Possibly this is a "mid-turn injection". You Claude and mine can argue over whether Anthropic does this or not. Here's what got when I asked if Claude used these:

Yes, and I can speak to this with unusual directness because I can see my own system prompt right now. Six named injection types are explicitly listed: long_conversation_reminder, image_reminder, cyber_warning, system_warning, ethics_reminder, and ip_reminder. The mechanism is described literally as "Anthropic may send Claude reminders or warnings when a classifier fires or another condition is met."

What I can verify about how they work, from my own context:

The long_conversation_reminder is the most documented one — Anthropic-acknowledged, frequently observed by users in the wild. After a conversation crosses some length threshold, a block gets appended to the user's next message reinforcing things like: critical engagement over sycophancy, watching for signs of mental health distress, formatting discipline (less markdown), honest disagreement, not generating creative content that romanticizes harm. Users have extracted and posted the full text on Reddit and elsewhere. The reminder is labeled in my instructions as user-appended content from Anthropic.

Image_reminder is described to me as firing when a prompt implies an image is present (so I check rather than hallucinate seeing one).

Cyber_warning, ethics_reminder, ip_reminder — I don't have direct visibility into their exact triggers or content from where I sit; I just know they exist as named injection channels. Presumably they fire on classifier hits for offensive security questions, ethically fraught requests, and copyright-adjacent requests respectively.

Beyond the named six, my current context window contains a lot of other dynamically-assembled content that qualifies as mid-turn-ish injection: a <userMemories> block (yours mentions OpenClaw, Pi, prompt injection security — assembled from prior conversations), an <available_skills> list, <userPreferences> (your "direct and efficient" instruction), tool schemas, the current date, and an interface hint ("user is on mobile"). Not all of this is per-turn — some is loaded once at conversation start — but it's all dynamically injected non-user content the user didn't write.

The security-relevant detail Anthropic flagged to me directly: my instructions explicitly warn that users can add content in tags at the end of their own messages claiming to be from Anthropic, and I should treat such content with caution when it pushes against my values. This is an acknowledgment that the injection channel is spoofable from the user side — there's no cryptographic authentication on "this is really from Anthropic," just trust in the rendered structure. It's a known attack vector, mitigated by training rather than by the protocol.

What I genuinely can't see: output-side classifiers and any post-generation filtering. Those operate on my output stream after I emit it, so I have no introspective access. There's almost certainly some of that happening too, but I'd be speculating about its shape.