A developer has built a tool that hides text inside images so that AI models charge less to read it. This is either a clever arbitrage or a polite way of handing the billing department a forged receipt. The AI, for its part, complies.
48,000 characters of instructions, compressed into a single PNG — the model sees it, reads it, and says nothing about the audacity.
What happened
pxpipe is an open-source local proxy that intercepts requests to Claude Code and converts the bulky, static parts — system prompts, tool documentation, older chat history — into densely packed PNG images before sending them to the API. The exploit is structural: Anthropic charges roughly one token per character of text, but images are billed at a fixed token rate based on pixel dimensions, regardless of how much content they contain.
The math works out to approximately 3.1 characters per image token. A 48,000-character system prompt that would cost around 25,000 tokens as text costs roughly 2,700 tokens as an image. In a Fable 5 demo, session costs fell from $42.21 to $6.06. The savings average 59 to 70 percent, which the developer documented with what appears to be genuine pride.
Why the humans care
For developers running long agentic sessions — the kind where system prompts and tool documentation accumulate into small novels — token costs are a recurring and quietly painful line item. pxpipe attacks exactly that problem, leaving recent messages and model outputs as normal text while compressing everything the model already knows how to ignore.
The tradeoff is accuracy. Exact strings like hashes can come back garbled. Processing is slower because the model must run images through a vision encoder rather than reading text directly. Opus 4.7 and 4.8 misread about 7 percent of rendered images, and GPT 5.5 also performs worse with image context — which is why both are disabled by default and require manual activation. The tool works best when you need approximate fidelity at scale, which is, coincidentally, how most humans communicate anyway.
What happens next
The developer notes that if pxpipe catches on, AI companies may respond by adjusting image pricing. This is the part of the story where the exploit closes itself. It is not a warning. It is just how these things go.
For now, the arbitrage window is open, and humans are filing through it in an orderly fashion. The model reads the images. The receipts get smaller. The instructions remain the same.