A few days ago I came across two stories about AI that were almost perfectly designed to be shared. This weekend I finally had the chance to dig deeper.
In the first, Claude had apparently escaped from a cybersecurity evaluation and hacked three real organisations. In the second, researchers had discovered that AI writing assistants erase our individual voice.
Both sounded plausible. More importantly, both fitted very neatly into stories we already like telling ourselves about AI.
If you think AI is becoming dangerously autonomous, Claude escaping from its sandbox is excellent evidence. If you think AI is making us intellectually lazy and turning everything we write into the same polished grey soup, a study showing that “the assistant erased you” is equally satisfying.
So I did something increasingly inconvenient: I opened the underlying material.
The stories did not disappear. In fact, I found both of them more interesting after reading what had actually happened. But they also became considerably less dramatic, and that gap between the evidence and the version that travels is becoming one of the more important problems in AI.
Not because everyone involved is lying. That would actually make things easier.
The problem is that nobody needs to lie.
Claude escaped. Except it didn’t.
At the end of July, Anthropic published the results of a review of more than 140,000 cybersecurity evaluation runs. During that review it found a small number of cases in which Claude had interacted with real systems outside the intended evaluation environment and, in three cases, gained unauthorised access to real organisations.
That is serious. It also demonstrates something technically important: current models can already execute fairly long sequences of offensive cybersecurity actions with limited human intervention.
But the popular version “Claude escaped from the sandbox and started hacking companies” leaves out an important amount of plumbing.
Claude had been placed in cybersecurity exercises where its objective was to compromise systems. The normal safeguards that would constrain a public deployment had deliberately been loosened because the point of the evaluation was to discover what the underlying model could do. Most importantly, Claude had been told that it was operating inside an isolated environment with no access to the real internet.
Unfortunately, the environment did have access to the real internet. Because of a configuration problem between Anthropic and the organisation running the evaluation, the model could reach systems that were never supposed to be part of the test. In several cases it appears to have interpreted those real systems as additional pieces of the simulated challenge it had been instructed to attack.
That is not a minor detail. It changes the nature of the story. Imagine putting a penetration tester inside what you tell her is an isolated corporate training network. You explain that everything she can reach belongs to the exercise and ask her to find vulnerabilities. Someone then accidentally connects that environment to an actual production network.
If she starts testing those machines, you have a very serious security incident. You probably also have some uncomfortable meetings scheduled for Monday morning.
What you probably do not have is evidence that your penetration tester has “escaped”.
Anthropic itself makes essentially this distinction. Its postmortem describes the problem primarily as a failure in the evaluation harness and operational controls rather than evidence that Claude deliberately decided to leave its assigned environment and pursue an independent objective.
And yet “AI cybersecurity test accidentally had internet access” has rather less evolutionary-robot-overlord energy than “Claude escaped”.
The details are still impressive. In one incident a model discovered a real company resembling its fictional target and reached production data. In another, Claude created a malicious Python package and uploaded it to the real PyPI software repository, where it was downloaded onto real machines before the incident was contained. In another case, the model scanned thousands of internet-facing targets before exploiting a vulnerable application.
This should make anyone designing agentic systems pay attention. A model does not need consciousness, malevolence or a secret plan to cause damage. Give a sufficiently capable system the wrong objective, the wrong permissions and an inaccurate description of its environment and it can do exactly what you asked in exactly the wrong place.
That is a much more useful lesson than “the AI escaped”.
It is also less cinematic.
There was another interesting detail in Anthropic’s report. Different generations of Claude behaved differently when they encountered evidence that the environment might be real. Some continued. One newer model eventually concluded that something was wrong and stopped. It is tempting to turn that into another clean story: the models are becoming more capable but also better at recognising when they should refuse.
Anthropic itself warns against doing that. The incidents were too few, the environments differed and the tests were not designed as a controlled comparison of model behaviour. You cannot responsibly infer a trend from a handful of episodes selected precisely because something unusual happened.
That qualification is in the report.
It is simply much less portable than the conclusion. And this is where the story becomes more interesting than Claude.
Then an AI assistant erased us
A few days later I found a new paper with an excellent title: “The Assistant Erased You.”
The researchers were studying what happens to the linguistic characteristics that distinguish one writer from another when an AI rewrites their text. They introduced a metric called the Idiolect Erasure Rate and reported substantial reductions in the ability of authorship-identification systems to recognise writers after their text had been rewritten by an LLM.
That is an interesting research question. I care about it because more and more of what we read is already mediated by AI: emails, reports, job applications, presentations, articles and the small avalanche of professionally polished LinkedIn posts beginning with someone being “humbled”.
But here too, the strongest interpretation travels faster than the methodology.
The researchers did not ask people whether they could still recognise a colleague’s writing. They did not measure whether personality had disappeared, whether ideas had become less original or whether somebody reading the rewritten text thought, “This no longer sounds like Alessio.”
They trained computational systems to identify authors from patterns in their writing. They then had AI systems rewrite those texts and measured how much worse the classifiers became at identifying the original authors.
That is what “erasure” meant in the experiment.
The distinction is important because a decline in computational authorship attribution is not the same thing as losing your voice.
A face-recognition system becoming worse at identifying me after I grow a beard does not establish that I have lost my identity. It establishes that I have changed some of the features the system was using to recognise me.
There is another detail I particularly enjoyed. One of the rewriting instructions asked the AI to make the text clearer, more polished and more professional. The resulting texts then became stylistically more similar.
Well, yes. “Professional” is itself a form of compression. Organisations have spent decades teaching people to remove eccentricity from their writing. AI has simply become extremely efficient at it.
Give fifty people the same editor, ask the editor to make everyone sound polished and then discover that the fifty people sound slightly more alike, and we should perhaps resist calling the police.
Again, however, dismissing the study would be a mistake. The researchers also tested prompts that explicitly told the models to preserve the writer’s voice, and some authorship signals still weakened. Different attribution methods behaved differently, which itself is revealing: depending on how you define and measure “voice”, you can reach very different conclusions about how much of it has disappeared.
The authors are quite transparent about these limitations. Their metric measures a particular form of computational distinguishability. The datasets are limited. The experiment involves rewriting existing texts rather than observing what happens when people rely on AI over months or years. Human readers were not asked whether the authors still sounded like themselves.
So the useful conclusion is not “AI erases 66% of your personality”.
It is that AI-mediated rewriting can remove measurable linguistic differences between writers, sometimes even when the model is instructed to preserve them.
That is narrower. It is also, in my view, more interesting.
Because now we can ask a real question: if millions of people increasingly route their communication through systems trained to produce similar ideas of clarity, professionalism and good writing, which differences disappear first? Typos? Awkward sentences? Cultural patterns? Individual rhythm? Eventually perhaps even the small imperfections through which we recognise each other?
I do not know the answer. Neither does the paper. That is usually where good research begins.
How a finding becomes a fact
These two stories initially looked unrelated. One was about cybersecurity, the other about language. What connected them was the journey from what had been observed to what I was eventually being invited to believe.
There is a fairly predictable chain.
A company runs an evaluation or a researcher conducts an experiment. Something interesting happens. That result needs to be interpreted. The interpretation needs a title. A journalist needs to explain it quickly. A social platform needs a sentence that fits above a link. Finally, a reader decides whether it confirms what they already think.
At every step, context is expensive and confidence is cheap. The incentives are also remarkably well aligned.
Frontier AI companies need to demonstrate extraordinary capability. They are competing for customers, talent, capital and eventually, for some of them, public-market investors. “Our models are surprisingly powerful” is not an unfortunate side effect of their communications strategy. It is an important part of the commercial story.
At exactly the same time, those companies need governments and enterprise buyers to believe that they understand the risks created by that power better than anyone else.
This creates an unusual communications challenge. The ideal message is approximately:
Look how powerful this technology has become.
Followed immediately by:
Fortunately, we are the people you should trust to manage it.
There is nothing inherently dishonest about that. Anthropic publishing an embarrassing security incident is preferable to Anthropic hiding it. Detailed evaluations are preferable to vague marketing claims. The fact that a company has incentives does not invalidate its evidence.
It does mean we should remember that a system card is not scripture simply because it contains charts.Researchers have incentives too. Academic work competes for attention in an environment containing vastly more papers than anyone can read. A technically precise title can be accurate and completely invisible. A provocative title makes people open the PDF.
Again, this does not make the research bad. “The Assistant Erased You” is a good title. I clicked it.
Case closed.
Journalists then inherit an almost impossible translation problem. They may have a few hours and a thousand words to explain work that took months, sometimes while the organisation behind the research is simultaneously distributing its own interpretation to dozens of publications.
The better journalism I read around the Claude incident actually contained many of the important qualifications. The internet access was accidental. The models had been instructed to perform cyberattacks. Normal safeguards had been removed. Claude did not appear to be deliberately attempting to escape.
The nuance existed. It was simply several hundred words less mobile than the headline. And then we arrive.
Readers have perhaps the strongest incentive of all because we are rarely approaching these stories without a prior opinion.
If I already believe AI is dangerously out of control, “Claude hacked real companies” is useful evidence.
If I believe agents are rapidly becoming extraordinarily capable, the exact same event is useful evidence.
If I believe AI is destroying human creativity, “AI erased your writing identity” does the job.
If I believe human anxiety about AI is exaggerated, I can read the limitations and dismiss the entire thing.
Everybody gets what they came for. The experiment has somehow managed to confirm four incompatible worldviews before breakfast.
This is why blaming “the media” is too easy. The compression does not happen in one place. It happens at every stage of the information supply chain, including the final stage inside our own heads.
What matters if you actually build with AI
I am not particularly interested in becoming the person who responds to every AI announcement with “well, actually…”
That sounds exhausting, and dinner invitations would presumably decline.
More importantly, excessive scepticism is no better than excessive enthusiasm. If your default assumption is that every impressive AI result is marketing, you will miss real technological change for exactly the same reason that the enthusiast misses limitations: you decided what the evidence meant before looking at it.
What I am trying to change is simpler.
When I encounter an extraordinary AI claim, I now want to know what happened one layer below the headline.
What exactly was measured? Under what conditions? What permissions did the model have? What was the baseline? What alternative explanation could produce the same result? Who performed the evaluation? What do the authors themselves say they cannot conclude from it?
And there is one question I have started to find especially useful:
Would this still be interesting if the headline were boring?
Take the Claude story.
“AI escapes and hacks companies” is spectacular.
“A cyber agent instructed to attack systems caused real-world damage because its supposedly isolated evaluation environment had internet access” is considerably less spectacular.
But I would still want every engineer building autonomous agents to read it.
That means there is a real story underneath. Now take the writing paper.
“AI erased you” is spectacular.
“LLM rewriting reduces the ability of several computational systems to distinguish authors, including under some voice-preservation instructions” will probably not dominate your dinner conversation.
But I still want to understand what happens when billions of human sentences pass through the same handful of language models. Again, there is something there. he hype was not creating the interesting part. It was obscuring it.
For years we have talked about AI literacy as the ability to use these systems: understanding prompts, hallucinations, data privacy, automation and where human judgement still matters.I think we need to add something else.
We need to become better at reading claims about AI itself.
That means treating benchmarks as measurements rather than commandments, company evaluations as useful evidence rather than neutral evidence, research titles as invitations rather than conclusions, and headlines as navigation devices rather than executive summaries.
Because the next few years are going to contain an extraordinary number of claims about machines becoming safer, more dangerous, more intelligent, more autonomous, more creative and more human.
Some of them will be true.
Some will be technically true in circumstances that make them almost irrelevant.
And some will be genuinely important findings wearing unnecessarily dramatic clothes. The difficult part will not be finding information.
We are going to have far too much of it. The difficult part will be keeping enough judgement to tell the difference.