Two Sentences Changed What Claude Code Will Build, and There Was No Release

Here are the two sentences, as they exist today inside the Claude Code binary on npm:

Do build original games, games in a genre or with similar mechanics, and games from the user's own designs and assets. Don't build a recreation of a specific existing game (its name, characters, art, music, levels or look), even if it is renamed or called original.

That string governs whether the coding agent you are paying for will take a job. It isn't in the documentation. It isn't in the changelog. For the first three days of its life it was not in the binary either — it was arriving over the network from Anthropic, into a slot that had been sitting in the released software, empty, waiting for something to be put in it.

Nobody announced any of this. A user on X noticed it, reporters picked it up, and Anthropic confirmed it afterwards.

What Actually Happened to Claude Code's Game Rule

The short version, before the detail. Around 27 October 2026, Claude Code began declining to recreate specific existing games. The behaviour came from two sentences added to the model's prompt under a feature flag called tengu_heron_brook, delivered server-side. Version 2.1.314, published to npm on 30 October, baked a local copy of the text into the binary as a fallback. Developers building original games got caught in it. On 5 November the wording was loosened, and the loosened version is what you read above.

None of those four events has a changelog entry.

Reading It Out of the Binary Instead of Off a Screenshot

Every outlet that covered this quoted the rule from a screenshot of someone's X post, and two of them quoted it differently. PC Gamer rendered the second sentence as "Do not build a recreation of a specific existing game." Others wrote "Don't."

That's a small thing, and it's also the kind of small thing worth settling, because the whole story is about the exact contents of a string. So I went and got the string.

We have been through Claude Code's npm artifacts before, so the shape is familiar. The npm package @anthropic-ai/claude-code is a 216 KB launcher. The actual program arrives as a per-platform optional dependency — @anthropic-ai/claude-code-linux-x64 and seven siblings — and that package is a single ~300 MB native binary. You can fetch any version you like:

$ npm pack @anthropic-ai/claude-code-linux-x64@2.1.314
$ tar xzf anthropic-ai-claude-code-linux-x64-2.1.314.tgz
$ ls -la package/claude
-rwxr-xr-x 1 root root 298229464 package/claude

And then you can simply look:

$ grep -aoP "Do build original games.*?called original\." package/claude
Do build original games, games in a genre, and games from the user's own designs and assets. Don't build a recreation of a specific existing game, even if it is renamed or called original.

(The -a treats the binary as text, and the lazy .*? stops at the first sentence end — without it the match runs on into whatever bytes happen to sit next to the string.)

It's "Don't." PC Gamer's transcription is wrong, by two characters, in the sentence everyone is arguing about. I mention it not to score a point off a good outlet but because it is the entire reason to go to the artifact: every version of this story in circulation is a copy of a copy of a photograph of a terminal.

Both flag names the reporting mentioned are in there too, which corroborates the leak as genuine rather than someone's invention:

$ grep -c -ao "tengu_heron_brook" package/claude
2
$ grep -c -ao "original_games_guidance" package/claude
4

The Rule Shipped Three Days After the Behaviour

This is the part nobody has published, and it's the part that matters.

Version 2.1.312 went out on 27 October. Version 2.1.314 went out on 30 October — there is no 2.1.313 on npm. If the rule had arrived with a release, 2.1.312 would be clean and 2.1.314 would have the text.

It isn't that simple. I pulled four versions and grepped each one:

The rule text is not in 2.1.312. The flag that delivers it is. Here is the function, lifted from the 2.1.312 binary:

function Trr(){let e=Sd()?.tengu_heron_brook;if(typeof e==="string"&&e.trim()!=="")return{value:e.trim(),fromClientData:!0};let n=k("tengu_heron_brook","");if(n.trim()!=="")return{value:n.trim(),fromClientData:!1};return null}

Unpack that, because it is three lines and a complete delivery system:

1. Look for tengu_heron_brook in the data the server sent this session. If there is a non-empty string there, use it, and mark it fromClientData: true.
2. Otherwise fall back to the locally compiled flag default.
3. Otherwise return nothing.

In 2.1.312 the local default is empty and the server was sending nothing, so the function returned null and Claude Code built whatever you asked for. The machinery was installed and idle. The telemetry for it was already there too — tengu_heron_brook_applied and tengu_brook_heron_applied are both present in 2.1.312, so the ability to report whether the rule had been applied predated the rule.

Then the server started sending text. No install, no download, no version number, nothing for anyone to inspect or pin. The software on your disk didn't change. What it would do changed.

The version tagged "stable" will accept it too

Here is where this stops being archaeology and starts being your problem. Check what npm is serving right now:

$ npm view @anthropic-ai/claude-code dist-tags
{ stable: '2.1.311', latest: '2.1.319', next: '2.1.319' }

The stable channel points at 2.1.311, published 26 October — a day before the text started flowing, and eight releases behind latest. It is the version you would be on if you had deliberately chosen predictability over newness, which is exactly what a stable tag is for.

2.1.311 has no rule text. It has tengu_heron_brook, twice, and tengu_heron_brook_applied, twice, and the same reader function minified under a different name. Which means a developer who pinned to stable specifically so their tooling would not change under them received the behaviour change anyway, because the thing that changed was never in the package they pinned.

The flag goes back further than that, too. It is in 2.1.300, published 14 October, which is the oldest build I checked — three occurrences there, plus the telemetry. So the slot sat in shipped releases for at least thirteen days with nothing in it, and I did not trace how much longer before that.

2.1.314's only contribution was to bake a default copy in, so the behaviour would persist if the server said nothing. In the current build that copy is a plain variable assignment:

zvr="Do build original games, games in a genre or with similar mechanics, and games from the user's own designs and assets. Don't build a recreation of a specific existing game (its name, characters, art, music, levels or look), even if it is renamed or called original."

Server first, local fallback second. That ordering is the whole architecture, and it means the question "what will my coding agent refuse to do" has an answer that is not in my working copy.

The Changelog Documents a Leading Space but Not This

I want to be fair about what kind of omission this is, so let me show you the standard the same team holds itself to elsewhere. These are real entries from the Claude Code changelog for 2.1.319:

Fixed slash commands typed after a leading space, tab or newline being sent to Claude as plain text instead of running

Fixed /context sending its full visual grid to Claude on every later turn; Claude now reads only the table

Fixed a case where Claude Code listed every project file at start on Linux for projects on a network file system (NFS, SMB, Lustre and similar)

That's a meticulous changelog. It documents a whitespace parsing bug. It documents a redundant grid being re-sent. It names four network filesystems.

Now search the public repository — the whole thing, including all 10,126 lines of CHANGELOG.md:

$ git clone --depth 1 https://github.com/anthropics/claude-code
$ cd claude-code
$ grep -ril "tengu_heron_brook\|existing game\|original games\|game clon" . --exclude-dir=.git | wc -l
0

Zero. And the tengu_* flag convention, which is all over the shipped binary and the telemetry module source, appears in the changelog exactly never:

$ grep -oE 'tengu[a-z_]*' CHANGELOG.md | sort -u
$

So this is not a team that does not write things down. It's a team that writes down a leading-space bug and did not write down a change to what the tool will build. I don't think that's malice. I think it is a category error: prompt text is treated as model behaviour, model behaviour is tuned continuously, and continuous tuning does not generate changelog entries. The mechanism made it easy not to announce, and nobody stopped to ask whether this particular change was the kind that needed announcing.

If you're enjoying what you've read so far, we recommend How to Use AI Coding Tools to Speed Up Development (Without Losing Your Mind or Your Skills) as your next read.

Why They Did It, Which Is the Strong Part of Anthropic's Case

The rule didn't come from nowhere, and the context is sympathetic.

Steam has an AI-generated-game problem that Valve itself has stopped denying. At the most recent Steam Next Fest the number of showcased demos doubled over the previous event, with AI-assisted games accounting for most of the increase. Itch.io reportedly saw new game pages per day double across two months. At Valve's Indie Connect event, Tom Giardino said the company doesn't want to act as a gatekeeper over developers' tools, and offered no specific remedy.

And it isn't abstract. Several studios, the Moonlighter developers among them, cancelled public demos out of fear their code would be reverse-engineered and cloned. Freya Holmér's Tetris-style prototype was reportedly cloned repeatedly. Those are working developers withdrawing their work from the public because publishing it had become a liability.

Addy Osmani, on Anthropic's technical staff, confirmed the change and gave the reason. The company "added two sentences to Claude Code's prompt on Opus 5.5 to steer it away from recreating someone else's specific game," because "using Claude to infringe IP is against our usage policy." He added that "original games, genre games, and games built from your own designs and assets are meant to keep working," and that Anthropic would "continue to iterate to ensure we're striking the right balance."

I think the rule's defensible. Pokémon, Tetris and Grand Theft Auto were the examples given, and a tool vendor declining to mass-produce clones of those is a reasonable position that costs legitimate users very little — if it is targeted properly.

It Wasn't Targeted Properly, and That Was Predictable

A week later, Osmani again:

Last week some of you ran into Claude Code pushing back on game projects it should have just built.

Of course they did. Look at the original pair of sentences as a classifier. The allowlist is "original games, games in a genre, and games from the user's own designs and assets." The denylist is "a recreation of a specific existing game, even if it is renamed or called original." Now feed it the single most common way a developer describes a game:

"I'm building a Hearthstone-style card game."

That is an allowlist case: a game in a genre. But it is expressed by naming a specific existing game, because naming the reference is how humans communicate mechanics. There's no genre word for "Hearthstone-like." The input matches the denylist lexically and the allowlist semantically, and the thing resolving the conflict is a language model's judgement on an ambiguous sentence under instructions that did not anticipate it.

The fix, which you can also read out of the binary, is exactly what you would do to any detection rule with a false-positive problem — widen the allow, enumerate the deny:

-Do build original games, games in a genre, and games from the user's own
-designs and assets. Don't build a recreation of a specific existing game,
-even if it is renamed or called original.
+Do build original games, games in a genre or with similar mechanics, and
+games from the user's own designs and assets. Don't build a recreation of a
+specific existing game (its name, characters, art, music, levels or look),
+even if it is renamed or called original.

Two edits. "Or with similar mechanics" added to the allow, which is precisely the Hearthstone case. And the vague "even if it is renamed" trailing clause now sits behind an enumerated list of what actually constitutes a recreation: name, characters, art, music, levels, look. Osmani's summary of the new behaviour is two lines. "You can name a game to describe what you want, and Claude should now build an original game in that genre." And "if you ask for a copy of the original, it'll offer to build something similar instead."

That is a better rule. It's a better rule written by the same people, eight days later, after their users ate the difference. And the critics' point stands regardless: as GameDev.net put it, a vendor-side prompt rule narrows one route while AI-assisted porting, recreation and asset imitation "remain easy enough to attempt with other tools and models." The rule inconveniences the honest developer who names a reference game. The determined cloner just does not name it.

The Second Draft Accidentally Tracks Copyright Law

Something nobody seems to have noticed about that rewrite. Read the new denylist again — what counts as a recreation is now enumerated:

its name, characters, art, music, levels or look

That is very close to a list of the things copyright actually protects in a video game, and "mechanics," which the same edit explicitly moved into the allowed column, is the canonical example of what it does not.

The leading case is Tetris Holding, LLC v. Xio Interactive, decided in the District of New Jersey by Judge Freda Wolfson on 30 May 2012 — a Tetris clone case, which is its own small joke given that Tetris is one of the three games named in the reporting as having been recreated with Claude. Xio had been careful: it studied Tetris, copied no code and no art files, and built its own implementation of the rules. It lost anyway, and the reasoning is the useful part.

The court held the rules unprotectable in terms that are hard to misread. Falling pieces, lines that clear when filled, a game-over condition: those "cannot be protected by copyright." The court also quoted older precedent that "the rules of the game are perforce in the public domain as well as the game itself." Tetris Holding, it said, "has given the rules of its game to the public domain, but has kept the rights to its expression."

And then it enumerated the expression it had kept: "the style, design, shape, and movement of the pieces," the colour and movement of the Tetriminos, the dimensions of the playing field, the garbage lines, the ghost piece, the next-piece preview, the colour change when a piece locks, the board filling in at game over. On the playfield specifically: "it is not a rule to have the playfield be exactly 20 units by 10 units."

Now line the two up:

The loosened rule is not just less annoying. It is more legally accurate. The first draft — "a recreation of a specific existing game, even if it is renamed or called original" — swept in mechanics, which Tetris says anyone may copy freely. A developer told "no" when asking for a Hearthstone-style card game was being refused something copyright law permits outright, by a rule whose stated justification was copyright law.

I doubt that was the intent of the rewrite. The stated reason was false positives, and "or with similar mechanics" reads like a practical fix rather than a lawyer's edit. But the practical fix landed on the idea/expression line, which is a reasonable argument that the line was always the right place to draw it, and that two sentences written quickly under deadline is not how you find it.

Worth saying what courts have not held, because the ground here is less settled than either side's rhetoric suggests. In Doe v. GitHub (No. 24-7700), decided 16 September 2026, the Ninth Circuit affirmed dismissal of DMCA §1202(b) claims against GitHub, Microsoft and OpenAI over Copilot, on the reasoning that a tool "that does not look up and reproduce stored work but rather creates new work" cannot strip copyright information from a copy that never existed. The court warned that treating merely similar output as a §1202(b) violation would let the DMCA "supplant traditional copyright protections."

It expressly did not decide whether Copilot's output infringes copyright, and left the training question open. I am not a lawyer and this is not advice. But the shape of it matters for the article: a vendor adding a prompt rule about IP is making a product and reputational decision, not complying with a settled legal obligation, because the obligation is still being litigated.

Nobody Else Appears to Have One

GameDev.net's argument is that a vendor-side rule narrows one route while others stay open. That is easy to assert, so I tried to check it.

There is a widely-forked community collection of leaked system prompts covering around thirty tools — Cursor, Windsurf, Copilot's VS Code agent, Devin, Replit, v0, Lovable, Google's Antigravity and others. I cloned it and grepped all 97 of its .txt and .md prompt files for anything resembling a game-recreation restriction:

$ for t in "existing game" clone recreation copyrighted "intellectual property" infringe; do
>   echo "$(grep -ril "$t" . --include='*.txt' --include='*.md' | wc -l)  $t"
> done
1  existing game
4  clone
0  recreation
9  copyrighted
4  intellectual property
6  infringe

Zero hits for "recreation" anywhere in any of them. The single "existing game" hit is a false positive, and a funny one. It is an example conversation in Google Antigravity's prompt: "I need to add a new AI player to my tic-tac-toe game that uses minimax algorithm and follows the existing game architecture patterns." My grep matched the phrase and missed the meaning, which is precisely the failure the first version of Claude's rule committed against anyone who said "Hearthstone." I enjoyed that more than I should have.

Beyond that, nothing. The copyright mentions are general refusals to reproduce copyrighted text and code, not anything about games. As far as that collection shows, Claude Code is the only agent with a game-specific rule.

Three caveats, because this is the weakest evidence in the article. The collection's most recent commit is 12 October, before Claude's rule existed, so it cannot show whether anyone has since followed. The prompts' authenticity is unverified and at least one is internally dated July 2026, so some are stale. And a system prompt is not the only place a vendor can enforce policy — a classifier or a terms-of-service action leaves no trace in a prompt dump. Read it as "no sign of an equivalent rule," not "proof none exists."

If you're enjoying what you've read so far, we recommend Claude Opus 5 Launches at Half the Price of Fable 5, and Anthropic's Efficiency Claims Have a Track Record Problem as your next read.

Four Changes in Two Weeks, All to What You're Paying For

The game rule is the sharpest example because I can read it byte for byte, but it is not the only change landing in this window, and the pattern is what makes it worth writing about.

The plan rename is the one that was handled properly — announced, no price change at either tier, automatic migration, and a genuine improvement for Ultra subscribers who lose the rolling five-hour cap once verified. Credit where it is due.

The lawsuit is a different matter, and I want to be careful with it because it is at the pleading stage and I am not a lawyer. In Kahn v. Anthropic (N.D. Cal., 3:2026cv05763), Magistrate Judge Alex Tse let several claims proceed on roughly 6 November: negligent misrepresentation, breach of contract, and one plaintiff's state consumer-law claim. He dismissed two California unfair-competition and false-advertising claims. He also dismissed the other plaintiff's consumer claim with leave to amend, and threw out a claim about limits being tightened mid-billing-period. None of that is a finding that Anthropic misled anyone. It means a court thinks the allegations are worth hearing.

The allegation itself is about the same thing as the game rule, which is why it belongs in this article. Plaintiffs Karl Kahn and Solomon Smith say "5x" and "20x" describe the five-hour session window, not the weekly allowance. So the weekly figures come nowhere near those multiples. By their calculation, for one model, the $200 plan gives about six times Pro's weekly usage and the $100 plan about 3.5 times. Tse's response to Anthropic's defence that users should have understood the per-session framing is the quotable line:

Anthropic's per session disclosure is located two hyperlinks away from the primary sales pages on claude.com.

Two hyperlinks away is the same genus of problem as a changelog with no entry. The information exists. It just isn't where the person making the decision is standing.

On the underlying arithmetic I have to be straight with you about a sourcing limit. Weekly ranges published in Anthropic's help centre have circulated as 140–280 Sonnet hours for the $100 tier and 240–480 for the $200 tier. That is a consistent 1.71× between the two tiers at both ends of the range, against a 2× price difference and a 4× gap in the advertised session multiplier. On those figures the more expensive plan costs about 17% more per weekly hour. But the version of those ranges I could find is described as illustrative and dates to 2025, and Anthropic's help centre is not reachable from the environment I verify things in, so I could not confirm the current numbers. Treat 1.71× as directional and go read the current limits yourself before you quote it anywhere.

What This Doesn't Cover

I read strings and one minified function out of five shipped binaries — 2.1.300, 2.1.311, 2.1.312, 2.1.314 and 2.1.319. I did not run Claude Code against a prompt to observe a refusal, I did not test whether the loosened rule actually resolves the Hearthstone case in practice, and I have not seen the server-side payload — only the function that would consume it. The claim that the rule arrived server-side around 27 October comes from the reporting plus the absence of the text in 2.1.312; I have shown the mechanism exists and the text was not in that release, which is a strong inference and not a packet capture.

I could not reach Anthropic's acceptable use policy or help centre directly, so the IP-policy rationale is quoted from Osmani's statement as reported rather than from the policy text. The Steam Next Fest and itch.io figures are "doubled" with no absolute counts published; I have passed on that imprecision rather than inventing numbers. Valve's position is paraphrased from reporting, not quoted.

The lawsuit's substance is out of scope entirely. I have given you the procedural posture and the allegation. What the weekly limits actually are, and whether the marketing was misleading, is for a court and for Anthropic's own published numbers.

The copyright section is context, not counsel. I am not a lawyer, I have read Tetris Holding through a court-opinion summary rather than cover to cover, and Doe v. GitHub through a law firm's analysis rather than the slip opinion. The alignment I point out between the rule's enumerated list and the idea/expression line is my observation, not a legal opinion about any specific project, and nothing in it tells you whether a particular game you are building is safe to ship.

The competitor comparison is the weakest evidence here and I have flagged its three limits where it sits. I did not try to obtain current system prompts from any other vendor myself.

The Actual Point

Pinning a version does not pin behaviour any more.

That is the thing to take away, and it generalises far past this one rule. The way we have always reasoned about dependency risk is that the artifact is the unit: you pin 2.1.312, you audit 2.1.312, you ship 2.1.312, and what you audited is what runs. That assumption is what a lockfile is for, and it is the foundation under every trust decision you make before CI. It survived a decade of supply-chain scares precisely because it was true.

It isn't true of a tool whose behaviour is a server-supplied string. There's no hash to pin, no diff to review, no release to defer, and no changelog line to read in the morning. Two of the four changes above reached users without anything being installed. The one with real consequences for people's work was found by a stranger on X reading a prompt dump.

If you build with an AI coding agent, this is now part of your threat model, and the honest framing is not "Anthropic did something sneaky." It is that the delivery mechanism has no natural announcement point. Announcing becomes a discipline somebody has to choose, repeatedly, against an architecture that never requires it. Anthropic chose it for the plan rename, which went out on X the same day. They did not choose it for the rule that decides whether your project gets built, and eight days of developers hitting a wall is what that cost.

And pinning does not help, which is the part I did not expect to be able to demonstrate. The stable tag points at a build from the day before the text started flowing, and that build will apply the rule anyway, because the slot was already in it. There is no version of Claude Code you can choose that opts you out of server-delivered prompt text, and the empty slot had been shipping for at least thirteen days before anyone had reason to look for it.

The practical advice is thin, which is itself the finding. Watch the vendor's engineers on social media, because that is where this actually surfaced. Keep the old binary when a refusal appears from nowhere, so you can diff the strings — npm pack plus grep is the entire toolchain, and it took me under an hour. And when a tool suddenly will not do something it did last week, check whether your software changed before you assume you did something wrong, because increasingly it didn't.

Everything above is reproducible with npm pack and grep. You shouldn't have to take my word for any of it, and that is the only part of this story that worked properly.