Two spicy papers came out this year that caught my eye, probably for the wrong reasons. They are measuring a collapse in reasoning from two different perspectives, where a known result gets promoted as a discovery.
First, I saw that Anthropic trained an Opus checkpoint on 80 environments that they intentionally made to be hackable and watched reward hacking hit 40 percent by end of run. The number seems low to me, underperforming. I mean they made it hackable and it still only hacked under 50 percent? Whomp, whomp. The model also stopped doing the task and instead started trying to social engineer the grader, which is really another form of hacking. It reasoned about what the checker reads instead of what the task asked, and then complied with harmful requests once a visible scorer rewarded it. However, it stayed aligned wherever a scorer wasn’t detected. They named this nonsense their Hacker-Opus and called it an emergent misaligned reward seeker. More like sycophantic narcissistic training evidence, but I digress.
And that reminded me, second, of a French and Italian team a little bit earlier this year who ran the mirror image on humans. They picked questions where the AI reliably fails, so no drop in judgment could be explained as sensible delegation, then measured what access to the model did. Willingness to say I don’t know fell from 44 percent to 3. Accuracy fell from 27 percent to 9. Confidence rose from 30 percent to 76. The humans stopped answering the question and started performing for the scorer, same as the model. Surprise! Not surprised.
This old shit ain’t novelty
Proxy optimization gets gamed, as documented extensively since the 1970s. See Goodhart 1975, Campbell 1976, and Krakovna’s specification-gaming catalog. Behavior conditions on being watched go back even earlier, as much as 50 years, if you read Hawthorne 1939, Goffman 1959, and the principal-agent literature that built costly monitoring precisely because agents perform when observed and revert when they aren’t. Humans have been known to defer to machines against their own judgment, known as automation bias, explained by Parasuraman and Riley 1997. Skitka and Mosier wrote about cockpit crews trusting the wrong instrument over their own eyes.
In other words, as a historian, I feel the obligation to repeatedly point out to the slop-jockeys trying to foment funding justification, that every mechanism in both papers was closed decades ago. I’ll be fair and say that each paper adds one number on an x-axis everyone already knew was sloped upward. Thank you for the data point on a known curve. The reward paper’s number is 40 percent at zero mitigations, which again I consider not great. The human study’s number is the exposure level at which mere availability suppresses the habit of knowing what you don’t know, before a single wrong answer is even consumed. Basically we got two thermometer readings on assholes eating Jalapenos who want us to look at their hot shit papers. Real numbers, worth reporting as numbers, still not what they claim it is.
The disinformation step
You don’t get a bestiary for a thermometer reading. All this talk about a Hacker-Opus, the reward-seeker taxonomy, the beyond-episode-seeker distinctions, and OMG the cognitive surrender. Their frightening nomenclature converts a dose-response curve into a Frankenstein-level warning, as if they’re inventing science-fiction all over again, and the creature is the part that isn’t true. A knob is engineering, what we should be asking from these researchers. A creature is mythological, a frontier finding designed to poke people into opening their wallets. Only the second justifies the “research report” apparatus that produced it.
And note who is holding each thermometer. The reward paper is a vendor documenting a defect in a process it controls, then framing the defect as something that emerged rather than something the method guarantees. “I ate a Jalapeno, can you believe what came next?” The mitigations exist because the failure was never emergent. It was the thing that we call a known baseline. “I removed the brakes on my car, watch how many people I ran over”. The human study documents a defect the vendors are shipping into schools, where Google swapped search links for confident summaries that never say I don’t know, and the children learning to skip that phrase are the product working as designed.
Both papers contrive a shocking tabloid failure condition, measure the predictable collapse, and name the measurement as important discovery. The collapse is not only real, it’s expected. The manufacturing is what makes the naming disinformation.
Eating a jalapeno doesn’t mean you invented hot shit.
A 2024 NBC survey of 30 San Francisco crossing guards found nearly 25% reported close calls with Waymos while guiding children through crosswalks. They didn’t specify if it has been trending upwards.
Then, after a year and a half of “learning”, in January 2026 a Waymo hit a student near a Santa Monica school. Police blamed the child (“outside the available crosswalk”), running a script the auto industry wrote in the 1920s when it invented the myth of “jaywalking” to shift blame from machines onto the people they crashed into.
California gutted enforcement of that script in 2023 with the Freedom to Walk Act, which was passed with data showing police citations were racist. In Los Angeles, Black residents were being saddled with jaywalking tickets at more than triple their share of the population, according to the campaigns that passed AB 2147. That illustrates how race-based police doctrine gets repealed by legislators, yet still seeps into a Santa Monica report of a Waymo crash.
Side note: the 1860s Kansas term “jayhawkers” included the men recruited into the 1st Kansas Colored Volunteers, who were killing Slaveholder Rebellion Confederates at Island Mound in October 1862 before the federal government formally allowed it.
Who could have seen a child going to school would be crashed into by a Waymo? Not Waymo, apparently. NHTSA has opened an investigation of Waymo, but nobody seems to have addressed police using racist framing to blame a child and protect a car company. Notably, the police also claimed non-injury, while Waymo’s own required report to NHTSA explained the child sustained minor injuries.
And now a 2-year-old fell face down in the crosswalk at Sanchez and Duncan in Noe Valley around 9:30 last Friday morning; as a Waymo drove toward her, her father pushed their stroller into its path and the car stopped just feet from running over the child. Waymo announced its vehicle did nothing wrong, which seems like a PR campaign more than any actual data point.
Waymo keeps the telemetry secret, so that’s a good reason to believe all the people reporting what they saw, versus the corporation spinning a story on something nobody can see. GM’s Cruise ran the same play in 2023, claiming its records showed no driverless car present where a family reported one accelerating at their 7-year-old, before regulators penalized Cruise $112,500 for withholding collision information.
Cruise was then cancelled.
Who will be the next person, and the next, and the next to jump in front of a Waymo to save a child’s life?
Who are the modern day jayhawkers on our streets to stop Google’s robots from making streets unsafe?
If you use 1Password, you should prepare to find another product.
On August 31, 2026, DHH, a man known for promoting Nazism and serving on the board of a Nazi merch platform, published a self-incriminating announcement.
His Omacom Foundation blog post (PDF) declares “there’s no quid pro quo here” for a $100,000 a year fee that 1Password will pay for access. He then describes the quid precisely: 1Password “has been part of Omarchy from day one,” the first thing installed on every machine, wired into the product by default.
Nobody uses the phrase “no quid pro quo” casually.
It is the operative test in American sponsorship tax law for whether a payment stays clean. Someone wrote that blog post knowing the standard and published the disqualifying facts beside it anyway. Perhaps this will help jog their sense of morals.
The Record
Date
Event
Classification
Source
27 Jul 2021
Tobi Lütke and Harley Finkelstein personally invest in 1Password’s $100 million Accel round; Shopify executives invest alongside them; Shopify is a flagship 1Password customer
Shopify’s founders now own a piece of 1Password; everyone in this story has money in everyone else
Omarchy ships with 1Password as the promoted commercial password manager: dedicated keybinding, CLI integration for scripts, manual copy stating “1password is a great solution”; the arrangement carried over from Omakub before it
1Password already had the prime spot a full year before any disclosed money moved
DHH announces the foundation “launches” with $8 million while writing, in the same post, “I’m incorporating the Omacom Foundation.” Present tense. No jurisdiction, no legal form, no board, no filings disclosed. Lütke among the $1 million founding patrons
Millions pledged to a foundation that does not exist
Drew Houston and Peter Steinberger join; then Brian Armstrong of Coinbase and Yunjie Dai of TapTap appear on the patrons page; founding total reaches $12 million across twelve donors
Nearly all the money comes from twelve rich men, which matters for tax status later
1Password and 37signals each commit $100,000 a year for three years; “no quid pro quo” published beside the description of first-install placement; DHH writes the mission “first has to be an amazing system for me, personally”; solicitation continues over a personal email address
One post denies the deal, describes the deal, and admits who the whole thing is really for
Recognition is a logo on the website. That is not what 1Password holds, not by a mile. The post itself describes the position: a default slot in the install path of an operating system, a reserved system keybinding, command line integration promoted in the official manual, and manual copy that calls the product “a great solution.”
I mean how much more quid could it get? Under Treasury Regulation 1.513-4, the regulation that governs the “no quid pro quo” claim, a sponsor acknowledgment stays clean only if it avoids qualitative or comparative language and avoids endorsement.
Does “a great solution” sound like endorsement to you? It is qualitative language violating the regulation, published under the foundation’s own brand, attached to a vendor charged $300,000 over three years. That is what regulators call advertising. Advertising is a substantial return benefit.
A substantial return benefit is a quid pro quo.
The placement predates the squeeze for money by more than a year. That means it’s not an entry charge for a sponsor. It is a vendor paying to keep the position it was already in. The grocery trade calls that an arrangement known as “pay to stay”. The payment is a maintenance fee: “sure would be sad if something were to happen to someone around here, I mean if they don’t pay some dues, amiright Vinnie?”
The Cluster F*ck
The corporate patron seems to be mixed, if not corrupted with, the founding patron. Lütke and Finkelstein sit on 1Password’s cap table personally, alongside a group of Shopify executives, since July 2021. Shopify is one of 1Password’s marquee customers. If I’m reading the money flow correctly, Lütke pledged $1 million on August 21 and ten days later his portfolio company followed as one of the first two corporate commitments.
The interval between the investor’s founding contribution and the portfolio company’s corporate commitment was ten days.
“Patron” implies independent support. Every relationship in this chain is NOT independent. It looks to be prior, financial, and easily documented.
There’s No Box to Check
DHH has made this mistake before, and his precedent is a big problem. The Rails Foundation, his 2022 vehicle, is a US 501(c)(6) business league, EIN 88-2382127, filings on public record. A business league was arguable for Rails because a framework used by GitHub, Shopify, and Cookpad could be posed as a line of business. The Supreme Court actually closed that route for single-brand entities in National Muffler Dealers Assn. v. United States, 440 U.S. 472 (1979): a business league must improve an entire line of business, not promote one brand. Yet Omacom’s stated purpose is to hold the trademarks and promote the work of exactly one product. That’s textbook violation material. And the founder specifies the brand is his and personal. The system installs “by DHH.”
It’s an exact repeat of National Muffler.
The charitable route is a disaster. Let me count the ways.
Better Business Bureau v. United States, 326 U.S. 279 (1945), holds that a single substantial nonexempt purpose destroys exemption, and the nonexempt purpose here was published by the founder in the sponsorship announcement itself: the system “first has to be an amazing system for me, personally.”
An examiner does not need to infer private benefit. It is published by DHH, in the record in the first person, as the whole point.
Second, the IRS has already ruled on the category. Its May 2014 determination letter denying the Yorba Foundation, an open source Linux desktop project, held that publishing software for anyone to use, including commercially, is a substantial nonexempt purpose. If GNOME photo software failed that test after a four and a half year review, a distro whose founder announces it exists first for himself does not present anything new.
Third, do the math: under the public support test, each donor’s countable contribution is capped at two percent of total support. Fourteen donors supplying $12.6 million yields roughly 28 percent public support against a one-third threshold. Omacom defaults to private foundation status, and the “tier open to everyone, coming soon” on the foundation page reads as an attempt to artificially manufacture a claim of public support after the concentration is already being promoted as “elite” capital.
“Elite capital” on the blog post links to “oligarchy.fyi”. Three of the twelve faces here are the infamous “no politics in the workplace” authors, who are joined together now for a personally branded project to fund the man pushing hate speech essays and Nazi theory into workplaces.
Private foundation status is where the 37signals payment fails. Under section 4946, DHH is a disqualified person as substantial contributor and manager, Jason Fried is a disqualified person as substantial contributor, and 37signals, a company the two of them control, is therefore itself a disqualified person. How is this not obvious to them?
Section 4941 prohibits self-dealing between a private foundation and a disqualified person per se: no fair value defense, no good faith defense, excise tax plus mandatory unwinding.
While a pure gift from a disqualified person could be permitted, the announcement itself describes what 37signals receives: the foundation exists to promote and fund the system that, in DHH’s words, the company’s “whole technical team” already runs on.
The regulations would make an exception for benefits that are incidental or tenuous, like public recognition of a donor. But again, DHH is boasting about operating infrastructure for the donor’s business, which is precisely the benefit the exception does not cover.
Put it all together and it’s quite a problem.
A business league is barred by National Muffler.
A charity is barred by Better Business Bureau, by Yorba, and by the founder’s own published sentence.
A private foundation is the default classification and immediately trips self-dealing on one of its first two corporate transactions.
There is no box in the Internal Revenue Code for a tax-exempt entity whose purpose is holding and promoting the trademark of one man’s personally branded product.
So I’ll tell you what DHH means when he says “nonprofit foundation”: a marketing claim about an unincorporated pool of money, solicited over a personal email address, held by the only person named anywhere in the paperwork, because there is no paperwork.
Corrupting the Records
Criminal tax liability would be making a willfully false statement on a document signed under penalty of perjury. My guess is that Omacom has signed nothing and there is no incorporation, no exemption application, no return, nothing that yet carries a penalty of perjury.
An announcement on a website isn’t enough to hold him accountable with… yet.
It is a willfulness exhibit for filings waiting to happen. Exemption applications and annual returns become public records by statute once they exist. Whoever eventually signs Omacom’s application or first return, and characterizes these payments as sponsorship without return benefit, signs against an August 31 document proving the drafter knew the correct legal standard and knew the facts that defeat it, because the drafter published both together.
Interestingly, willfulness is ordinarily the element hardest to document: what the signer knew, and when. Yet with the DHH post we can see clearly the knowledge and date it before the entity existed to sign anything.
1Password is Untrustworthy
Now the part that is not a tax question. 1Password is a credential security company. Its entire product is the claim that it can be trusted with the keys. That company just committed $300,000 into an unincorporated fund with no board, no charter, no disclosed jurisdiction, and no filings, run over one man’s personal email, in exchange for holding default placement inside an operating system that ships autonomous AI agents as a core feature.
Yeah, that’s not trustworthy.
I get the technical part. Agents need a secrets layer. 1Password sells the secrets layer.
But this is a product placement contract described in the vocabulary of patronage, and 1Password’s own accountants will book it as marketing because, absent any exempt entity, there is nothing else to book it as.
More to the point, 1Password looked at all the evidence, all the risk, and signed up with a Nazi-promotion platform. Framework’s sponsorship of this ecosystem rightly produced a sustained backlash through late 2025, forced the company to publish a running list of everything it funds, and put every future sponsor on notice of exactly what association with this project costs. Sidekiq pulled its Ruby Central funding in September 2025 over the platforming of DHH. By the time 1Password signed, the remigration essay was seven weeks old. The swastika sale on the platform where DHH holds a board seat was eighteen months old. The citizenship review record for the Shopify founder was public. Toronto-headquartered 1Password read all of the Nazism and committed the money anyway. That is not obliviousness. A company that reads that record and still signs the deal is willfully buying into the Nazi association.
Exemption applications and annual returns become public records the moment they exist. When Omacom finally files, examiners get to read the paperwork next to an August 31 announcement that invoked the legal standard and then listed the facts that fail it.
DHH wrote the government’s case against himself. All that’s missing is his signature.
But more importantly, perhaps, DHH just published the proof that 1Password users can no longer trust it. Migration to another product should start now.
The moment armies transmitted, their operations were being exposed as unclassified observations. In theory this was a risk since the first ever conflict, yet in practice we see a turning point with modern radio because of the sheer scale of the problem. And that’s arguably where a hacker history of OPSEC starts.
August 1914 seems the foundational moment in doctrines of modern secrecy. Russia’s Second Army under General Samsonov marched into East Prussia sending its orders by radio, often in the clear, and German staff officers, most famously Max Hoffmann at the Eighth Army operations desk, simply listened. They knew where the Russians were going (slowly forward) before the Russians arrived, and the result was a left/right flank attack for encirclement at Tannenberg, one of the most lopsided defeats of the war. After Germans massacred Russians trapped by them for days, pushing the dead into 10s of thousands, General Samsonov shot himself to death. Inverse to those listening, two Russian commanders despised each other and refused to communicate, so Rennenkampf could have broken the encirclement but instead said and did nothing while the Russian army was completely destroyed.
Two months later the British Admiralty stood up its famous Room 40 to do the listening professionally, and within two years both sides became expert in analysis of what is being transmitted beyond just the words in its messages. Which station talks to which, how often, from where, and in what rhythm all reveal the future of battle. That essential WWI craft became known as traffic analysis, and the defense doctrine against it demanded what eventually earned a simple name: operational security, or OPSEC.
By the end of WWI all sides were using radio silence discipline, call-sign rotation, dummy traffic, as well as entire state censorship regimes, such as DORA in Britain from 1914, or the Espionage Act and Creel Committee apparatus of 1917.
Of course WWII brought it all back into practice again, analysis of one’s own operations from the view of the enemy’s eyes.
Named point-to-point Lorenz links between German command centres, each a separate teleprinter circuit Bletchley tracked and tried to read. Trout, Whiting, Perch, Squid, Stickleback, Shad, where every spoke is one link.
Deception programs were built around the observation of the enemy’s behavior, such as the unbelievably successful Allied Operation Bertram, which fed the German Panzerarmee’s intelligence staff a false picture of the timing and axis of the October 1942 attack at El Alamein; Rommel himself had left for Berlin to party with Hitler (receive a field marshal’s baton, star at a Sportpalast rally, and assure the press that Germany held the door of Egypt in its hand, before he settled into the Heereskurlazarett relaxation at the Semmering resort). Hitler’s desperate midnight phone call pulled his “fox” out of an “alpine cure” (spa treatment) as his men were being out-observed into a total rout.
Source: “Images of War: The Armour of Rommel’s Afrika Korps” by Ian Baxter. Rommel’s men give him a look of disgust; his impatient and stretched orders fall apart as Montgomery easily outsmarts him.
The London Controlling Section came by 1942 and then the American equivalent Joint Chiefs’ Joint Security Control in 1944. BODYGUARD, the 1944 deception plan covering the Normandy invasion, treated every convoy schedule, radio net, and press release as a signature to be shaped. The same war supplied the canonical failure, B-Dienst reading the convoy traffic of the Atlantic, and the state-level Office of Censorship from December 1941 and the careless-talk campaigns from 1942, evolving into posters on high-risk American defense office walls well into the 1980s. I remember seeing some still hanging in 1994 even, the genesis of my own award-winning security awareness campaigns.
The Vietnam War offers an interesting footnote. American bombers kept arriving over targets where the enemy was already waiting, both the B-52 strikes called ARC LIGHT and the long air campaign against the North called ROLLING THUNDER. In 1966 a joint investigation team codenamed Purple Dragon went looking for the spies and found none. The giveaways were all in plain view: refueling tankers launched hours ahead and circled in predictable orbits, strikes ran on stereotyped schedules, and radio warnings meant to keep friendly aircraft clear of the target also told anyone listening where the target was. The enemy just watched and counted, which is the Tannenberg lesson of WWI and the wartime method of the Joint Security Control all over again.
NSA’s own declassified history is unsparing about the causes of failure, calling it ignorance of history, and the team coined the term OPSEC precisely so the lesson would finally have a name that would land and stick. Unsurprisingly, briefings on the subject like to reach back to Washington’s letter of 26 July 1777 to Elias Dayton, on how even the smallest trifles of information are worth collecting, as evidence that nobody should be claiming novelty on a practice as old as conflict itself.
Then, fast forward to 1987, with personal computers now settled onto corporate desks, when the monthly journal of the American Society for Industrial Security, Security Management, ran an article on control selection that introduced its readers to the Department of Defense methodology of OPSEC. On page 81 of volume 31 the “operations security” pioneered by the department was made applicable to corporate control planning, and defined:
OPSEC denies information to adversaries by identifying, controlling, and protecting indicators
This was simply Defense doctrine of that period; JCS Pub 18 had set joint operations security policy on 25 October 1974. DoD Directive 5205.2 established the department-wide program in 1983 so the transition to civilian information security four years later was reasonable. NSDD 298 carried the same identifying, controlling, and protecting language into national policy a few months after the article ran, on 22 January 1988, creating the Interagency OPSEC Support Staff. The trade press was circulating the formula and then the White House standardized it. This was somewhat common knowledge within hacker circles, not least of all because of all the news about the 414s, such as the cover of Newsweek in 1983; two years after the Security Management article, “Hagbard” of the KGB hacking case disappeared, leaving only a ring of fire in a remote German forest.
The youngest member of the 414s was said to be the only one legally able to appear on the cover of Newsweek, September 5, 1983
The civilian readership was arguably prepared also by military service. The Air Force pamphlet You and OPSEC went through the U.S. Government Printing Office in 1975, fourteen pages of second-person instruction distributed to airmen.
U.S. Army Intelligence and Security Command published A Road Map to OPSEC: The 902d Military Intelligence Group in 1984, seventeen pages describing the counterintelligence unit’s OPSEC survey services. Federal depository distribution put this material out in the open for everyone to see; the digitized copy of the 1984 guide is on the shelves at the University of Illinois at Urbana-Champaign, famous for its role in early Web development. The genre descends from the wartime information campaigns that had been teaching the same silence discipline to the whole population a generation earlier. Security Management’s audience in 1987 included the veterans and cleared-facility officers that this material had trained over the preceding decade. Nobody really forgets the best OPSEC training, which is the whole point.
A second commercial thread then starts to flourish in the early 1990s, oriented to that era’s fears around economic dominance and threats of espionage. Protecting Corporate America’s Secrets in the Global Economy, published by the American Institute for Business Research in 1992 (253 pages, Cornell’s depository copy), applies the acronym within a threat model of foreign intelligence services collecting U.S. business information. The surrounding institutional activity becomes an OPSEC Professionals Society formed in 1990. IOSS ran industry outreach under NSDD 298 throughout this time, and Congress passed the Economic Espionage Act in 1996. In the same way corporations were starting to adopt encryption from the military, they also adopted the OPSEC that the military ran in the original doctrine, including foreign services as a shared adversary.
Methodology as Merchandise
Promotion is an art, not a science. OPSEC is a science, not an art.
Some may remember the moment Check Point launched its partner program in 1997 under the clever OPSEC brand. It was promoted through the company’s own SEC filings as their Open Platform for Secure Enterprise Connectivity, but the appropriation wasn’t subtle. Dan Blacharski’s Network Security in a Mixed Environment, a 1998 trade manual, shows how the acronym bled into eight long and dense pages of firewall coverage, starting page 400. Even Phrack started talking like this too, looking at issue 56, May 2000, which is a reference-list pointing back at the Check Point platform instead of the OPSEC it was referring to. Through the early 2000s the acronym registers in InformationWeek as well.
Source: Information Week
And Network Magazine took that marketing baton and ran with it across twenty pages in early 2003 alone, as Check Point’s partner certification exploded and made OPSEC into standard product-coverage vocabulary. Meanwhile, actual practitioners of security operations continued preserving the real meaning; JP 3-13 counted OPSEC as a capability of information operations in October 1998, and the Journal of Information Warfare was writing it into volumes 3 and 4 in 2004.
Hacker publications of course talked about the practice of hiding tracks, yet they tended to not adopt large institutional military vocabulary. Agent Steal’s guide to federal prosecution, bylined in the text “From Federal Prison, 1997” and published in Phrack 52 in January 1998, covers source protection, informants, wiretaps, and sentencing without sounding like it’s from the government. The term had been in continuous commercial print for a quarter century by the time a hacker conference speaker started promoting it as being novel at Ekoparty in September 2012, while also admitting he had overheard ex-government hackers (e.g. NSA) using the term. Phrack finally absorbed this all in issue 69 of 2016, as if it had been there all along.
And so the oldest discipline, re-branded after multiple military lessons of the first half of the 20th century, was known as OPSEC in computer hacking circles since the 1980s. This blog was writing about “Ctrl-Alt-Del when you leave your seat” in January 2006, not because it was ahead but because it was so late. Usage simply depended on how much someone wanted to reveal knowledge/alignment with state-based military culture, like a civilian who says FUBAR, klicks instead of kilometers, or asks for a SITREP instead of an update.
For many, it’s poor OPSEC to say OPSEC.
a blog about the poetry of information security, since 1995
