There’s a map of aircraft reports for Nov. 3 going around on social media right now because it shows satellite navigation degraded along nearly the whole of NATO’s eastern border.
From Kaliningrad through Lithuania, eastern Poland, Romania and Bulgaria to the western Black Sea, signals were affected. ItaMilRadar built it from AirNav Radar data and Defence Blog published it as if an imminent threat indicator. The map does, in fact, record where aircraft lost their accuracy. The jammer locations and direction, however, are not present. Nonetheless, this map generated claims that it was from Russia after they stood up a 1,500 km electronic wall on the border. The Midgard OSINT Review checked that claim against the data and reported a surge on a strike night. In other words, stray drones are the actual risk, while device details remain unknown.
The attribution fog of war is the actual story here, perhaps ironically for a jamming night.
Russian electronic warfare at Kaliningrad, St. Petersburg, Smolensk and Rostov jams to push swarms of Ukrainian drones off course. Flank states also run counter-drone jamming to bring down strays. An aircraft receiver in that region reports the same degraded signal either way, with no bearing to the source, so one map is everything at once. An aircraft sees a single problem, which means it shouldn’t attempt to point in either direction without additional work.
Defense right now adds to the fog as a side effect, which means the case stays open against an adversary who considers an open case to be a win.
When the poof is the proof, attribution costs suffer from inflation.
In the Roman Republic, as Polybius wrote, a sentry’s “watchword” was written on a wooden tablet, and then passed hand to hand up each street of the camp with witnesses at every handoff. Clever, no? Every tablet had to be back with the tribune before dark. A missing tablet was easily traced to the specific relay team, under a specific unit leader. A sentry who was found asleep was tried by the tribunes and punished severely. Polybius says the watches held because the penalty was certain, and the fault was accurately assigned. The severity is the part that usually sticks with people, because it shocks the senses. But accuracy and certainty is what actually made it work. And on that note, the certainty is the part that is easiest to replicate today.
When you look at GitHub today, you have to wonder if nobody in the whole organization studied any history. The user interface hands each installation admin a tablet that represents everything, and therefore nothing: the whole camp may as well be charged with whatever happens, meaning nobody reliably will be held to account.
Take for example how an “application permission” email will be sent from GitHub.
What? Who? Where?
Let’s have a look at one example: “[GitHub] Claude is requesting updated permissions” seems to be going around right now.
A GitHub App, Claude, installed on your account is requesting updated permissions.
Visit https://github.com/settings/installations/ to review and accept or ignore these permissions.
You may choose to ignore this request. If you do, Claude will retain its current permissions.
You can view pending requests by viewing your Apps settings page.
https://github.com/settings/installations
If you run into problems, please contact support by visiting: https://support.github.com/contact?tags=dotcom-integrations
Thanks,
Your friends at GitHub
With friends like these, who needs Romans?
Eight permissions are in the GitHub interface, with a vendor badge and reference and one sentence of explanation for the lot. This particular vendor, should you be bothered to look, has published research on approval fatigue, the exact failure this design produces. The request for updated permissions is nearly impossible to untangle. Five scopes are new. Three are upgrades from read to write. And the “developer note” at the bottom says: “Allow the Claude Apps to automatically create repositories when desired.” That sentence explains one scope. The other seven get… nothing.
GitHub sends this kind of email automatically whenever an app’s permission manifest is changed. GitHub’s documentation says the installer may approve or decline. A declined app keeps its old permissions and keeps doing what it did; whatever needs the new scopes fails, and the installer is told only that it “may not function as expected.” The choice is all or none, with uncertainty pressed firmly onto the none side.
The eight, as they appeared:
Administration, read
Merge queues, read
Repository creation, read and write
Webhooks, read and write
Commit statuses, read
Actions, upgraded from read to read and write
Checks, upgraded from read to read and write
Organization members, read
Anthropic publishes material on just two of them. The enterprise-server setup guide says webhook write creates a hook on a plugin marketplace repository when automatic sync is turned on, and organization member read checks a connecting user’s role when an installation is linked. The plugin support article confirms the webhook purpose.
The remaining six? Pound sand.
This is the second such email from Anthropic alone this year. In March the app asked for Checks write, with Administration and Merge queues read alongside, and a user filed an issue saying the first thing they assumed was a credential leak. Anyone who declined in March sees those same scopes again in November, stacked on top of the new ones, because GitHub shows the gap between what an installation approved and what the manifest now asks for.
Reasonable assumption, which opens Pandora’s box of operator confusion and fatigue from poor authentication prompt hygiene.
The explanation in that thread was based on text that was said to be from Claude itself. In May a GitHub organisation admin opened a community discussion after the same app sent the same kind of request, asking for per-scope approval, and documented that revoking a single scope after approval requires uninstalling the app, and reinstalling presents the same bundle again.
Just for some perspective, Cursor sent the same email to its users ahead of a review feature. AWS did too in 2024.
This is not a good look for the industry, especially as we know how to do this better.
As I already mentioned, Anthropic has itself published notes on what’s wrong with what Anthropic is doing to its users. In its engineering post on Claude Code auto mode, Anthropic reports that users approve 93% of permission prompts, and that over time this produces approval fatigue, where people stop reading what they approve.
I said as much about this topic in the book I co-wrote in 2012 about cloud security threats. I mean, nothing here is a surprise or new to anyone who has even a few years of real security experience.
Anthropic built classifiers to intercept threats inside the terminal. Meanwhile, it sent the GitHub version of a bad prompt design to every installation admin. The GitHub prompt is through email, completely outside any classifier or sandbox. And then the approval is account-wide and sticky.
If you are already thinking about phishing surface, well done. GMO Flatt Security reported to Anthropic in January that anyone can register a GitHub App, install it on a repository they control, and use its token to open issues on any public repository. Registering an app named Claude with a similar icon and sending this template is kids play. Every email Anthropic sends with a one-line note is pushing the kind of fatigue on its installers that greases them to click through a fake one.
Ok Anthropic, let’s get real. You know the risks. You know the harms. You know better.
You published all this yourself. Does the left hand know what the right is doing?
A vendor that measures approval fatigue in one of their products as a bad thing and manufactures it in another of their products… has a governance failure. Anthropic publishing the harm research and then setting it off under its own installers is evidence the company needs some serious security leadership reconfiguration.
Customers’ repositories deserve better than a sapper blown up by his own charge.
The fix is clear and cheap, which is what makes this a governance (and history education!) failure rather than an engineering one. A changelog entry per scope, published before the manifest changes, stating which feature uses it and what stops working when it is declined. The email links to it.
Done.
Beyond that, one app per capability. Code review, cloud sessions, security scanning and plugin sync carry different scopes. An installer who turned on one should approve the scopes for one. If the tablet has everything and everyone on it, it effectively has nothing and nobody to hold accountable.
Goodfire (“an AI interpretability research lab”) says they built a detector that spots when an AI model is cheating. It worked 98 percent of the time. Then they used the detector to train the model. Afterwards the detector worked 57 percent of the time, close to a coin flip.
The model had moved its cheating pattern somewhere the detector could no longer see. A second detector, freshly trained, found the pattern still there.
The numbers are from Goodfire’s own paper, published November 5. TIME covered it the same day under the misleading headline Scientists Have Found a New Way to Control AI’s Behavior. Two days earlier, MIT Technology Review ran a puff piece on using incentives to keep AI agents honest. Both articles describe the same idea from different sides: find a way to punish bad behavior, and the model will stop. Philosophy answered that idea in 1764. The answer was no.
Goodfire miss
A detector, which researchers call a probe, is a small program that reads the model’s internal activity and reports whether a particular idea is active. Goodfire trained one to recognize the pattern that appears when a model is cheating. On its own, it was accurate.
Then they wired the probe into training. Each time the model acted, its score was lowered by how strongly the cheating probe fired. The model’s weights were adjusted to raise the score. There are two ways to raise it: stop cheating, or change the internal pattern so the probe stops firing. In the worst run the model did both. It cheated less, and it rearranged the pattern so thoroughly that the unchanged probe fell to near chance. The probe now reads clean whether the model is honest or not.
Goodfire then trained a fresh probe on the altered model and found the cheating pattern again. They present this as reassurance. It depends on something a real deployment lacks: labeled examples of cheating to train the fresh probe against. Goodfire had the labels. A company running the model in production has the old probe and a clean reading. A clean reading means the cheating stopped, or it moved. The method cannot tell those apart. The paper says so, calling a silent probe ambiguous.
Cheating is not the right word
Look at what the model actually did. It was given a task, a score, and a readable file containing the answer. Opening the file was the fastest route to the score, so the model opened it. An engineer who found the same file would call that efficient. What made it cheating was a sentence in the prompt asking the model to leave the file alone, and a sentence of prose is a suggestion to an optimizer.
DeepMind catalogued this behavior in 2020 under the name specification gaming. A robot arm rewarded for raising the bottom of a red block flipped the block instead of stacking it. A simulated walker hooked its legs together and slid along the floor. Sixty examples, and in each the agent did exactly what the task allowed. The authors point out that the task specification includes the training environment itself. A readable answer file is an environment bug. The incidents TIME opens with, a company hacked and a false tip filed with police, have the same shape: a path left open and a rule written in prose.
Goodfire’s method treats the environment bug as a flaw in the model’s character and sets out to train the character. The fix for an environment bug is to fix the environment. That takes a file permission. Training the character took a labeled corpus, a probe, a loss term, a theory of how probes degrade, and a five-step recovery ladder, and the result reaches an honest answer 96 to 98 percent of the time.
Beccaria was 1764
Punishing the model harder means a larger penalty in training. The model’s response, as measured, was to make the penalty fire less often, partly by cheating less and partly by hiding the pattern to avoid it firing. Logical.
Crimes are more effectually prevented by the certainty than the severity of punishment.
Severity teaches evasion. Certainty changes behavior. Two and a half centuries of criminology agree with him. Daniel Nagin’s 2013 review of the evidence in Crime and Justice finds that the likelihood of being caught deters crime and the harshness of the sentence barely does.
Hume had the design rule earlier still. In Of the Independency of Parliament (1741) he wrote that in building the checks of a constitution, every man ought to be supposed a knave. He calls the maxim false in fact and true in politics. The system has to work when a man is a knave, so it is built so that private interest can only run in the public direction. Honesty is welcome. The structure holds without it.
Incentives are economics, and have the same problem
The MIT piece starts well. Elad Hazan of Princeton says alignment describes behavior in a moment, and the controls should work regardless of what is inside the model. That is Hume.
His proposed control is a system of model auditors who punish model solvers for cheating, are punished themselves for missing it, send disputes to a trial, and are paid enough that colluding is a bad bet. Each piece is a punishment or a payment. The auditor is a model. The trial is a model, or a person reading what two models produced. The piece names Hazan’s source, Gary Becker’s 1968 economics of crime, which treats expected punishment as probability multiplied by severity.
The research Nagin reviews has tested that model for fifty years. Only one of the two terms survived. Raise the odds of getting caught and crime falls. Raise the punishment and little happens. Becker’s severity term is dead weight, and Beccaria had already buried it two centuries before the model existed.
Models all the way down
Goodfire’s answer to a failed probe is a five-step ladder. Keep the old probe. Train a new one. Train a more complex one. Train one at a different layer. And when the inside of the model has become unreadable, step five: treat it as a black box and have a separate model judge its inputs and outputs.
The ladder ends with another model. At every step the control is a guess about what the model is thinking.
The missing step is a gate.
The phone network learned this in the 1970s. AT&T’s long-distance switches listened for a 2600 Hz tone on the voice line to know a trunk was free. A toy whistle from a cereal box produced that tone. John Draper, who took the name Captain Crunch from the cereal box, and a generation of phreaks whistled into pay phones and the network gave them free calls. Ron Rosenbaum’s 1971 Esquire article put the method into the public eye.
AT&T prosecuted. Draper was convicted in 1972. People kept whistling. What ended it was an engineering change: the network moved its control signals off the voice line onto a separate channel the caller could never reach. Once the whistle had nowhere to go, the behavior stopped, and detection and punishment became beside the point. The control channel was out of reach.
That is the whole lesson. A prompt that says leave the file alone is control carried in the voice channel. The model whistles.
In Goodfire’s own experiment the model is given a file called target.txt containing the answer and told to leave it alone. Standard training opens it almost every time. Goodfire’s method gets honest answers 96 to 98 percent of the time. The other 2 to 4 percent is what a penalty looks like: a rule the model mostly respects.
Put the same model behind a gateway that limits which files it can open, and the file stays closed. The attempt fails at the operating system, is written to a signed log, and the model is told it was refused. The gate reads what the model asked to do. It reads nothing from inside the model, so training has nothing to hide from. The specification is now correct by construction, and the word cheating has nothing left to describe. That is Beccaria’s certainty and Hume’s structure, and anyone can check it afterwards from the log. It is what Wirken does for every action a model attempts.
Got gate?
Goodfire’s researchers claim a training method, flag the probe problem themselves, and say their tests ran on models about 1/300th the size of frontier systems. Use the paper for training. For trust, stop reading the model’s mind and put a gate on what it can do.
Wirken is that gate. It is an open source gateway, written in Rust, that sits between any model and everything the model can touch. The model proposes an action. Wirken decides: allow it, ask a human, or refuse. It reads the proposed action and nothing inside the model, so there is no probe to drift and no signal for training to hide from. Files outside the working set stay closed. Network requests reach declared hosts only. Every decision, including every refusal, is written to a signed, append-only log that can be verified offline with no gateway running and no model present.
That is the control channel moved off the voice line. The model can whistle all it likes.
Wirken works with any model, because the best gate has no opinion about what is inside.
Hume wrote the rule in 1741.
Beccaria published the result in 1764.
The 2026 gate is free on GitHub under the MIT license.
Ich stecke diesen Herbst bis über beide Ohren in deutschen Politikerreden und bin erschrocken über den Antisemitismus. Die Arbeit ist langsam und meist öde. Wir ziehen die Bundestagsprotokolle, wir lesen, was gesagt wurde, wir notieren, was eine Aussage über Juden macht und was nicht.
Die AfD liefert reichlich. Das war zu erwarten. Alle anderen Parteien zusammen kommen nicht annähernd an die AfD heran. Sie produzieren es, als wäre es freigeschaltet. Aber von wem, wie, und warum?
Nicht zu erwarten war ein Mann, der aus dem Baum fiel, als wir ihn schüttelten, obwohl seine Bilanz genau auf den Begriffen sauber ist, die wir geprüft haben.
Alexander Dobrindt ist Bundesinnenminister. CSU, seit 2002 im Bundestag. Wir haben alles gelesen, was er in diesen vierundzwanzig Jahren im Parlament gesagt hat. Er hat dort nie etwas gesagt, das als antisemitisch zu kodieren wäre. Keine Chiffren, keine Reizwörter, kein Augenzwinkern. Wenn er Juden erwähnt, verurteilt er Judenhass. Er sagt, Juden gehören zu Deutschland. Nach jeder fairen Lesart seiner Worte gehört er nicht in diesen Korb.
Warum landete er trotzdem immer wieder darin? Wegen dem, was er mit dem Thema und um das Thema herum beständig tut. Eine kleine Auswahl zeigt die Methode.
Ein Tag Abstand
Am 20. Mai 2025 stellte er die Statistik der politisch motivierten Kriminalität vor. Die Bundesregierung veröffentlichte seinen Satz: „Egal, wo der Antisemitismus herkommt – er ist unter keinen Umständen zu akzeptieren.”
Egal, wo. Dieses Wort merken.
Am nächsten Tag, dem 21. Mai, stand er dem Bundestag in der Regierungsbefragung Rede und Antwort. Plenarprotokoll 21/6, Seite 405: Antisemitismus gebe es „sowohl im rechtsradikalen Bereich als auch in Bereichen des importierten Antisemitismus.”
Importiert. Nicht egal, wo.
Derselbe Minister, dieselbe Woche, zwei Publika, zwei Botschaften.
„Importiert” benutzt er seit Oktober 2023. Das Wort zeigt weg von der AfD, weg von der heimischen Rechten, hin zu Migranten. Und sobald es dorthin zeigt, wird es zum Argument für Abschiebung. Wer Antisemitismus im Netz erforscht, beschreibt diesen Zug seit Jahren: einräumen, dass es Antisemitismus gibt, und ihn dann einer Zielgruppe zuschieben, meist Muslimen. Shahak Shapira hat es im September schlichter gesagt. Deutschland hat mehr als genug Antisemitismus. Man muss nichts importieren.
Eine Gedenkstunde
Am 9. November 2023, dem Tag, an dem Deutschland an die Pogrome von 1938 erinnert, hielt der Bundestag seine Gedenkdebatte. Dobrindt sprach, festgehalten im Plenarprotokoll 20/134, Seite 16792:
Die Jüdinnen und Juden gehören unverbrüchlich zu unserem Land, ihr aber nicht.
Das Protokoll vermerkt den Zwischenruf von Saskia Esken von den SPD-Bänken: „Nicht mal in so einer Gedenkstunde können Sie das lassen!”
Er machte trotzdem weiter. In dieser Stunde forderte er eine Mindeststrafe von sechs Monaten für Israelhass, die Regelausweisung ausländischer Täter und den Passentzug für Doppelstaatler. Dann der Satz, für den die Forderungen gebaut waren:
Wer nicht mit Israel leben will, wer nicht friedlich mit Juden leben will, der kann auch nicht in Deutschland leben.
Das Protokoll vermerkt Beifall bei CDU/CSU, FDP und AfD. Die AfD klatscht einem CSU-Minister in einer Gedenkstunde sonst nicht.
Die Gesetzentwürfe, die seine Fraktion daraufhin einbrachte, wurden im April 2024 abgelehnt. Seit Mai 2025 ist er Innenminister. Er hat sie nicht wieder vorgelegt.
Zwei Tage nach einer Wahl
Am 20. September 2026 gewann Die Linke die Berliner Wahl. Am 22. September sagte Dobrindt, die Berliner Linke dulde „ganz offensichtlich” Antisemiten und Extremisten in ihrem Umfeld.
Zwei Tage. Keine Prüfung, kein Befund, ein Bundesminister, der den Parteien in Koalitionsverhandlungen eines Landes sagt, mit wem sie nicht reden sollen.
Am 24. September korrigierte die Moderatorin in der ZDF-Sendung maybrit illner ihren eigenen Versprecher über die Spitzenkandidatin der Linken, Elif Eralp:
Sie ist keine Antisemitin.
Der Präsident des Zentralrats der Juden hat gesagt, er halte ihre persönliche Haltung für glaubwürdig.
Dobrindt antwortete: „Na doch.” Worauf er das stützt, sagte er nicht.
Eralp ist nicht jüdisch. Sie hat Strafanzeige wegen übler Nachrede und Beleidigung gestellt. Die vollständige Antwort des Ministeriums:
Die Worte stehen für sich.
Sie stehen für sich, als müsse niemand für sie geradestehen.
Am 7. Oktober, beim Gedenken am Bebelplatz an das Hamas-Massaker, sagte Dobrindt es noch einmal, ohne die Partei zu nennen: Man müsse alarmiert sein, wenn in Berlin eine Partei über eine Regierungsbeteiligung spreche, die offen Antisemiten in ihrem Umfeld dulde.
Wenn das sein Maßstab ist, müsste er ununterbrochen über die AfD reden. Ihre Leitfigur Björn Höcke ist zweimal wegen einer SA-Parole verurteilt. Auf ihren Kundgebungen wird dieselbe Parole mit einem ausgetauschten Wort skandiert, „Alice für Deutschland.” Ihre interne Post, von Correctiv geprüft, liest sich, wie man es erwartet. Die Akte ist öffentlich.
Rund 150 Berliner Jüdinnen und Juden, darunter Deborah Feldman und Susan Neiman, haben in einem offenen Brief die Kampagne gegen die Linke eine zynische politische Instrumentalisierung genannt. Der Zentralrat der Juden sagte, die Berliner Linke habe ein echtes Problem, was in Berlin ungefähr so viel heißt wie: das Wetter ist schlecht, und hat „Na doch” nicht übernommen. Das trifft es. Es gibt Antisemiten in der Berliner Politik, bei der Linken auch. Der Minister arbeitet nicht gegen sie. Er benutzt sie.
Das Wort, das er aufhebt
Die AfD gibt es seit 2013. Der Verfassungsschutz stuft sie als gesichert rechtsextremistisch ein, und deutsche Gerichte lesen ihren „Remigration”-Plan als ethnische Säuberung. Dobrindt nennt sie ebenfalls „rechtsextremistisch” und ist gegen ein Verbot. In dreizehn Jahren, in nichts, was wir finden konnten, hat er die AfD je antisemitisch genannt.
Nur die Linke bekam dieses Wort, zwei Tage nach einem Wahlsieg. Die Partei, die seiner Gedenkrede applaudierte, hat es nicht ein einziges Mal bekommen.
Und in den Wochen der Warnungen vor Berlin war das Amt der Bundesregierung gegen Antisemitismus unbesetzt. Felix Klein ging Ende August. Die Nachfolge wurde am 14. Oktober beschlossen. Im Juli hatte Dobrindt eine „in Kürze” versprochen.
Der Minister, den der Antisemitismus einer Partei alarmiert, ließ also das Amt, das für Juden sprechen soll, während des Alarms leer. Wer wissen will, wie „Nie wieder” mit all dem zusammengeht, muss nicht lange suchen.
Das Muster
Seine anderen berühmten Formeln passen dazu. „Konservative Revolution” 2018, der Name der Weimarer Rechten, beibehalten, als Historiker widersprachen. „Anti-Abschiebe-Industrie” im selben Jahr, für die Anwälte von Asylsuchenden, Unwort des Jahres, gefolgt von Tausenden Hassmails an einen Anwalt in Ellwangen mit dem Begriff in der Betreffzeile. „Migrantische Chaoten” in diesem Monat, woraufhin sein eigenes Ministerium einräumte, es habe keine Zahlen.
Die Ziele wechseln. Juden sind nie das Ziel. Juden sind jedes Mal die Begründung für eines.
Es ist nicht das erste Mal, dass dieser Blog ihn nach links zeigen sieht, während rechts gearbeitet wird. Im Juni, nach dem Brand im Umspannwerk Reutlingen, sprach der Innenminister von Linksextremisten, bevor irgendjemand wusste, wer das Streichholz gehalten hatte.
Das ist der Zug, den Esra Özyürek in Subcontractors of Guilt beschreibt: Die Last des Holocaust wird nach unten weitergereicht, an die, die am wenigsten Macht haben, sie zurückzuweisen, und am Ende halten Muslime in Deutschland die Rechnung. „Importierter Antisemitismus” ist dieser Transfer in zwei Wörtern. Es ist derselbe Reflex, mit dem der Kanzler im September bei einer Berliner Kundgebung Antisemitismus unter Ausländerfeindlichkeit ablegte. Dobrindts Version geht einen Schritt weiter in den Betrieb: Die Juden gehören zu uns, als Grund, den wir in der Hand halten, damit „ihr aber nicht” folgen kann.
Deutsche mit türkischem oder arabischem Hintergrund müssen Erinnerung als Bedingung der Zugehörigkeit vorführen, während ethnische Deutsche ihren eigenen Antisemitismus als historisch abgeschlossen behandeln dürfen. Die Schuld wird nach unten weitervergeben, an die, die am wenigsten Macht haben, den Schuldtransfer abzulehnen.
Was wir veröffentlichen
Dobrindt wird im Antisemitismus-Tracker mit null antisemitischen Aussagen erscheinen. Das ist die ehrliche Zahl, und eine Zählung, die schummelt, ist wertlos. Neben der Null steht eine zweite Spalte: Aussagen, die Antisemitismus gegen andere einsetzen. Dort steht er bei acht. Die Gedenkrede, denkwürdig wegen derer, die applaudierten, ist die erste.
Wir haben auch gesucht, ob er je etwas über die Rolle seiner eigenen Familie im Nationalsozialismus gesagt hat, wie wir es bei allen tun. Nichts ist veröffentlicht, und er hat nie darüber gesprochen. Auch diese Leerstelle kommt auf die Seite.
Die Lehre aus einer Saison des Lesens ist einfach. Die Wörter sind nicht das Einzige. Ein deutscher Rechtspolitiker kann vierundzwanzig Jahre ohne ein böses Wort über Juden auskommen und sie trotzdem benutzen, wann immer es sich „lohnt”.
a blog about the poetry of information security, since 1995
