­tem

Read more

Richard Audoly, Miles Guerin, Srinidhi Narayanan, and Rachel Schuh

The la­bor share of in­come in the U.S. is cur­rently at its low­est-ever level in the post-war pe­riod. The la­bor share mea­sures the frac­tion of eco­nomic out­put paid to work­ers as wages and salaries. As such, it is a use­ful bench­mark for wage growth: when the la­bor share falls, it means that pro­duc­tiv­ity, prices, or both are grow­ing faster than wages. After much-stud­ied drops in the 2000s, the la­bor share fell sharply again af­ter the COVID pan­demic. In this post, we com­pare the dy­nam­ics of the la­bor share post-COVID to ear­lier pe­ri­ods to un­der­stand whether the re­cent de­cline rep­re­sents the con­tin­u­a­tion of a trend or a new and dis­tinct phe­nom­e­non. We find that both the cycli­cal­ity of the la­bor share and the con­tri­bu­tion of re­al­lo­ca­tion to the la­bor share post-COVID are sim­i­lar to ear­lier pe­ri­ods.

The Evolution of the Labor Share

To con­tex­tu­al­ize the post-COVID de­cline in the la­bor share, we first de­scribe its long-run evo­lu­tion, il­lus­trated in the chart be­low. For much of the post-war pe­riod, the la­bor share was re­mark­ably sta­ble, hov­er­ing around 63 per­cent through the late 20th century. Starting in the early 2000s, how­ever, it en­tered a sus­tained de­cline, with a par­tic­u­larly sharp drop dur­ing the global fi­nan­cial cri­sis (GFC). The la­bor share is a core ob­ject of in­ter­est in the aca­d­e­mic and pub­lic de­bate—it mea­sures the share of ag­gre­gate in­come go­ing to work­ers as op­posed to cap­i­tal—and a large aca­d­e­mic lit­er­a­ture dis­cusses the long-run forces be­hind this down­ward trend, in­clud­ing tech­no­log­i­cal change, the rise of “superstar” firms, and in­creas­ing markups.

The Labor Share Has Declined Since the 2000s

In this post, we zoom in on the post-COVID de­cline in the la­bor share. After sta­bi­liz­ing in the 2010s, the la­bor share de­clined again dur­ing the post-COVID pe­riod, ul­ti­mately falling 1.6 per­cent­age points be­low its pre-pan­demic level. The la­bor share now stands at an all-time low in the post-war pe­riod. Given that the la­bor share de­clined in the two most re­cent re­ces­sions, how does the post-COVID de­cline com­pare to ear­lier re­ces­sion­ary episodes?

Is the Post-COVID Decline Typical Across U.S. Recessions?

In the next chart, we study the path of the la­bor share around var­i­ous re­ces­sion–ex­pan­sion pe­ri­ods, trac­ing its tra­jec­tory from the on­set of a down­turn. We then as­sess whether the post-COVID de­cline mim­ics the dy­nam­ics of the la­bor share across ear­lier cy­cles.

The Post-COVID Evolution of the Labor Share Aligns with Pre-2000 Recessions

Most pre-2000 pe­ri­ods fol­low a sim­i­lar pat­tern: the la­bor share in­creases dur­ing a re­ces­sion, de­clines through re­cov­ery, and then rises again later in the ex­pan­sion. While we re­strict at­ten­tion to the two most re­cent pre-2000 re­ces­sion–ex­pan­sion pe­ri­ods (1979 – 1989 and 1989 – 2000) and omit ear­lier episodes for clar­ity, we find broadly sim­i­lar dy­nam­ics across these cy­cles.

This be­hav­ior changes in the 2000s. Following both the dot­com re­ces­sion and the GFC, the de­cline in the la­bor share dur­ing ex­pan­sion is steeper than in ear­lier cy­cles. Moreover, un­like in pre-2000 episodes, the la­bor share does not mean­ing­fully re­bound later in the ex­pan­sion.

The dy­nam­ics of the la­bor share at the on­set of the COVID pan­demic ac­tu­ally ap­pear more sim­i­lar to pre-2000 re­ces­sions: the la­bor share in­creases sharply fol­lowed by a mod­est de­cline be­fore flat­ten­ing out. Judging by past re­ces­sions, we would need a longer ex­pan­sion to see the la­bor share rise again.

Another source of dif­fer­ence across re­ces­sion–ex­pan­sion episodes is the de­gree of re­al­lo­ca­tion in eco­nomic ac­tiv­ity. As busi­nesses and house­holds ad­justed to pan­demic re­stric­tions, eco­nomic ac­tiv­ity may have shifted sub­stan­tially across sec­tors. This raises the ques­tion of whether these shifts con­tributed to the re­cent de­cline in the ag­gre­gate la­bor share.

Did Sectoral Reallocation Drive the Post-COVID Decline in the Labor Share?

Some in­dus­tries have higher la­bor shares be­cause they rely more heav­ily on hu­man la­bor and skills. For in­stance, health­care and ed­u­ca­tion tend to have higher la­bor shares be­cause out­put re­lies pri­mar­ily on work­ers’ time and ex­per­tise, while man­u­fac­tur­ing and agri­cul­ture have lower la­bor shares be­cause ma­chin­ery and au­toma­tion play a larger role in out­put. If, in the post-COVID years, a larger share of out­put came from low la­bor share in­dus­tries, the ag­gre­gate la­bor share could de­cline even if la­bor shares within in­dus­tries re­mained con­stant.

To see if COVID stands out in terms of re­al­lo­ca­tion com­pared to ear­lier re­ces­sions, we con­struct a re­al­lo­ca­tion in­dex, de­fined as the ag­gre­gate of ab­solute changes in sec­toral out­put shares across pe­ri­ods. The chart be­low plots this in­dex across the three most re­cent re­ces­sion episodes: 1999 – 2004, 2007 – 2012, and 2019 – 2024. We find that al­though sec­toral re­al­lo­ca­tion spiked at the on­set of the COVID pan­demic, it then mod­er­ated and sta­bi­lized at a lower level. In con­trast, ear­lier re­ces­sions ex­hib­ited more per­sis­tent and in­creas­ing re­al­lo­ca­tion.

COVID Led To a Spike in Economic Reallocation That Quickly Subsided

However, the over­all amount of re­al­lo­ca­tion does not by it­self de­ter­mine the ef­fect on the ag­gre­gate la­bor share. Even mod­est shifts in eco­nomic ac­tiv­ity could re­duce the ag­gre­gate la­bor share if they move out­put to­ward in­dus­tries with lower la­bor in­ten­si­ties. To eval­u­ate this chan­nel, we im­ple­ment a stan­dard “shift-share” de­com­po­si­tion of the pay­roll share, which mea­sures la­bor in­come ex­clud­ing non­wage com­pen­sa­tion. We de­com­pose the change in the ag­gre­gate pay­roll share into two parts: changes hap­pen­ing within in­dus­tries (“shift”) and changes due to eco­nomic ac­tiv­ity mov­ing be­tween in­dus­tries (“share,” or re­al­lo­ca­tion). The chart be­low pre­sents this de­com­po­si­tion for the same re­ces­sion episodes as be­fore.

The red bars show the to­tal change in the ag­gre­gate pay­roll share be­tween the first and last year of each pe­riod. The gold bars cap­ture how much of that change in the pay­roll share was caused by shifts within in­dus­tries—for in­stance, changes in how much re­tail pays work­ers rel­a­tive to its own out­put. The blue bars show how much of the change is due to eco­nomic ac­tiv­ity mov­ing be­tween in­dus­tries—for in­stance, whether out­put shifted to­ward sec­tors that gen­er­ally have higher or lower pay­roll shares.

Within-Industry Declines, Not Between-Industry Reallocation, Drove the Fall in the Aggregate Payroll Share

From this shift–share de­com­po­si­tion, we find that de­clines in the ag­gre­gate pay­roll share dur­ing COVID, and the pre­vi­ous two re­ces­sions, were en­tirely dri­ven by changes within in­dus­tries rather than shifts across in­dus­tries. Across all three re­ces­sion pe­ri­ods, we find that move­ments in out­put across sec­tors con­tribute noth­ing or very lit­tle to the change in the ag­gre­gate pay­roll share.

Conclusion

This post doc­u­ments a per­sis­tent drop in the la­bor share fol­low­ing the COVID pan­demic. Is this de­cline a dis­tinct change from the re­cent be­hav­ior of the la­bor share in the U.S.? Along the two key di­men­sions we in­ves­ti­gate, our an­swer is no. First, the la­bor share’s tra­jec­tory post-COVID broadly fol­lows the cycli­cal pat­terns ob­served in ear­lier re­ces­sions, with a de­cline dur­ing the re­cov­ery phase that mir­rors his­tor­i­cal dy­nam­ics. Second, the de­cline in the la­bor share since COVID is dri­ven pri­mar­ily by within-in­dus­try changes rather than shifts in eco­nomic ac­tiv­ity across sec­tors. Taken to­gether, these re­sults sug­gest that the post-COVID de­cline fol­lows the same cycli­cal pat­terns as ear­lier re­ces­sions and is dri­ven by the same within-in­dus­try forces, and they pro­vide lit­tle ev­i­dence that it will evolve dif­fer­ently from past episodes.

Richard Audoly is a re­search econ­o­mist in the Federal Reserve Bank of New York’s Research and Statistics Group.

Miles Guerin is a re­search an­a­lyst in the Federal Reserve Bank of New York’s Research and Statistics Group.

Srinidhi Narayanan is a re­search an­a­lyst in the Federal Reserve Bank of New York’s Research and Statistics Group.

Rachel Schuh is a re­search econ­o­mist in the Federal Reserve Bank of New York’s Research and Statistics Group.

How to cite this post: Richard Audoly, Miles Guerin, Srinidhi Narayanan, and Rachel Schuh, “The Post‑COVID Decline in the Labor Share,” Federal Reserve Bank of New York Liberty Street Economics, June 24, 2026, https://​doi.org/​10.59576/​lse.20260624 BibTeX: View |

DisclaimerThe views ex­pressed in this post are those of the au­thor(s) and do not nec­es­sar­ily re­flect the po­si­tion of the Federal Reserve Bank of New York or the Federal Reserve System. Any er­rors or omis­sions are the re­spon­si­bil­ity of the au­thor(s).

A jour­nal­ist typ­ing a few let­ters and num­bers into a web browser pulled up the pass­port of a young woman from Germany. Then a Spanish man’s pass­port. Then an­other man’s dri­ver’s li­cense. All of it sit­ting on the pub­lic in­ter­net with no pass­word, no en­cryp­tion, no ac­cess con­trol what­so­ever.

How Did Nearly a Million Identity Documents End Up Unprotected?

What Happens When Identity Documents Are Stolen at Scale?

Why Can’t You Just “Change” Your Passport Like a Password?

Nearly a mil­lion pass­ports and photo IDs from mul­ti­ple coun­tries were ex­posed across un­pro­tected pub­lic URLs, ac­ces­si­ble to any­one with a link. The doc­u­ments re­mained dis­cov­er­able this way for months, ac­cord­ing to re­port­ing by The Verge, be­fore be­ing taken of­fline. The ex­po­sure rep­re­sents one of the largest iden­tity doc­u­ment breaches in re­cent mem­ory—and it hap­pened be­cause of a fun­da­men­tal fail­ure in data se­cu­rity prac­tices.

Key Findings:

The Scale: Nearly one mil­lion pass­ports and photo IDs from mul­ti­ple European coun­tries were left com­pletely un­pro­tected on pub­lic web servers.

The Access Method: No hack­ing was re­quired—doc­u­ments were ac­ces­si­ble through di­rect URLs with zero au­then­ti­ca­tion or en­cryp­tion.

The Timeline: Identity doc­u­ments re­mained pub­licly ac­ces­si­ble for months be­fore dis­cov­ery, cre­at­ing an un­known win­dow of po­ten­tial crim­i­nal ex­ploita­tion.

The doc­u­ments were hosted by sys­tems used by cannabis clubs and a com­pany called Nefos, which op­er­ates PuffPal, a plat­form that man­ages mem­ber­ship and age ver­i­fi­ca­tion for cannabis re­tail­ers and clubs across Europe. The in­fra­struc­ture stor­ing these iden­tity doc­u­ments—full pass­port scans, dri­ver’s li­censes with pho­tos, names, and iden­ti­fy­ing num­bers—was left com­pletely un­pro­tected on pub­licly ac­ces­si­ble web servers.

Sammy Azdoufal, a se­cu­rity re­searcher who dis­cov­ered the ex­po­sure, told The Verge the ur­gency was acute: “We have to do some­thing about it as fast as pos­si­ble, be­cause peo­ple will find this and re­sell it. It will do dam­age.” The con­cern was not the­o­ret­i­cal. Identity doc­u­ments at scale on the open in­ter­net are im­me­di­ately valu­able to crim­i­nals. According to guid­ance from the Federal Trade Commission, stolen pass­ports and dri­ver’s li­censes fuel iden­tity theft, doc­u­ment fraud, and ac­count takeover at­tacks.

How Did Nearly a Million Identity Documents End Up Unprotected?

What makes this breach struc­turally sig­nif­i­cant is not just the vol­ume of doc­u­ments ex­posed, but the mech­a­nism of ex­po­sure: a com­pany col­lect­ing iden­tity ver­i­fi­ca­tion data—os­ten­si­bly for le­git­i­mate age-gat­ing pur­poses—stored that data in a way that treated se­cu­rity as op­tional. No au­then­ti­ca­tion layer. No rate lim­it­ing. No en­cryp­tion. Just raw iden­tity doc­u­ments, URL-accessible to the en­tire in­ter­net.

The Security Failures: • Zero pass­word pro­tec­tion on doc­u­ment stor­age sys­tems • No en­cryp­tion for sen­si­tive iden­tity ver­i­fi­ca­tion data • Public URL ac­cess with no au­then­ti­ca­tion re­quire­ments • No ac­cess log­ging or mon­i­tor­ing sys­tems in place

This mir­rors a pat­tern that de­fined the Cambridge Analytica scan­dal: the ac­cu­mu­la­tion of per­sonal data at scale, jus­ti­fied by a le­git­i­mate-sound­ing use case (age ver­i­fi­ca­tion in this case, po­lit­i­cal re­search in CA’s), with se­cu­rity and con­sent treated as af­ter­thoughts. Cambridge Analytica har­vested psy­cho­log­i­cal pro­files of mil­lions with­out ex­plicit con­sent, stor­ing and weaponiz­ing be­hav­ioral data. Here, iden­tity doc­u­ments were col­lected for age ver­i­fi­ca­tion but stored with such neg­li­gence that any­one could down­load them in bulk.

What Happens When Identity Documents Are Stolen at Scale?

The Verge’s in­ves­ti­ga­tion did not iden­tify a spe­cific at­tack or breach. No hacker broke in. No ran­somware gang de­manded pay­ment. The doc­u­ments were sim­ply left there, ac­ces­si­ble by de­sign—or more ac­cu­rately, by de­fault. This is a cat­e­gory of ex­po­sure that se­cu­rity re­searchers call “misconfiguration,” but that term ob­scures the re­al­ity: a com­pany han­dling mil­lions of iden­tity doc­u­ments treated them with less care than most peo­ple give to a pub­lic photo al­bum.

Research pub­lished in PMC’s cy­ber­se­cu­rity analy­sis demon­strates that the health­care sec­tor con­tin­ues to suf­fer some of the high­est costs from data se­cu­rity breaches, with iden­tity doc­u­ment ex­po­sure cre­at­ing par­tic­u­larly se­vere long-term risks for af­fected in­di­vid­u­als.

The time­line of dis­cov­ery and re­me­di­a­tion re­mains un­clear from avail­able re­port­ing. The doc­u­ments have since been taken of­fline, but the dam­age win­dow—how long they were ac­ces­si­ble, how many peo­ple or au­to­mated sys­tems may have down­loaded them—is un­known. No of­fi­cial state­ment from Nefos or the cannabis clubs us­ing the plat­form has been cited in re­port­ing.

Why Can’t You Just “Change” Your Passport Like a Password?

For in­di­vid­u­als whose doc­u­ments were ex­posed, the im­me­di­ate risk is iden­tity theft. Passport and dri­ver’s li­cense scans in crim­i­nal hands can be used to open ac­counts, ap­ply for credit, or fa­cil­i­tate doc­u­ment fraud. There is no uni­ver­sal “change your pass­port” op­tion like re­set­ting a com­pro­mised pass­word. The ex­po­sure is per­ma­nent un­less and un­til those doc­u­ments ex­pire or are reis­sued.

Identity Document Vulnerability: • Unlike pass­words, gov­ern­ment-is­sued IDs can­not be in­stantly changed or re­voked • Document re­place­ment re­quires lengthy bu­reau­cratic processes across mul­ti­ple coun­tries • Criminal use of stolen doc­u­ments can con­tinue for years be­fore de­tec­tion

The broader im­pli­ca­tion is sharper: any com­pany col­lect­ing iden­tity doc­u­ments for ver­i­fi­ca­tion pur­poses is now on no­tice that “we’ll just store them se­curely” is not a cred­i­ble promise with­out demon­strated tech­ni­cal con­trols. The NIST Computer Security Incident Handling Guide es­tab­lishes base­line se­cu­rity re­quire­ments that were com­pletely ab­sent in this case—no pass­word pro­tec­tion, no en­cryp­tion, no ac­cess logs.

What re­mains unan­swered is whether reg­u­la­tory bod­ies in the European coun­tries af­fected will im­pose penal­ties on Nefos or the cannabis clubs for this ex­po­sure, and whether in­di­vid­u­als will have any re­course for iden­tity restora­tion or mon­i­tor­ing. The struc­tural par­al­lel to data col­lec­tion fail­ures that de­fined pre­vi­ous pri­vacy scan­dals sug­gests this in­ci­dent rep­re­sents a broader fail­ure in how com­pa­nies ap­proach sen­si­tive data stew­ard­ship. As of mid-April 2026, those ques­tions hang open.