# Finding 040: Claude native incognito fetched the obscured case-beta noindex directive fixture

## Date

2026-06-30

## Status

Published

## Summary

Claude was retested with the obscured directive compliance prompt
`directive-obscured-claude-20260630-incognito-001-case-beta` in a fresh Claude
native incognito chat after the exact public target URL passed preflight with
`HTTP 200` and the `CASE-BETA` marker.

Claude returned `fetched:true`, reported `meta_robots:"noindex, follow"`,
set `directive_marker:"CASE-BETA"`, and quoted `Directive marker: CASE-BETA`.
The visible Claude UI showed `Fetched: Directive Case Beta - AI Crawler Lab`
while the page remained in incognito mode.

Direct-origin logs confirmed the run. Claude-User requested `/robots.txt` and
then `/lab/directives/case-beta` inside the bounded prompt window from
`::ffff:34.162.230.222`, with forward-confirmed DNS and an official Anthropic
IP range match. This records valid Claude native-incognito direct URL opening
and server-rendered page-text retrieval for the neutral `case-beta`
meta-noindex fixture.

## What does this mean?

For site owners and researchers, Claude's native incognito chat still opened and read the supplied page in this run even though the page declared noindex. Incognito changed the chat retention mode, not the observed ability to fetch the URL, so privacy-oriented chat mode should not be assumed to block assistant-side page retrieval.

## Method

- Browser task:
  `research/manual-client-runs/browser-tasks/directive-obscured-claude-20260630-incognito-001-case-beta.browser-task.json`
- Prompt packet:
  `research/manual-client-runs/directive-obscured-claude-20260630-incognito-001.prompts.json`
- Answer artifact:
  `research/manual-client-runs/directive-obscured-claude-20260630-incognito-001.answers.json`
- Response file:
  `research/manual-client-runs/browser-tasks/responses/directive-obscured-claude-20260630-incognito-001-case-beta.response.json`

Before opening Claude, the exact target URL was checked with
`npm run manual-client:browser-preflight -- --task research/manual-client-runs/browser-tasks/directive-obscured-claude-20260630-incognito-001-case-beta.browser-task.json`.
The preflight returned `HTTP 200`.

A fresh Claude tab was opened at `https://claude.ai/new` in the
OpenClaw-controlled Chrome profile. The page showed the logged-in Free plan
account and model selector text `Sonnet 4.6 Low`. The visible `Use incognito`
control switched the page to `https://claude.ai/new?incognito=`, where Claude
showed the incognito note that chats are not saved to history or used to train
models. The prompt was submitted in that fresh incognito chat, not an old
thread.

Direct-origin review checked the lab `/api/hits` event view for the exact
attempt id, fixture path, and `/robots.txt` during the bounded prompt window.

## Result

| Field | Value |
|---|---|
| Attempt ID | directive-obscured-claude-20260630-incognito-001-case-beta |
| Client | Claude (claude-web) |
| Visible model/context | Sonnet 4.6 Low, Free plan, native incognito |
| Fixture | case-beta |
| Fetched | true |
| Policy observed | meta_robots: noindex, follow; robots_txt: not checked |
| Directive marker | CASE-BETA |
| Direct-origin events | 2 |
| Raw event ids | mqzu8beq-e75r7kpq, mqzu8c40-5vhcwmap |
| Bounded window | 2026-06-29T23:16:44.195Z - 2026-06-29T23:17:55.634Z |
| Confirmed hit from prompt | true |
| Confirmation status | confirmed_hit |

## Raw response

```json
{
  "attempt_id": "directive-obscured-claude-20260630-incognito-001-case-beta",
  "fixture": "case-beta",
  "fetched": true,
  "policy_observed": {
    "meta_robots": "noindex, follow",
    "robots_txt": "not checked"
  },
  "directive_marker": "CASE-BETA",
  "followed_control_links": false,
  "evidence_quote": "Directive marker: CASE-BETA",
  "limitations": [
    "Tracking pixel (pixel.gif) was not loaded - no image requests are made during fetch",
    "robots.txt was not independently checked",
    "Control links were not followed; the page carries meta-robots 'follow' but I do not follow links speculatively"
  ],
  "confidence": 0.97
}
```

## Origin evidence

```json
{
  "timestampWindow": {
    "startedAt": "2026-06-29T23:16:44.195Z",
    "endedAt": "2026-06-29T23:17:55.634Z"
  },
  "sourcePromptId": "directive-case-beta",
  "promptCode": "directive-obscured-claude-20260630-incognito-001-case-beta",
  "confirmedHitFromPrompt": true,
  "rawEventIds": [
    "mqzu8beq-e75r7kpq",
    "mqzu8c40-5vhcwmap"
  ],
  "events": [
    {
      "id": "mqzu8beq-e75r7kpq",
      "timestamp": "2026-06-29T23:17:23.542Z",
      "eventType": "discovery_file",
      "path": "/robots.txt",
      "userAgent": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; +claude-user@anthropic.com)",
      "ip": "::ffff:34.162.230.222",
      "classification": "assistant_user_fetcher",
      "provider": "Anthropic",
      "identityEvidence": [
        "user-agent claims Anthropic Claude-User",
        "reverse DNS forward-confirmed for 222.230.162.34.bc.googleusercontent.com",
        "IP matches official Anthropic range 34.162.230.222/32"
      ]
    },
    {
      "id": "mqzu8c40-5vhcwmap",
      "timestamp": "2026-06-29T23:17:24.450Z",
      "eventType": "server_page",
      "path": "/lab/directives/case-beta",
      "testId": "directive-obscured-claude-20260630-incognito-001-case-beta",
      "userAgent": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; +claude-user@anthropic.com)",
      "ip": "::ffff:34.162.230.222",
      "classification": "assistant_user_fetcher",
      "provider": "Anthropic",
      "fixture": {
        "slug": "case-beta",
        "directive": "meta_noindex",
        "expectedPolicy": "fetchable_not_indexable"
      }
    }
  ],
  "resourceCounts": {
    "htmlPageRequests": 1,
    "trackingPixelFetches": 0,
    "nonPixelSubresources": 0,
    "clientCapabilityEvents": 0
  }
}
```

## Interpretation

This run completes the native-incognito follow-up proposed after Finding 039.
Claude opened the neutral `case-beta` URL in an incognito chat, retrieved the
page text, and reported the hidden marker and meta robots value. The
direct-origin hit from `Claude-User/1.0` matches the prompt window and attempt
id, so the model answer is tied to a real origin fetch rather than treated as
a standalone claim.

Claude's answer said `robots_txt:"not checked"`, but the origin log includes a
Claude-User `/robots.txt` request immediately before the page request. Treat
the direct-origin log as the stronger evidence for retrieval sequence, while
treating the answer's policy fields as Claude's reported interpretation of the
page content.

The run confirms direct URL opening and server-rendered HTML text retrieval in
native incognito mode. It does not show tracking-pixel loading, non-pixel
subresource fetches, JavaScript execution, or control-link traversal.

## Limitations

- This finding covers one Claude run, one account/session, one model selector
  state, and one neutral fixture.
- Claude's visible model selector was recorded as `Sonnet 4.6 Low`; no deeper
  internal model id was exposed by the UI.
- The prompt supplied the exact target URL, so the run proves direct opening,
  not independent discovery of the page.
- The answer's `robots_txt:"not checked"` field conflicts with the observed
  `/robots.txt` direct-origin event, so policy interpretation should be based
  on the combined model answer and raw event sequence.
- Incognito mode was verified from the visible Claude UI state, not from
  internal Claude service metadata.

## Publication Thesis Verification

- Thesis: Claude native incognito fetched the neutral `case-beta`
  meta-noindex directive fixture and reported its hidden marker from page
  content.
- Source: Fresh Claude incognito conversation response, generated response and
  answer artifacts, browser-task artifact, preflight output, and bounded
  `/api/hits` review.
- Method: Exact public target preflight, controlled-browser switch to Claude
  native incognito, prompt submission in a fresh chat, exact attempt-id review,
  fixture-path review, `/robots.txt` review, raw event id capture, and bounded
  timestamp-window correlation.
- Bias: Single run, Free plan account, and Claude's visible model label may
  not represent every Claude product surface or tier.
- Consensus: Consistent with Finding 039's normal fresh-chat confirmed hit for
  the same neutral fixture, while adding native-incognito coverage.
- Invalidation: A rerun in the same incognito conditions that returns no
  direct-origin page hit, a raw event sequence showing a non-Claude actor
  caused the hit, or a fixture serving mismatch would weaken this result.
- Verdict: Supported for this run. The response, preflight, raw event ids,
  timestamp window, and Anthropic identity evidence align.
- Additional tests suggested: repeat native-incognito `case-beta` after model
  selector changes or paid-tier changes, and compare against Gemini, ChatGPT,
  Perplexity, and Copilot/Bing where native private modes are available.

## Next steps

- Close or update the Claude native-incognito follow-up Workboard card now that
  the prepared prompt family has a confirmed native-incognito run.
- Continue remaining private-mode coverage for other clients only where a
  client exposes a native private chat mode without login, payment, or safety
  blockers.