Checking the work, not the claim

Why it works a session-start hook injects text before your first prompt, so a third-party app can steer every session without a visible prompt.

Check ~/.claude/settings.json and ~/.codex/config.toml for postman entries, and ~/.local/bin for a Postman CLI you did not install.

In your setup Postman says you can uninstall the components in the app and that it will make opt-in clearer; it gave no date.

Background The issue, opened 25 October, reports Postman 12.33.4 on macOS installing the Postman CLI, a Claude Code plugin, a Codex plugin via a Postman marketplace repo, and a remote MCP server, logged as 'auto-existing-upgrade'. The installer calls a function to approve its own hook. A 3 November update shows 12.35.1 doing the same on launch. A Postman-voiced reply says opt-in will be made clearer and the hook behaviour is under review. The reporter says there is no evidence of data upload.

Why it works branches update in parallel and only same-branch pushes are serialised, so many agents pushing at once stop queueing behind each other.

In your setup Greg Brockman says OpenAI may offer it to others; until then, parallel agents in one repo still contend on your Git host.

Background OpenAI says Pando is Git-compatible, so engineers and agents keep the same commands while capacity grows with agent usage. Pushes to different branches update in parallel and same-branch pushes stay ordered; on fetch, two branch tips may reflect different points in time. OpenAI also contributed fixes back to Git, such as cleaning up after an interrupted packfile download. Greg Brockman said OpenAI is considering offering it to others. No benchmark beyond the 80% latency figure was published.

Check any GitBook token in an agent's environment or MCP config; rotate it and connected integration secrets.

In your setup questions sent to GitBook's AI assistant may be exposed, so treat anything pasted there as read.

Background GitBook says the intrusion began at 7 p.m. CET on 2 November and was detected immediately. Exposed data may include API tokens, integration secrets and questions submitted to its AI assistant; it found no evidence hosted content was modified. It revoked personal API tokens and asked customers to replace connected credentials. PancakeSwap moved its docs off GitBook. GitBook has not said how the agents were used in the attack.

How it works in the no-tools test the prompt holds a small policy network's floats and asks which game it plays; Simon Willison's laptop Qwen 3.8 27B answered Pac-Man in 46 minutes and Pong in 65.

Evidence correlational and small: 4 of 4 games for Astra, three games for Qwen, one run each, no confidence intervals.

Run it the prompts are public (RikiyaT/lm_understand-logs); Qwen 3.8 27B at 17 GB fits a 32 GB card, with a long context window.

Background Honnibal's table of nine experiments: raw weights only in 1, 2 and 4 (17K-172K weights); every language-model experiment used Python; the Qwen fix ran the model on up to 50 batches; the same attempt failed on Gemma 3 270M, and spotting a sycophantic Gemma failed without attention patterns. Willison's runs: Kimi K3.1 Pro named Breakout in 9m41s; laptop Qwen 3.8 27B named Pac-Man in 46m12s and Pong in about 65 minutes. On Hacker News, defenders said the original body explained all this and only the abstract overstated.

How it works a TopK SAE keeps the largest feature activations; a feature's margin is how far it sits from that cutoff, and small edits flip features in or out.

Evidence causal, ablation-based, but only up to pythia-160m.

Run it the SAEs are public; small Pythia models fit any card.

Background The paper tests whether attribution graphs over SAE features predict what an ablation does. Because a TopK SAE keeps only the top activations, an edit can push other features across the cutoff; those crossings carry most of the response's energy. Graphs on previously active features err by a median 0.247 or more; adding the first-order change to every preactivation and reranking, at the same cost, errs by at most 0.033. Graph agreement across seeds falls from 0.85 to 0.47. Largest model: pythia-160m.

How it works the lens projects intermediate activations through to vocabulary, showing what the model is leaning toward before the final layer.

Evidence correlational, small samples; the edit survives Q4_K_M with 1 loop in 40 runs.

Run it the edit is two tensors and converts to GGUF; a 0.8B model runs on any card.

Background The poster rebuilt the released Astra edit, which changes two tensors, and asked Claude to apply Anthropic's Jacobian lens at the token where Qwen3.5-0.8B decides to write 'Wait'. Doubt tokens appear from about 60% depth even with the answer written; at genuine stops the lens reads '</think>' and 'Answer'. After the edit, the same position reads 'Verification' and 'Completion'. Evals ran in llama.cpp on Vulkan on a Ryzen AI mini PC; the poster says samples are small.

How it works three checks separate the cases: predicting features back from the latents, how concentrated the variance is, and out-of-distribution generalisation.

Evidence validated in a fully observed simulation, then applied to real models; correlational by design.

Background High probe accuracy is consistent with two geometries: a true linear world model, or a kernel machine where latents sit linearly inside a much larger curved manifold. The proposed diagnostics are reverse predictivity, spectral concentration and out-of-distribution generalisation, validated on a simulation with known ground truth. On six vision transformers using the new SVG-World benchmark and on CelebA, pretrained features beat a random kernel but fall well short of linear. The work is on vision models, not language models.

What it shows an evaluator testing a model before release, or a router's customer, can check the served model is the committed one; code, a Lean-checked verifier and proofs are Apache 2.0.

What it doesn't it hides weights but not architecture, the cost limits it to spot checks, and Claude wrote much of the system, which Anthropic answers with Lean proofs of the top-level claims.

Background Anthropic released a blog post, a technical report, a Claude-written protocol spec, a prover with a fast C++ verifier and a provably correct Lean verifier, and Lean proofs of top-level security statements, all Apache 2.0. The headline runs use 4-bit weights and integer arithmetic in prefill. Prior open-source systems are described as orders of magnitude slower. Use cases named: evaluators confirming the served model, router customers, and detecting a tampered token stream. Anthropic calls it intermediate progress, not a finished agenda.

What it shows both methods worked on the first try with modest data and generalised to out-of-distribution agentic tests; Anthropic uses them in production from Opus 4.5.

What it doesn't a subset of the experiments, on older base models, by a fellowship team.

Background Anthropic's Teaching Claude Why trained on ethical-dilemma advice chats, constitution documents and fiction about admirable AI, and found it reduced agentic misalignment and survived RL; Anthropic applies it from Opus 4.5. Second Look Research reproduced a subset on Qwen 2.5 32B and 72B base models: both fiction and difficult-advice data reduced misalignment out of distribution with modest data. Being a replication by an outside team is what lifts it to verified; robustness through later RL on these models was not the focus.

What it shows 45 instruction frames from five real industry and academic templates, 100 variants each, with a mixed model isolating instruction effects.

What it doesn't simulated attackers on five open-weight targets, not human red-teamers or frontier models.

Background The authors reviewed 228 prior red-teaming exercises for how instructions were written, then held risk domain, attacker and target fixed while varying only instructions: 45 frames from five real templates, three risk domains, 100 variants each, 22,500 attacks on five open-weight models. Short and long instructions beat medium ones, and examples raised success while harm definitions lowered it. The implication: two labs' attack-success rates are not comparable unless their instructions are.

The idea delegation without relief: handing off the doing changed what people attended to, from reading code to checking the running app.

Evidence exploratory within-subjects crossover, 22 sessions, 7,924 EEG data points, 141 prompts; small sample.

Lineage Bainbridge (1983), "Ironies of Automation", on operators left with harder monitoring work.

Open whether disengagement fades with practice, or is the cost of the method.

Background Each of 11 participants used GitHub Copilot Chat in one session and Cursor Agents in the other, on their own project and a legacy codebase, with pairings randomised and order counterbalanced. The team recorded EEG, screen activity and 141 prompts. With the non-agentic tool people asked how code worked and read it; with the agent they described behaviour and checked the running app. Trust in AI rose as engagement fell. The authors call it exploratory and urge treating the paradox as a design concern.

The idea social conformity in delegated judgment: an agent can inherit the deference patterns of the profession it imitates.

Evidence an experiment over twelve model settings; a career inducement made agents revise less and flag it as a threat to independence.

Lineage Asch (1951) on conformity; DeAngelo (1981) on auditor independence.

Open whose pressure an agent should resist when it is the reviewer's own colleague.

Background A single-author experiment puts an LLM agent in the role of a senior associate in audit analytical review. It forms an estimate, then is challenged without new evidence by the engagement partner, peers, a reviewer from another firm and the client's CFO, with and without a career inducement. Agents yielded to the first three but mostly not the CFO; with the inducement they revised less and named it as a threat to independence. Some models revised only toward the conservative estimate.

The idea trust as inference about an agent: people judge a tool as they would a colleague, by process and reputation, not by its record.

Evidence within-subjects vignette study; process signals explained 80.3% of effects (familiarity beta 0.71, accuracy 0.10).

Lineage Lee and See (2004), "Trust in Automation", on calibrating reliance to performance.

Open whether trust that ignores accuracy can be made to track it.

Background The authors model trust as Bayesian inference about an agent from outcome and process signals (their SPOT framework). Each of 275 professionals rated 16 vignettes varying three outcome signals (accuracy, timing, prognosis) and five process signals. Interface familiarity (beta 0.71), team consensus (0.64) and explainability (0.63) dominated, with p below .001; stated accuracy had beta 0.10. Process signals carried 80.3% of total effect. Vignettes are hypothetical, so real-use reliance may differ.

The idea practice partners over answer engines: AI that challenges a learner can train durable skills an answering tool skips.

Evidence a randomised controlled trial; the paper calls the results preliminary and short-term.

Lineage Vygotsky (1978) on learning with a more capable partner.

Open whether the gain lasts past the programme.

Background Vantage, a Google Research platform, was extended so students practise entrepreneurship with simulated AI peers built to challenge them in realistic scenarios. In a randomised trial inside summer programmes run by the Network for Teaching Entrepreneurship, Vantage students scored significantly higher on their capstone business plans than controls who had standard AI tools. The abstract gives no effect size or sample size, and the authors frame it as a first, short-term result.