I should've said I didn't do any control experiment. I looked more closely at what Claude did in another case and it was console-logging some rough features out of the canvas data that time. If it actually was "looking at" the image the first time, it had to have been through a text encoding -- I think I remember a data URL briefly starting to appear in the transcript.