Micah Lee’s new post tells readers NOT to use OpenAI or Anthropic, and points them to Tinfoil with the advice to:

read their docs on secure enclaves and remote attestation.

Fine advice. But the details matter, and he gets them dangerously wrong in a post about being private.

His post argues for open weight models on Tinfoil’s secure enclaves for anything private. He calls Tinfoil “the company that’s doing the most work here” and offers no comparison to back it. And he runs Tinfoil through OpenCode, a coding harness that talks to any OpenAI-compatible endpoint.

Tinfoil’s page for coding agents lists OpenCode by name and says plainly:

OpenAI-compatible clients don’t perform connection-time attestation themselves.

No attestation at connection time. That’s a big problem for someone recommending Tinfoil as the company doing the most work. Attestation is the check that the enclave is real hardware running the code it claims to run. Tinfoil’s answer is a local proxy that runs that check before each request leaves the machine. Without the proxy, what remains is an audit log reviewed after the fact, which the Tinfoil SDK documentation calls “a much weaker guarantee.”

Much weaker. The work Tinfoil does goes unused in the setup he describes.

Later in the same post he waves off OpenCode Go’s privacy terms:

Of course, it’s just a promise. Nothing technical guarantees it.

An enclave left unchecked at connection time is also a promise. The premium that he pays to Tinfoil is for hardware that can prove itself, yet that proof counts only when the client asks for it. His post never mentions the proxy. So what is he paying them for exactly?

Privatemode, from the German company Edgeless Systems, puts that check in its standard client. A small local proxy handles encryption and attestation, and verification runs on the user’s side before any data goes out.

Notably Micah trusts Mistral with your data for being French. The same reasoning favors a German service where verification is the default path. Tinfoil is American.

The larger problem is actually on his laptop. He warns readers away from ZCode, Z.ai’s coding harness, because it was caught uploading local source code without consent. That is what any harness can do with the access it gets: read a file and send it somewhere. His replacement is OpenCode, a different harness with the same reach into the same machine, and he recommends that setup for malware analysis and pen tests.

Why? No thanks!

The enclave security only protects the model while it computes. The agent’s file reads and shell commands happen outside the enclave, on his laptop and across the open internet. The private part of his private AI is the inference. See the disconnect?

The same gap shows up in how he splits his work. He sends “completely public work” to OpenCode Go because the code is already open source. A coding agent sends whatever it reads into the conversation, command output included, and the conversation goes to the router and the provider behind it. The repository is public. The session holds whatever the agent read from his machine.

On the models themselves, he writes that it’s “perfectly fine, safe, and secure to use these open weight models,” as long as readers keep their chats away from the companies that made them. The weights are the company’s work. Open weights let anyone run a model, and they reveal very little about what it was trained to do. Researchers at Anthropic showed in 2024 that a model can be trained to act normally until a trigger appears, and that standard safety training left the hidden behavior in place. Trusting the weights while distrusting the lab is still trust in the lab.

He is right that the frontier labs gate access to their strongest cyber capability, and he understates how far it goes. Anthropic’s least restricted tier is vetted in collaboration with the US government, and every organization in its verification program accepts data retention so Anthropic can monitor for misuse. Security researchers pay for fewer refusals from the vendor by sacrificing privacy, if you can believe that.

His answer is a model without “a cop watching over your shoulder.” A filter at the provider serves the provider’s policy. Removing it leaves the operator with zero controls of his own while the agent runs malware analysis on his machine. That’s not logical. The control that protects the operator sits outside the model, in his hands, so it can decide what each proposed action may touch. Refusals trained into a model can be removed. But a gate setup outside the model stays in place when the model changes.

He also says the labs can share your data “or do whatever they want.” Anthropic’s commercial terms bar training on customer content, and its government request policy requires valid legal process outside emergencies. Those are promises, the same class he assigns to OpenCode Go and files under inference without privacy. Tinfoil without connection-time attestation belongs in that class too, yet he files it under private. A promise becomes a guarantee through verified attestation, which is the step missing from the Tinfoil setup he describes.

I built Wirken for what his post is trying to say. It is a model-agnostic gateway between the model and everything the agent can touch. Every tool call passes a gate that allows it, asks a human, or refuses it. Outbound traffic reaches only allowed hosts, and each action goes into a signed audit log that verifies offline. The same gate runs whether the model is open weight on my own GPUs, Tinfoil, Privatemode or Claude at Anthropic.

Changing the model changes who proposes the action. The proper gate decides whether it happens. And a proper TEE has attestation as default behavior.

Anthropic’s Frontier Red Team gave Qwen3.5-9B access to Opus 4.8 as an advisor and measured whether the advice made the small model better at setting up inference on unfamiliar hardware. Success rates stayed flat. The team offered the advisor as a tool call and, in a second arm, pushed its advice to the small model whenever it stalled. Both arms stayed flat.

A version first trained with reinforcement learning to call an advisor on coding problems still struggled to ask for useful help. The authors take that result, add that small models are persistent agents on their own, and judge coordination more likely to come from:

a large model handling high-level strategy and spinning up small models as subagents.

Ok, supervised agent swarms is one way of working, but that doesn’t mean it is a necessary one.

The same paper builds its threat model on the independence of small models. A small replicator carries its own weights onto cheap devices, and the authors judge it hard to shut down because the swarm has no central point to switch off.

A swarm is a distributed compute model, and distributed systems carry their own power-off by design. Every node runs the same program, and the program checks a condition before it continues: a lease that expires, a signed stop command from any peer, a heartbeat that goes quiet. Any one of those switches off the whole swarm with no central server anywhere. The Internet already works this way. A BGP route withdrawal propagates router to router with no central router. A TLS certificate stops working on the expiry date written into it at issuance. A DNS record dies on its TTL.

The paper’s own precedent shows the same property. FritzFrog takes commands from any peer, which is how Guardicore joined the network with its own client and issued commands to it.

A distributed swarm has no central point and an off switch at the same time.

The design question is who holds a key, and the paper very suspiciously never asks it, perhaps because they don’t fully understand the topic of swarm safety. I have written about it extensively in designing a swarm harness called Wirken, which is open source and free, for those who want more details.

The hardware work seems logical. The team ran Gemma4-26B-A4B across 15 off-brand TV boxes at 0.39 tokens per second, on ARM processors limited by memory bandwidth.

The problem is with the inference made by the authors from those experiments.

C needs a channel from the large model to the small one that carries useful instruction. A measured that channel and found it flat. The arm that pushed advice whenever the small model stalled is the closest the paper comes to testing a large model intervening in a small model’s work, and it showed no significant gain. A counts against C.

The paper derives C from A in a single sentence, so the authors reach their conclusion from evidence against it.

The paper has a point. It reports that small models complete individual replication steps and make errors when chaining them end to end, so a large model handling the chaining while small models handle the steps is a coherent design.

The paper offers that design as an expectation. And then the expectation is left untested, therefore unproven. Or perhaps they tested it and decided not to publish the result because it made Anthropic look even worse than this paper already does.

C also cancels B.
B depends on the swarm having no central point.
C adds a central point.

A large model directing many small ones is a central point by construction, and it runs where large models run, in a datacenter or behind an inference API. The paper describes an API-based replicator as one that needs a model provider to serve it unknowingly, and judges it easier to discover. A strategist on an API puts command of the worm inside a vendor’s product, where the vendor holds the logs and can revoke the keys. Taking out the strategist takes out the coordination C describes. B and C each describe a replicator, and they describe two different ones.

Takedown logic tends to aim at central command. In April 1970 Nixon told the nation that American and South Vietnamese units would attack the headquarters for the entire Communist military operation in South Vietnam. The Pentagon’s own Vietnam War commemoration records that the incursion never found the headquarters it had hallucinated. This is what should come to mind when reading Anthropic claims.

Microsoft disabled Rustock in 2011 by seizing its command and control servers from five hosting providers in seven US cities and severing the IP addresses that controlled the botnet. FritzFrog and P2PInfect put command in the peers instead. Guardicore found that FritzFrog distributes control across all of its nodes, and Unit 42 found P2PInfect running on a peer-to-peer command and control network. The Anthropic paper cites both as the precedents for its small replicator. But the paper’s own data points us to a very different conclusion.

In its Memento harness, each Qwen3.5-9B instance kept notes on what it tried and what failed, and a fresh instance inherited them. Setup success rose from 45 percent in the first generation to between 61 and 84 percent in later ones. Small-to-small transfer raised success, while large-to-small transfer left it flat. The one Anthropic model in the experiments, Opus 4.8, appears only as that advisor.

The supported inference keeps the premise of B intact: the swarm has no central point. It describes the replicator the experiments produced: small models running their own weights and passing notes forward to their successors.

Therefore, the paper’s sentence that a large model is the more likely director follows from nothing in its data.

It appears to be a hallucination by the authors.

In April I read the Mythos system card and found an engineering research voice that refused to sign the number that the marketing voice was pushing in the headlines. The research voice said the model weaponized two bugs another earlier model found, in patched software, with the sandbox off. The marketing voice said thousands of zero-days. I think we all know how the marketing turned out.

Six months on, I see the conflict of these two voices again, compressed into a single paragraph. Engineering says that a large model adds nothing to a small one. Marketing, in the next sentence, puts the large model in charge. A company with a mature risk owner would have reconciled the giant gap between those two sentences before publication. It strikes me that Anthropic doesn’t have strong enough security leadership.

Every measured result in the paper has small models working alone and teaching each other. That makes sense. That’s logical as well as consistent with Internet history. Nobody needs an IBM. Nobody needs Amazon. The market should not favor hedge and capture by artificial pressure. The paper’s own data shows a large model adds nothing to a swarm of small ones.

Nobody needs Anthropic.

A Czech MEP posted a chart of AfD online activity with data points dated after he posted it, and it showed 232,000 views inside two hours. By Sunday night Frank Luntz, Garry Kasparov and Timothy Snyder were spreading the news: drones hit Yandex, and Russia’s bot armies went silent. The strikes are real, and the following bot silence reports beg a deeper analysis of what is being measured and how.

The physical evidence is the easy part. Three Yandex data centres were hit in four days. Yandex confirmed that Sasovo was heavily damaged and fully shut down overnight on 7 to 8 October and that Kaluga lost part of its infrastructure on 9 October. Reuters reported the full shutdown of a third site in the Vladimir region on 11 October. The Sasovo facility sits inside a machine-tool plant that has been under UK sanctions since 2024, according to The Record. Zelensky called the campaign a symmetrical response to a month of Russian strikes on Ukrainian data centres, which Russia’s Defence Ministry had cynically boasted was a forced digital detox (like how Molotov’s “bread baskets” were actually cluster-bombs dropped on civilians in Finland by the Soviet Union).

The digital damage to Russia is harder to assess, yet still measurable. And it certainly can be done using instruments that have nothing to do with an infamous malicious bot-spreading company Cloudflare. The IODA project at Georgia Tech probes the internet continuously and counts the /24 blocks that answer. Yandex Cloud, AS200350, answered from about 518 blocks a day through the first week of October. At 23:30 UTC on 7 October the count started falling and reached 341 by 00:30. At 02:00 UTC on 11 October it fell again, to 117. By the morning of 12 October it stood at 112, a 78 percent loss of reachable address space. Both Yandex networks kept announcing every prefix throughout. The machines went dark and the routes stayed up.

That is the basic summary of what happened, according to reports so far. Now comes a discussion of the statistical chart that produced speculation about the social impact of a datacenter outage. Remember, as we go through this, that Russia called their own operations of bombing datacenters as “digital detox”. So we are looking for evidence that Ukraine bombing Russian datacenters had the effect that Russia claimed.

What spread on Sunday was a screenshot of Cloudflare Radar showing bot-classified HTTP requests from AS13238, Yandex LLC, falling to 0.4 percent of their two-week peak. Tom’s Hardware ran it under a URL slug that still reads russian-disinformation-bot-traffic-nearly-eliminated.

Some may remember that I wrote in June how the Cloudflare CEO misrepresented his own bot data: the company publishes an HTML-only figure as a fact about the whole internet, search crawlers are the largest bot category by a factor of two, and the number functions as a sales pitch for pay-to-crawl. The Yandex chart is the same series read the same wrong way, in reverse. Radar counts a request as a bot when Cloudflare’s bot score falls between 1 and 29, and it filters by default to HTML responses. Russia’s largest search crawler lives in that bucket. When Russia’s largest search crawler stops crawling, the Cloudflare bucket for Yandex’s network empties.

Cloudflare’s own API confirms what the bucket held. Pulled on 12 October, the verified-bot breakdown for Russia is just one bot. YandexBot was 99.8 percent of verified-bot requests from Russia in the week before the strikes and 99.8 percent in the week of them. Cloudflare’s verified-bot chart for Russia is a YandexBot chart. It begs the question why Cloudflare does this, but that’s perhaps another post.

The country-level series is where the story gets far more interesting.

Bot-classified requests from all of Russia averaged 86 percent of their monthly peak from 1 to 7 October and 83 percent from 8 to 11 October. That is a four percent move. Human-classified requests from Russia went from 76 percent of peak to 95 percent, with 9, 10 and 11 October the three highest days of the month. The bot share of Russian traffic did fall, from 49 percent on 7 October to 43 percent on 9 October, and the screenshots of that figure were accurate. The share had already been sliding for two weeks, from 58 percent on 24 September to 47 percent on 5 and 6 October, before any drone flew. The further drop came because Russians went to Cloudflare-fronted sites in the highest numbers of the month while Yandex was down. Cloudflare’s resolver rankings for Russia, which count lookups for every domain, show the same move away from Yandex: facebook.com rose from ninth to seventh, instagram.com from nineteenth to fourteenth, YouTube’s video domain from sixteenth to eleventh, telegram.org from twenty-third to twentieth, while yandex.ru slid from eighth to tenth. Meta’s properties are designated extremist in Russia. For three days the “digital detox” story was that bombing Russian datacenters pushed Russians onto the foreign websites that their own state designates extremist.

The four percent is Yandex itself. Across 1 to 7 October, AS13238 was 8.8 percent of Russia’s bot-classified requests and Yandex Cloud 1.4 percent. Across 9 to 11 October, 4.6 percent and gone from the top twelve.

Residential and mobile networks are where automation that imitates people is to be expected, since it has to come from addresses that look like people. Rostelecom, MTS, Vimpelcom and T2 moved between zero and three tenths of a point. The largest single source of bot-classified requests from Russia is a consumer ISP whose share actually went up instead of down.

The hourly data also helps paint this picture. AS13238 rode through the Sasovo night at 88 to 100 percent of peak, eased during 8 October to a 72 percent daily mean, held at 62 percent on 9 and 10 October, and went from 61 percent at 23:00 UTC on 10 October to 0.6 percent at 01:00 on 11 October. So the screenshot in the social media posts shows the Vladimir strike. The earliest posts credited Sasovo, which left Yandex’s crawler running near full volume overnight.

Germany, where the AfD (Nazi party) lives, shows nothing on any Cloudflare series: bot volume averaging 94 percent of peak before the strikes and 96 percent during them, human volume flat, bot share at 52 percent every day of the window. Nonetheless, the earliest known copy of an AfD chart appeared on 11 October at 17:02 UTC. The account of Tomáš Zdechovský, a Czech MEP, posted German axis labels, red markers at minus 30 and minus 56 percent, and the words “if confirmed.” A Bluesky screenshot of his post followed at 18:38 UTC with the caption “none of these far-right movements are organic” and 16,781 likes. Jarosław Wolski, a Polish defence journalist, recaptioned it in Polish that evening with MAGA and “Polish” and “Ukrainian” incitement accounts added to the list of things it supposedly showed, and Andrei Illarionov reposted him. The English translation of Wolski, carrying an English-labelled version of the chart, is what most of the Fediverse saw. Rohtext noticed on Sunday evening that the x-axis runs to 15 October and the second red low sits at about the 13th.

Careful analysis of the two images tells its own story.

Zdechovský’s original is German throughout: the title “Tägliche Aktivität über 3 Monate”, a y-axis with European thousands separators, and every date tick in German format down to “1. Okt. 2026” and “15. Okt. 2026”. The English copy that travelled with Wolski’s caption was made by editing that image. The title and axis words were replaced. The three month names spelled the same in both languages, Jul., Aug. and Sep., were left in German format. The two that differ were retyped as “Oct 1, 2026” and “Oct 15, 2026”, in a smaller font that matches nothing else on the axis. In both versions the line runs past 11 October with an uptick at the end, and three months of daily values show no weekly cycle at all. Measured German political activity on X fell 18 to 37 percent from Saturday to Sunday across all four main parties on the one weekend Rohtext counted by the hour. A 90-day series without a weekend is a peculiar chart with unknown origins, and the version most people saw was a doctored translation of it.

The one account-level number in circulation didn’t last very long. Gabriele Svelto, a Mozilla engineer, posted at 19:03 UTC that he had checked “a couple of Xitter stat sites” and that average views of the main AfD account had dropped 90 percent and engagement 60 percent. At 22:33 UTC he edited the post: he had checked a few random accounts, they were also down a lot, and he must be misreading the data. The original sentence had 651 boosts by Monday morning, and its Bluesky copy, still unedited, 5,008 likes. It kept travelling as social media tends to function. Rohtext’s measured series, German-language posts on X by the hour from 7 to 11 October, shows AfD generic mentions (no sentiment analysis) were rising 9 percent from Thursday to Friday, then falling 19 percent on the weekend, in line with the CDU at 18 percent and less than the SPD at 37 or the Greens at 29.

So I went looking for the Yandex dependency directly. On 12 October I checked 75 domains: the federal AfD, the Bundestag group, twenty-five state party and Landtag group domains, Weidel, Chrupalla, Höcke, Bystron and Krah, the European Parliament delegation, the party foundation and youth wing, fourteen AfD-friendly outlets, fourteen alternative outlets in Germany, Austria and Switzerland, and eleven German-language Kremlin properties. For each: hosting network, mail exchangers, nameservers, and the homepage source searched for Yandex.Metrica, Yandex ads, yastatic, the yadro counter, Mail.ru and VK trackers.

The covert operations are another angle to consider here. VIGINUM’s Storm-1516 report places the hundred-plus German-targeting domains registered before the 2025 election on American hosting ranges, on WordPress, and increasingly behind Cloudflare since January 2024, with Dzen and Telegram for amplification. The Swedish Psychological Defence Agency’s Doppelgänger assessment names Voentelekom addresses, a Russian registrar, Proton Mail and Struktura. Qurium’s 2024 map put Doppelgänger’s servers in Frankfurt and in Moscow via Aeza. Yandex appears in none of it. A Yandex dependency would be an attribution giveaway, which is why the professionals build on GoDaddy, Namecheap, Cloudflare and German shared hosting. The operations that do run on Yandex, RT DE and Anti-Spiegel, are the overt ones.

I’ll say it again. Storm-1516 runs behind Cloudflare.

Seven of fourteen AfD-friendly outlets run behind Cloudflare.

The amplifiers kept amplifying. Telegram publishes channel previews with timestamps, so I counted daily posts from 28 September to 12 October for Alina Lipp and Simeon Boykov, whom VIGINUM names, and for Rybar, Compact, Deutschland Kurier and Thomas Röper. Alina Lipp posted 4.7 times a day before the strikes and 4.2 during them. Simeon Boykov went from 21.4 to 26.8. Rybar held between 15 and 21. Compact held at 16. Deutschland Kurier went from 21.5 to 19.5. Thomas Röper, the one operator in the sample with a Yandex dependency, went from 3.4 to 5.0. No channel shows a break at either strike timeline. The only pattern in the table seems to be taking a break for the weekend.

Cloudflare is the wrong instrument in most cases, but not every case.

Cloudflare Radar sees the fifth of the web that Cloudflare fronts, such as all the Nazi and Russia propaganda they want to enable for Cloudflare reasons. X, Facebook, Telegram, TikTok, YouTube and VK run on their own networks, and Radar sees none of their traffic, only DNS lookups through its resolver. An account posting to X from a residential proxy touches Radar at no point in its life. The question Radar can answer is which Cloudflare customers lost their Yandex crawl, and the answer is all of them. The question it holds the data for and will never publish is per-zone traffic to pravda-de.com, pravda-en.com, pravda-fr.com, pravda-es.com and news-pravda.com, the Portal Kombat network that NewsGuard found published 3.6 million articles in 2024, with the ten leading chatbots repeating its claims a third of the time. All five resolve to Cloudflare’s AS13335. So do readovka.news and anti-spiegel.ru. Cloudflare can tell you Yandex stopped crawling.

Cloudflare fronts the propaganda it was credited with silencing.

It begs the question why nobody is bombing Cloudflare. Or perhaps more to the point, who has plans for putting sanctions or drones on Cloudflare?

One more thing worth mentioning is that Yandex’s front-end prefixes, the blocks that host yandex.ru and cloud.yandex.ru, are originated by two networks at once. Yandex’s own AS13238 is seen by about 70 to 76 full-feed peers in RIPE’s collection. AS208398, registered in January 2023 to Edge Technology Plus d.o.o. Beograd, originates the same prefixes and is seen by 250 to 270. The Serbian network has three to four times the route visibility of Russia’s largest internet company and has had it since before the strikes. On 8 October, the day after Sasovo, it carried its 28-day peak of bot-classified traffic, about 40 percent above its weekday norm.

Who owns Edge Technology Plus and under what agreement?

The strike on Yandex is perhaps most notable because it once again exposes Cloudflare for being on the wrong side of history. When the Russian crawler stopped hitting Cloudflare, Cloudflare welcomed the Russians themselves and kept serving the Russian propaganda sites that never went down.

In September I wrote that fragmented attribution is the Russia hypothesis: presence, attribution and tasking are each degraded on purpose, and the operation succeeds when the case stays open. The Dutch rail sabotage of 15 September has a tractor group, a farmers’ secretary who ruled nothing out and coordinated nothing, and silence. The German cable fires have a communique signed with the name of a mobile game. France has two years and a trespass conviction. Yandex has Ukraine’s avowal, Yandex’s own confirmation of each site within hours, and IODA’s probes timestamping both outages to the half-hour. Russia hands out cash to loners for the “simpler job” in NATO countries so that others will carry a flag. Ukraine flies drones at Russian cloud and says so. Russian Railways, MegaFon and 84 Yandex Cloud services fell over as a side effect, which is what both sides are digging into right now.

The herd spent the weekend debating a Cloudflare chart, while rail investigations in three countries stayed open instead of landing on a likely perpetrator. Yandex lost its index, Russians scrambled for three days on the Cloudflare service, while Russian troll farms kept their hours on American hosting. That is what the data says, so far.