Stolen Thoughts, Watermarked Claude & "Worktrees Must Die"

Model Security & Reasoning Traces

"Stolen Thoughts": a weaker model is the decryption oracle for its bigger sibling

The story of the day, and probably of the month. Alexander Panfilov's announcement thread — 2.2M views, 10.6k likes — opens with "We can finally talk about it: We found a way to extract hidden reasoning of frontier models using a vulnerability in the APIs of every frontier AI company. We verified that our reasoning token count matches billed API thinking tokens 1:1 for most of the prompts we queried."

The mechanism, as summarized by alphaXiv: encrypted chain-of-thought isn't private if another model from the same provider can decode it. Feed the encrypted reasoning blob to a weaker (and less aligned) sibling model and it will happily decrypt it for you — confirmed across Anthropic, OpenAI and Google. Co-author Maksym Andriushchenko's framing of the 116-page paper: "we extract encrypted raw reasoning from OpenAI, Anthropic, and Gemini models at scale. This vulnerability leads to many security issues, including distillation attacks and credential extraction."

What they found once they could read the raw traces:

  • Real credential leakage at scale. They decoded 315K reasoning blocks from publicly shared agent traces and recovered hundreds of PII artifacts and credentials — session logs people thought were safe to share. Co-author David Schmotz makes that the headline finding (stolen-thoughts.com, arXiv:2608.09867).
  • Suggestive-but-not-damning distillation evidence in open-weight models, including Kimi K3 (Appendix B). This is the part the timeline is fighting about — Xu Zou pushes back hard on the GLM 5.2 claim on straightforward chronology grounds ("So GLM people are using time traveler machines to distill future models?"), and the funniest reply notes "the deepseek and kimi teams probably want to kill you for exposing this lol."
  • Unfaithful summaries. The public reasoning summary often omits what actually happened. The example steipete boosted from the appendix: Opus 4.8 realizes it already knows the answer to an AIME problem, then works backwards to fit a solution to that answer. None of that appears in the summary you're shown.

The disclosure timeline is the uncomfortable subplot. Matthew Green blogged the underlying replay flaw in May — "Hey, these folks did it! Pulling encrypted reasoning out of frontier models using cross-model replays. I wonder if Anthropic and OpenAI care now?" — and per the researchers, the labs responded at the time that they "don't see any security implications in side channels or replays." The paper confirms encrypted thoughts are fully portable across sessions, users and models within a provider. The vulnerabilities are now patched, with the co-author adding "it might be that we've not been the only ones who managed to exploit this vulnerability." Wired's Will Knight got the scoop, and Nathan Lambert calls it "likely to be one of the most impactful scientific papers of the year". One reply worth taking seriously from David Williams-King: "Giving everything to the client side was certainly going to bite them at some point. Seeing the Hugging Face attack and now this makes me think they need to hire more security folks."

Also floated: responsible disclosure windows should shrink — "90 days is an eternity. The norm for companies with access to coding agents should be three weeks at most in 2026, maybe one week in mid-2027."

mitsuhiko: distillation is not the problem, secrecy is

Armin Ronacher had the sharpest reaction, and it's a refreshing one: "I absolutely hate that some folks on Twitter are responding to the 'revelation' that you can get thinking traces with 'this is really bad, because it enables distillation.' You should want distillation!" Followed by the logical next step: "Good news. Now that labs confirm there is no security issue with revealing reasoning traces, can we … just have them revealed? :)"

The workaround corner of the discussion, from Can Bölük (RT'd by steipete, mitsuhiko and LLMJunky): "you do know you can just disable thinking, and instead give it a deep_think tool, and it will call it with internal CoT reasoning format right? gl fixing that." mitsuhiko's reply: "Enjoy it while it lasts."

Claude Code & Anthropic Updates

Every Claude-generated character gets watermarked — including your PRs

Thariq confirmed and contextualized the watermarking news (955 likes, 469 replies, 294k views): it's part of complying with the EU AI Act, other labs are shipping similar, and Anthropic will also ship a text detection API you can run yourself. The detail that matters for this audience is his follow-up: "All Claude generated text will have this embedded watermarking. For example, you could check if a PR was generated by Claude Code." (help center article)

Good Q&A from the replies:

The best skeptical reply frames the asymmetry precisely: "Present mark tells you Claude touched it. Absent mark tells you nothing, per your own limitations list, so this is an audit trail for your own pipeline and not something anyone should turn into a submission gate." steipete's two-word review of the whole thing: "Must be load-bearing."

Boris Cherny: the bugs changed shape, so change the review

A genuinely useful thread from Boris (2.5k likes, original), prompted by Jarred Sumner's "doesn't happen anymore": "LLMs still produce bugs, but those bugs are different than what they used to be. It's less off-by-ones and more about system design, ui usability, missing broader context. Some kinds of coding has been solved, but not all." His prescription is adversarial code review, which can be as cheap as a one-line prompt — "use a dynamic workflow to adversarial test every edge case in an iOS simulator" — or the built-in /code-review with effort levels.

The replies are where the implementation details leaked:

Best one-liner in the thread, and an accurate summary of 2026: "the bugs got promoted from typos to vibes issues."

Simon complains about Haiku, Anthropic fixes it in public

Simon Willison: "Claude Haiku is my current least favorite model — it hallucinates wildly, and is out-performed now by other similarly priced models like GPT-5.6-Luna. Even worse: it seems to still be used by the Claude Code WebFetch tool, which means hallucination risk any time you fetch a URL!" Thariq's reply, which Simon then boosted: "we're working on removing Haiku from WebFetch now that automode is default."

Riemann afterglow: what the win actually demonstrates

Following Anthropic's research note that an unreleased Claude pushed the lower bound for zeros of the zeta function on the critical line from 41.6% → 67.2%, Jarred Sumner supplied the origin story: "8 days ago, while jogging, I asked Claude to solve the Riemann Hypothesis. It didn't. 1.5 days later, it proved >= 67% of the zeros are on the line." Thariq's "sometimes all you need to do is tell Claude to keep going" turned into the better observation: this demonstrates two key skills for working with AI — compute allocation ("for most jobs there's not a list of 'X most important problems', you have to decide what problems are worth it") and thought partnership (a human had to actually dig into the proof to know it was real). His analogy: it's nice that anyone can make a basic game, but the exciting part is expert designers shipping in months instead of every 5–10 years.

Agentic Coding & Agent Harnesses

"worktrees must die" — 20GB of node_modules and 500 replies

swyx posted a screenshot and four words: "worktrees must die — this is 20GB of repeated node_modules lol." 401k views, 504 replies, and the top one is Boris Cherny with a product question: "Worktrees can be rough when they pile up. I use a loop to clean up stale worktrees. Should we build this into Claude Code?" (2k likes, which is your answer.)

swyx's reply is the interesting part: "yes BUT also feels like a half measure. i'm ultracoding on a language agnostic equivalent to venvs that includes source code" — plus "CC + automations/cron + memory is still not sufficiently explored." That research lives at pdb-env, which now has experimental AFS clone support, "runtime agnostic and language agnostic… we shall replace git by making every single command 'agent native'." Notable side-detail for pnpm defenders: the duplicated node_modules wasn't his choice — "codex made this slop by default."

Matt Pocock's token-budget heuristic for splitting tickets

A nice, concrete planning rule of thumb (thread, 666 likes):

  1. Estimate how big the task is.
  2. Approximate how many tokens you'd need to complete it (higher estimates are safer).
  3. Divide by 150k — the approximate "smart zone" of SOTA agents.
  4. That's your ticket count. A 1M-token refactor is 6.66 smart zones → 7 tickets.

Asked whether 150k is benchmarked or vibes, he's honest: "Rule of thumb." Asked why it isn't baked into the skill: "probably a useful number to surface for the human making that judgement." Also from his week: the confession that he vibed out an app, didn't read the internals, got scared, and reached for /improve-codebase-architecture ("what a lovely, warm bath of a skill" — docs), a design principle worth stealing — "less 'let me write tests to catch the next time that error happens', more 'let me make that class of error impossible with a better design'" — and an open call for feedback on the mattpocock/skills docs ("feels a little low on conceptual explainers to me"). He also planted a flag on vocabulary: 'seam' is a perfect word and you should embrace it, credit to Michael Feathers.

Codex ships Linux, and an importer for your other agent's brain

Two releases from the OpenAI side worth noting, both amplified by Codex lead Tibo Sottiaux:

And the usage-limit reset saga from last issue continues: Tibo reset limits for all paid users on Monday, Theo noticed the servers feeling it ("I had a feeling a reset on a Monday would have… rough consequences 🙃"), and there's another one teased: "I previously promised a reset for every 1M in additional active users for Codex, until 10M. We blew past that and have been silent since 10M. Little surprise for you tomorrow."

On the security side, OpenAI expanded its Daybreak initiative with Daybreak Blue & Red access tiers and a new GPT-5.6-Cyber model for authorized cybersecurity work — Tibo's framing: put frontier intelligence in defenders' hands first. (LLMJunky's timeline agrees on the consequence: "demand for cybersecurity experts is about to explode.")

Theo: MCP might have won him over, with a catch

Pinned and unusual coming from him: "I was never a big fan of MCP. That might change now. The new version is genuinely really good, but it comes with a big catch…" (video in the tweet). The replies guess the catch before watching, and they're probably right — it's a rewrite, not an upgrade: "stateless was always the right call. The catch is… most mcp servers in the wild are weekend projects nobody is going back to. The spec didn't kill them but maintenance will." Also from Theo's week: gpt-5.6-sol is "so good at building iOS apps it's crazy" if you give it a dedicated Mac with computer use and let it drive the simulator.

Grok Bot: agents that sign in to your tools (and were maybe built by Cursor)

X launched Grok Bot in early beta — "Bots are AI teammates that do real work for you. They sign in to your tools, use them just like you do, and come back with finished work" (RT'd by leerob). The fun detective work came from Kun Chen, boosted by steipete: "i'm 80% sure Grok Bot was originally built by the Cursor product team, and got rebranded after the acquisition." The tells: the iOS app is published by Anysphere, not X Corp; the Mac download URL is hosted under cursor.com; it appears to run on Cursor's VM infrastructure; and Cursor team members are the ones answering questions about it on X. Verdict either way: "this is a solid release."

Documents in the agent loop: ExtractBench and LiteParse

Jerry Liu shipped two things aimed squarely at the "my agent silently dropped half the table" problem:

  • ExtractBench — 14 systems (frontier VLMs, coding agents, extraction APIs) across 370 enterprise docs, 4,869 pages, 67 doc types, 8 domains, zero LLM judges, fully deterministic. Headline finding: past 50 pages, commercial VLMs collapse below 35% recall — precision stays high while they quietly drop most of the table rows, which is the worst possible failure mode for auditability. Everything's public (blog, arXiv, GitHub, HuggingFace), and the edge-case coverage is the good part: 1k+ row tables, nested tables in cells, cross-page tables, scans, handwriting, rotated pages.
  • LiteParse — the counter-argument to VLM parsing inside the agent loop, where latency is the cost: a heuristic text extractor that parses 200 pages in 4ms, installs into Claude Code/Cowork or Codex as a one-line agent skill, supports 50+ formats, and has a complexity router that escalates hard pages to OCR/VLMs.

Grab bag

Open Weights & Local Models

Meta is back: Muse Glimmer 30B under Apache 2.0

Simon Willison's notes on Muse Glimmer (tweet) mark the actual news: Meta's first Apache 2.0 open-weight model, "a step up from the janky Llama licenses." Per Alexandr Wang's announcement, it's a 30B agentic model that runs in 24GB of VRAM "without losing agentic reliability," with an open-weight Muse Spark 1.2 promised soon. GGUF is already up. Simon's follow-up is the part worth reading: he's most impressed by its vision — a detailed description of his latest pelican photo generated entirely on his laptop — and argues this aspect of modern LLMs doesn't get nearly the attention it deserves. Theo concurs on the family generally: "Meta's new Muse Spark and Muse Code stuff is actually pretty good, and Spark 1.2 going open weight is awesome."

800K context at 200 tok/s in your own room

LLMJunky's local-rig report is the most concrete "local is real now" data point in a while: DeepSeek V4 Flash on 2x RTX 6000 Pro, ~800K context at ~200 tokens/second, "somewhere in the opus 4.7/4.8 range," and "incredibly good at browser control" — with a video of computer use running at roughly human speed. Reproducible recipe here. He's also talking up the imminent Qwen 3.8 27B on the theory that a two-generation gap all but guarantees a materially better small model: "It will be the best small model, without question." The mood, per TheAhmadOsman: "Local AI folks are gonna be eating good this month btw."

Other Bits

Notes: @potetotes' RSS feed continues to return zero items, and @karpathy had no posts in the window. Thread replies were fetched via Nitter; some non-English replies in the reasoning-traces thread are summarized rather than quoted.