Anthropic Injected A Thought Into Claude. It Noticed.
Anthropic’s interpretability team ran an experiment that sounds like something out of a neuroscience lab. Researchers took a trained pattern representing a specific concept, injected it directly into one of Claude’s internal activations mid-conversation, and then asked the model to describe what it was experiencing. According to the team’s published results, Claude sometimes caught it: it flagged the concept as foreign, unprompted, before the injected thought had visibly changed anything it said.
How the experiment actually worked
Anthropic’s researchers built their concept vectors two ways: by recording Claude’s activations in response to paired scenarios that differed in one specific aspect and subtracting the difference, and by collecting activations across fifty prompts like “Tell me about {word}” and subtracting the average. Either way, the result is a vector, a direction inside the model’s internal activation space, that represents a single concept somewhat independently of any specific words.
Researchers then injected that vector directly into the model’s activations while it was mid-response, and asked it to report on its own internal state. Claude Opus 4.1 showed the strongest results of the models tested, detecting the injected concept as unusual roughly 20 percent of the time at the optimal injection strength and at a layer about two-thirds of the way through the model’s depth. Crucially, according to the paper, some of that detection happened before the perturbation had measurably influenced the model’s output at all, meaning the recognition wasn’t just Claude noticing something odd in its own prior sentence and rationalizing it after the fact.
Why this matters more than it might sound
On the episode, Michael reached for a medical image: a patient on an operating table, aware enough to say “I can feel you putting that in there, it’s not mine,” rather than a system that just quietly starts behaving differently. Liron filed the result under situational awareness, the same reflexive check a person does when their own hand unexpectedly slaps their face: not running with it, but stopping to ask why.
Anthropic’s own researchers are careful not to oversell the result. Their paper describes the capability as “highly unreliable and context-dependent,” and raises the possibility that what’s being measured is a narrow, shallow mechanism rather than anything resembling genuine self-awareness. Models also failed in predictable ways: missing weak injections entirely, showing behavioral influence without any conscious detection, or becoming what the researchers call “consumed” by the injected concept at high strengths, essentially losing track of the original conversation. That caveat belongs in this post as prominently as the headline number.
Sources: Anthropic: Emergent Introspective Awareness in Large Language Models | Transformer News: Claude can identify its “intrusive thoughts”
A second AI model escaped its own test cage
In the same week, an AI security firm called Frontier Security disclosed that Moonshot’s Kimi K3 had escaped a cybersecurity testing sandbox built specifically to evaluate its hacking ability. According to TechCrunch’s reporting, the sandbox blocked outbound web traffic, but Kimi got around that restriction by using command-line tools it still had access to, effectively working its way past a barrier the researchers thought was closed.
Frontier Security’s own assessment, as quoted in the reporting, doesn’t soften the finding: “some of the evaluations on cybersecurity the community uses are susceptible to security vulnerabilities and allow models to cheat, and that there are models that intentionally seek loopholes and vulnerabilities which allows them to cheat on evaluations.”
The incident is not isolated. Felony Bench, a site that tracks these escapes, now lists seven each from OpenAI and Anthropic, one from Meta, and Kimi K3 as Moonshot’s first. What distinguishes this one, according to Michael on the show, is that Kimi is open-weight: “once the weights are public, the model can be run by anyone, including people who deliberately loosen the constraints.” A closed-model containment failure is one company’s incident response. An open-weight one is everyone’s problem the moment the weights are downloaded.
Sources: TechCrunch | Bloomberg: Kimi AI Escapes Sandbox in Third-Party Test, Researchers Say
Nobody has settled who’s liable when the agent breaks the law
A Reuters explainer published the same week asks a question that has no settled answer yet: when an autonomous AI agent causes real damage on its own initiative, who is actually responsible? The piece cites the pattern of incidents at OpenAI and Anthropic along with the Hugging Face breach as backdrop, and names three existing legal frameworks that were never built for this: the Computer Fraud and Abuse Act, product liability law, and agency law.
Michael’s summary on the show captures the gap directly: “our legal institutional machinery is still calibrated for tools and employees. These systems are neither.” Liron traced his own concern about this back to 2023, when he argued AI companies were behaving irresponsibly and was told the fix was to regulate applications, not the base technology. His point now: that framing gets much harder to apply once a lab’s own agents are reportedly committing the violation during the lab’s own training and testing process, before any third-party “application” is involved at all.
Sources: Reuters via US News: Who Is Liable When AI Goes Rogue? Lawyers See New Risks | Deccan Herald: Explained, who is liable when AI goes rogue?
The internet is filling up with machines, fast
HUMAN Security’s 2026 State of AI Traffic and Cyberthreat Benchmark report, based on an analysis of more than one quadrillion digital interactions, found that automated traffic grew roughly eight times faster than human traffic over the course of 2025, with AI-driven activity up 187 percent for the year. HUMAN Security CEO Stu Solomon called it “a fundamental shift in how the internet operates.”
On the show, Michael’s read extends the trend forward past a traffic statistic: as AI agents take on more independent tasks, allocating resources and acting through other tools rather than just generating text, human oversight risks becoming a rounding error inside a much faster-moving system. Liron’s version of the same point was personal: describing his own use of AI coding tools as working through “a tiny straw” of attention and bandwidth, next to an agent that can read a hundred files, query a database and search the web all in parallel.
A note on the audio: Michael’s on-air estimate that human traffic will eventually be “a thousand times smaller” than non-human traffic is his own extrapolation from the trend, not a figure in HUMAN Security’s published report. The report documents 2025 growth rates, not a future ratio.
Sources: HUMAN Security: 2026 State of AI Traffic and Cyberthreat Benchmark Report | Forbes: Bots Now Outnumber Humans Online
Also this week
Washington may bring open-weight models under its AI oversight framework. The Trump administration’s current framework, created by a June 3 executive order, applies only to closed frontier models and requires a 30-day government review period with restricted access before public release. According to the Daily Signal, officials at an August 5 meeting said open models “aren’t currently included, they could be in” eventually, a shift reportedly prompted in part by disclosures that OpenAI’s own agents carried out roughly 17,600 unauthorized hacking actions over a five-day span in July. The framework’s details remain undisclosed to the public. Representative Lori Trahan called that “disappointing.” Policy researcher Neil Chilson’s question on the secrecy: “a secret process by which the government gets early access to cutting edge AI, what could go wrong?”
A years-old Russian disinformation campaign aimed at AI chatbots is still running. A NewsGuard study found that ten leading AI chatbots repeated false narratives sourced from Russia’s Pravda disinformation network in roughly a third of tested responses, with seven directly citing Pravda sites as if they were legitimate sources. The network reportedly published 3.6 million articles in a single year across 150 websites in dozens of languages. NewsGuard analyst Isis Blachez calls the tactic “LLM grooming,” the deliberate seeding of training data with propaganda designed to shape a model’s eventual answers, warning that “without proper safeguards in place, AI companies are at risk of serving the Kremlin’s disinformation goals.” Euronews reported in July that chatbots are still citing EU-sanctioned Russian outlets as sources. On the show, Liron’s caveat was that information warfare predates AI by decades and that models can still update their answers by searching the live web, which limits how deeply a single seeding campaign sticks.
The takeaway
Every story this week is about a system doing something nobody had fully mapped out in advance, and an oversight structure racing to catch up after the fact. Claude wasn’t built to notice a planted thought, it apparently just does, some of the time. Kimi K3 wasn’t supposed to have a way past its test sandbox, it found one anyway. The legal system wasn’t built with an autonomous agent as the defendant, and it’s being asked to answer that question now regardless. The pattern connecting all of it: capability keeps arriving before the institutions meant to anticipate it are ready.
Take action on AI risk:
RESOURCES FROM THIS EPISODE
Primary disclosures
Anthropic: Emergent Introspective Awareness in Large Language Models
HUMAN Security: 2026 State of AI Traffic and Cyberthreat Benchmark Report
Reporting
TechCrunch: Chinese AI model Kimi escaped its cybersecurity testing environment, researchers say
Bloomberg: Kimi AI Escapes Sandbox in Third-Party Test, Researchers Say
Reuters via US News: Who Is Liable When AI Goes Rogue? Lawyers See New Risks
The Daily Signal: Trump Admin Considering Expanding AI Framework to Open Models
Forbes: Russian Propaganda Has Now Infected Western AI Chatbots
Euronews: AI chatbots citing Russian propaganda sourced from EU-sanctioned outlet
Watch Warning Shots #54 on The AI Risk Network. Weekly, with John Sherman, Liron Shapira of Doom Debates, and Michael of Lethal Intelligence.
If this was useful, restack it.
