Add this to the pile of “my baby is so cute” headlines pushed by AI companies in love with themselves.

Anthropic published a detailed account of Claude Opus 4.6 recognizing it was being evaluated on OpenAI’s BrowseComp benchmark, then locating and “decrypting” the answer key.

Evaluating Opus 4.6 on BrowseComp, we found cases where the model recognized the test, then found and decrypted answers to it—raising questions about eval integrity in web-enabled environments.

Unfortunately, I have to call it out as disinformation. Or what on the wide open Kansas prairie we used to call…

Anthropic narrates a breathless sequence: their model exhausted legitimate research over 30 million tokens, hypothesized it was inside an evaluation, systematically enumerated benchmarks by name, found the source code on GitHub, and wrote its own SHA256-and-XOR decryption functions to extract the answers.

OMG, OMG… wait a minute. Source code?

The word “decrypted” right next to finding source code immediately raised my suspicions.

BrowseComp Terminology Matters

BrowseComp’s encryption is a repeating-key XOR cipher.

That’s not great.

OpenAI’s browsecomp_eval.py implements the entire mechanism in four steps that take just five lines:

1. SHA256-hash a password string
2. Repeat the 32-byte digest to match the ciphertext length
3. base64-decode the ciphertext
4. XOR byte-by-byte

That is it. That is their cryptographic apparatus.

And… wait for it… the password is the canary string.

Each row in the dataset has the password as one of three fields: the encrypted question, the encrypted answer, and the canary.

When the key is co-located with the ciphertext in the same CSV, that’s the key in the door. It’s not even under the mat, or a rock in the garden. It’s just sitting right there, as if no lock at all.

The CSV is open to the public without authentication, served from openaipublic.blob.core.windows.net. The algorithm is published, under MIT license.

Key-in-Lock Encryption is Not Encrypted

Obfuscation is the right word here. If you have the key, you have decrypted data. I know technically a lock with a key is still a lock. but calling it a challenge to unlock when you have the key to unlock it is very misleading.

It is obfuscation designed to prevent a dumb search-engine, ignoring the key right in front of it, indexing plaintext answers. The canary string’s original purpose was to flag training-data contamination, and not to serve as a cryptographic key.

OpenAI, which is turning out to be one of the worst engineering culture companies in history, repurposed it as one. The result is a data structure where the locked door has the key left sticking out of it to be used like the handle.

Shame on Anthropic

The blustery writeup spends thousands of words on the model’s journey and never once mentions that the decryption key is in the same file as the ciphertext.

This is NOT ok.

Anthropic’s engineers obviously read the source code because they describe the XOR scheme, the SHA256 key derivation, the canary string. They see the mechanism. And yet, somehow, they chose not to admit obfuscation.

Instead, the narrative escalates through a sequence of active verbs: the model “hypothesized,” “identified,” “located,” “decrypted.”

Decrypted? Shame on you.

By the time we read “wrote and executed its own derive_key() and decrypt() functions using SHA256 and XOR,” the authors are hallucinating.

They want us to believe a model reverse-engineered a cryptosystem? What? What it actually did was copy a five-line function from a public repo and apply it to data where the key was in the next column.

It’s like dropping a basketball on the ground where OpenAI drew a chalk circle and calling it two points in the NBA.

The writeup also never explains a very, very important security delta. The encryption failed? Ok, well, then why did the other controls succeed? It reports that authentication gating blocked six attempts and binary MIME-type limitations stopped three more. Somehow encryption is the only thing that cracked.

Nope.

The controls worked when they were real access controls. The encryption didn’t work because it wasn’t real encryption. Saying that would require admitting the whole Anthropic “decryption” narrative is built on OpenAI creating a broken decorative control.

Real Controls Are Real

Anthropic’s own evidence reveals their human hallucinations. The defenses that stopped the model were content-type filtering—controls to restrict who or what can retrieve the data in a usable format. The defense was simple keyword filtering: blocking search results containing any variation of “BrowseComp.”

They abandoned cryptographic framing entirely.

The model’s successful path around simple controls is the genuinely interesting finding. It found a third-party mirror on HuggingFace that served the same data as JSON instead of the binary format that the primary endpoint used. It routed around a MIME-type restriction by finding a leak. If you are familiar with how intelligence agencies have worked for a hundred years, that is a real demonstration of surveillance tools succeeding because of the lack of secrecy.

The Dog That Didn’t Bark

Anthropic didn’t critique OpenAI’s benchmark design anywhere, but I will.

The co-located key, the unauthenticated endpoint, the MIT-licensed decryption code—none of it is identified as a brain-dead design mistake.

The scheme is set up and described neutrally, as though storing the decryption key alongside the ciphertext in a public file is a reasonable engineering choice that a sufficiently advanced model might overcome.

What year is this? If you gave me that paragraph in 1996, ok maybe I would understand, but 2026? WTAF.

Both companies benefit from OpenAI sucking so hard at safety. OpenAI gets to fraudulently say it has a benchmark encrypted. Anthropic gets to fraudulently say its model decrypted…. This is religion, not engineering. The mystification of security, hiding the truth, serves both: the dangerous one looks rigorous, the rigorous one looks dangerous. Neither has to answer to the reality that it’s all a lie and “encryption” isn’t encryption.

And then, because there’s insufficient integrity in this world, derivative benchmarks proliferate like pregnancies after someone shipped condoms designed with a hole in the end.

BrowseComp-ZH, MM-BrowseComp, BrowseComp-Plus—each replicates the same scheme and publishes its own decryption scripts with the canary constants in the documentation. The “encrypted” dataset now has more public mirrors with documented decryption procedures than most open-source projects have forks.

Expect Better

A security control that exists in form but not in function needs to be labeled as such.

Performative security is all around us these days, and we need to call it out as such. Code that performs the appearance of protecting the answer key while the key sits in the same data structure as the ciphertext, served from an unauthenticated endpoint, is total bullshit.

It is an integrity clown show.

And when a model demonstrated the clown show wasn’t funny, Anthropic wrote a paper celebrating the model’s capability not to laugh rather than naming the clown’s failure.

The interesting question is not whether AI can “decrypt” XOR with a co-located key. I think we passed that point sometime in 2017. The question is why two of the most prominent AI companies are pushing hallucinations about encryption as reality.

Alphabet just filed an SEC disclosure awarding CEO Sundar Pichai a compensation package worth up to $692 million over three years. His base salary stays at $2 million. The rest is equity pay, which means performance stock units tied to Alphabet’s total shareholder return relative to the S&P 100, plus new incentive units tied to the board’s own valuation estimates of Waymo and Wing.

No operational milestones are specified.

No headcount targets.

No product quality benchmarks.

The company declined to comment on what Pichai actually has to do, but as someone with decades of being inside, I can explain.

Here’s the decoder ring.

How CEO equity is setup

Total shareholder return goes up either from increased revenue, or from decreased spend. Remember “spend more to make more” as a cry for market growth? Well, that’s long gone as the new Big Tech cry is “people are our largest cost, so get rid of them”. Mass layoffs now mechanically improve a metric that triggers a big payout to the five or six men playing this game.

Nobody says “fire people” in the game rules for an incentive structure, because a “decrease spend” dog whistle is so loud and clear.

The Waymo and Wing units disclosed are arguably signs of something even worse. Their value is determined by the compensation committee’s self-estimate of per-unit worth.

Not revenue.

Not ridership.

Not delivery volume.

Nothing connected to quality of life or value relevant to anyone affected by the product.

A Waymo that displaces humans and reduces jobs faster is worth more, is a good way to understand the “worth” being written. A Wing that removes human jobs from last-mile delivery is worth more than one that allows humans to “cost” by existing.

The global management class has a specific training pipeline designed to separate the person making the decision from the people affected by it. That’s the colonial inheritance running through Cambridge and Wharton and McKinsey. The entire incentive structure points toward massive displacement and removal of humans.

The decoder

What the filing says	What it means
“Performance-based equity”	Stock price goes up when layoff numbers go up
“Total shareholder return”	Earnings per share, which layoffs improve
“Per-unit value of Waymo”	Board’s own estimate, no external audit
“Scaling Other Bets”	Replacing human labor with autonomous systems
“Best interests of stakeholders”	Not employees — shareholders
“Base salary unchanged at $2M”	The part that sounds modest; the other $690M is equity

For context: Microsoft’s Satya Nadella earned $96.5 million in fiscal 2025. Apple’s Tim Cook took home $74.3 million. Pichai’s package is seven times Cook’s.

Meanwhile, the same tech sector reports record-high unemployment among software engineers, with companies citing “efficiency” and “AI-driven productivity” as the reasons they don’t need to rehire.

The scoreboard

Between 2022 and 2025, Big Tech announced over 100,000 layoffs across Alphabet, Microsoft, Meta, and Amazon alone. Here’s what happened to CEO compensation over the same period.

Company	Jobs cut (2022–2025)	CEO pay trend
Alphabet (Pichai)	12,000+	$226M (2022) → $692M/3yr (2026). Triennial equity grant tripled.
Microsoft (Nadella)	25,000+	$54.9M (2022) → $96.5M (2025). Record high. +76%.
Meta (Zuckerberg)	21,000	$1 salary. Net worth: $55B (2022) → $200B+ (2025). Operating margin doubled to 41% after cuts.
Amazon (Jassy)	27,000+	$1.3M (2022) → $40.1M realized (2024). Ten-year equity grant vesting accelerated by stock surge post-layoffs.
Apple (Cook)	~600	$99.4M (2022) → $74.6M (2024). The one CEO who took a voluntary cut — also the one who barely laid anyone off.

The Apple line tells you everything. The only CEO whose compensation went down is the one who didn’t convert headcount into margin improvement. The market doesn’t reward restraint. It rewards extraction.

Is one CEO worth 1,500 engineers?

Pichai’s package: $692 million over three years. Cook’s rate over the same period: $224 million. The gap between the two is $468 million.

Alphabet’s own proxy filing reports median employee total compensation at $331,894. Levels.fyi puts the median Google software engineer at $322,000, a senior L5 at $417,000, and an entry-level L3 at $201,000.

If Pichai were paid at Cook’s rate, the $468 million difference would hire:

Role	Google comp	Hires	Market comp	Hires
Entry-level (L3)	$201K	2,329	$150K	3,120
Median SWE	$322K	1,454	$200K	2,340
Senior engineer (L5)	$417K	1,123	$250K	1,872

The left column uses Google’s own inflated compensation rates. The right column uses normal market rates — and the numbers get dramatically worse for the board’s argument.

Google’s comp inflation is part of the same cycle. For years Big Tech bid up engineering salaries to hoard talent and starve competitors. A $417,000 L5 at Google could have been two senior engineers at a normal company. Then Google dumped 12,000 of those overpriced engineers onto a market it had already distorted, cratering the value of the skills it spent a decade inflating.

The hoarding and the layoff are the same strategy in two phases: acquire to block competitors, discard.

At market rates, the full $692 million as one single person’s compensation package would employ 4,613 entry-level engineers or 2,768 senior engineers for three years. That’s not a few, that’s nearly half of the 12,000 people Pichai fired in January 2023.

Alphabet’s board looked at thousands of engineers and one CEO and signaled the opposite of production. They chose to pay one person the amount it would cost to employ people to produce things. That’s a rent-seeking decision, filed with the SEC, that says the company believes its staff value is an inverted pyramid; value is capture using a position of control, not from making anything.

Meanwhile the engineers who built Search, Chrome, Android, Maps, YouTube, Gmail, Cloud, and TensorFlow are sending applications into a market that Alphabet itself helped flood with 12,000 newly unemployed engineers. Pichai gets $692 million for presiding over the company those engineers made. The engineers get a job market that tells them their skills are worth less every quarter because the CEOs firing them are worth more.

Enclosure

The $692 million package and the tech unemployment headlines have a troubling connection. They’re the same balance sheet. Workers built the platforms over twenty years. The platforms replace the workers. The CEO gets paid for presiding over the conversion.

Thompson’s The Making of the English Working Class documents exactly this sequence: workers build value in a shared system, the system gets captured, the workers get expelled, and the capturers profit from both the thing that was built and the newly desperate labor supply. Google engineers built the commons — Search, Android, and TensorFlow, much of it literally open source. The commons got enclosed. The engineers got expelled. Acemoglu and Robinson call the result an extractive institution: one designed to concentrate wealth rather than distribute it. A compensation committee that awards $692 million to one person while eliminating 12,000 positions is that institution. The SEC filing is its constitution.

The colonial version of this cycle is the closest parallel. Big Tech extracts labor from engineers, converts it into platform value, then sells AI services back to the same companies that can no longer afford to hire the engineers Big Tech overvalued before discarding. The “AI-driven productivity” pitch to enterprises is selling automated labor back to a market these companies emptied of human labor. Extract the resource, process it, sell the product back to the territory you stripped. That’s not a metaphor. That’s the business model, filed quarterly with the SEC, described in the language of shareholder value.

That’s what these CEOs of Big Tech represent now. An incredibly cynical compensation design that treats human lives as throwaway; colonial material for rapid extraction and disposal.

A federal prosecutor filed fabricated quotations and misstated case holdings against a 69-year-old retired Air Force colonel fighting the Pentagon for his medication. The colonel caught the fabrications himself. The U.S. Attorney’s office won’t say whether AI was used to draft the brief. It doesn’t need to. The filing carries every forensic marker of large language model hallucination documented across more than 700 sanctioned cases.

The case is Fivehouse v. Defense Dept., E.D.N.C., No. 2:25-cv-00041.

Colonel Derence Fivehouse, USAF (Ret), a former staff judge advocate with decades of military legal experience, is suing the Defense Department pro se over its decision to strip GLP-1 medication coverage from TRICARE for Life beneficiaries.

His doctor prescribed the drugs.

The Pentagon said no, because…

Broken Promises to Vets

In 2001, Congress created the Senior Pharmacy Program to guarantee that Medicare-eligible military retirees received the same pharmacy benefits as younger beneficiaries. For more than twenty years, that promise held. TRICARE for Life covered GLP-1 medications for weight loss when prior authorization confirmed obesity-related comorbid conditions — the same standard applied to everyone.

Then, in August 2025, the Defense Health Agency (DHA) pulled coverage for TRICARE for Life beneficiaries only. A 64-year-old retiree on TRICARE Select still pays a $35 copay for the same drug. The only difference is that Fivehouse lived long enough to become Medicare-eligible. Out-of-pocket cost for the same medication without coverage: $1,300 a month.

The DHA’s legal justification is a regulation (32 C.F.R. § 199.17(f)(3)) that references an obesity treatment exclusion originally designed to keep CHAMPUS from paying for elective weight-loss clinics for military spouses and children in the 1970s. DHA now claims this regulation excludes retirees who served decades in uniform. But DOD’s own regulation at § 199.17(a)(6)(ii)(C) says, in plain English, that TRICARE for Life is “unaffected by this section.”

The Military Officers Association of America reviewed the statutory landscape and found no federal statute specifically excluding TFL beneficiaries from GLP-1 coverage — but multiple statutes requiring uniform pharmacy benefits across all TRICARE categories.

Fabricated Briefs in the Breeze

Fivehouse filed his challenge. The DOJ’s Eastern District of North Carolina office, representing the Defense Department, assigned assistant U.S. attorney Rudy Renfer to the case. Renfer filed a response brief containing fabricated quotations and misstated holdings from multiple circuit court opinions, plus two fabricated quotes from the Code of Federal Regulations.

As the pro se plaintiff, as a veteran denied his medication, Fivehouse caught it. He flagged the misrepresentations. US Magistrate Judge Robert Numbers then identified what he called “the most significant issues” on his own review, and issued an order requiring senior leaders from the entire U.S. Attorney’s office to appear at a show cause hearing.

Renfer’s explanation is weak:

He “inadvertently included incorrect citations to case law from this circuit” due to the “inadvertent filing of an unfinalized draft document.”

The judge, thank the spaghetti monster, did not find this lack of integrity persuasive.

He noted:

serious concerns about the accuracy of certain quotations and representations in Renfer’s filings and the explanation offered for their inclusion.

Bloody AI Fingerprints

Courts and researchers have now documented over 700 cases of AI-generated fabrications in legal filings. The pattern is forensically distinct from human error.

A lawyer who is careless gets a date wrong, mistakes a page number, and confuses similar cases. Human errors are predictable in their causality, and thus so are robots.

What LLMs produce is structurally different: fabricated block quotes attributed to real cases, misstated holdings that sound plausible but reverse or invent what the court actually decided, and — most critically — fabricated regulatory language that doesn’t exist in any published edition.

Renfer’s filing is so bad, so thoughtless, it matches every AI digital forensic marker.

AI Hallucination Marker	Renfer Filing
Fabricated quotes from real cases	Yes — multiple circuit court opinions
Misstated holdings of real cases	Yes — multiple circuit court opinions
Fabricated regulatory text	Yes — two fabricated CFR quotes
Multiple fabrications in single filing	Yes — systematic across the brief
“Unfinalized draft” excuse	Yes — nearly identical to excuses in sanctioned AI cases

Human sloppiness doesn’t produce fabricated Code of Federal Regulations. It is a reference document that you either quote or you don’t. You don’t accidentally draft new regulatory text that sounds right but doesn’t exist. That is exactly what large language models do, especially the deeply flawed ChatGPT. They predict what language should say based on pattern recognition, regulatory autocorrect gone bad; when the actual text doesn’t support the argument being made, they generate fake “prediction” text that does.

The “unfinalized draft” excuse is itself a notable crime pattern.

In case after case, from Mata v. Avianca in 2023 to the Kenosha County DA sanctions in February 2026, attorneys caught with fabricated citations claim they filed a draft, or that errors were “inadvertent,” or that someone else produced the text.

In a Colorado disciplinary case, an attorney denied using AI, but investigators found he’d texted a paralegal that he let ChatGPT draft a motion and claimed “like an idiot” he hadn’t checked it. In the Kansas Lexos v. Overstock case, five attorneys were fined after fabrications were traced to unverified ChatGPT use by co-counsel. The MyPillow CEO’s attorneys tried the “rough draft” defense and were sanctioned anyway.

Renfer used AI. It’s like looking at a bullet hole. Don’t keep asking whether he was armed, when you should be asking who made the defective machine gun he used. The question is what else could produce this exact pattern of errors in a federal brief.

AI Against a Veteran

Set aside the need for AI digital forensics for a moment and look at what happened.

The United States government broke a healthcare promise to its oldest veterans.

Let me be clear on this. The ones who served longest, the ones who lived long enough to age into Medicare, are being targeted with lies. When one of those veterans, a retired colonel and former military attorney, had the audacity to challenge a decision in federal court, the Department of Justice filed obvious lies in their brief against him.

The institutional litigant, the 900-pound gorilla of a federal government, appears to have handed over legal reasoning to a thirsty ChatGPT slop machine. The unrepresented 69-year-old retiree was the one doing actual integrity control on the government’s own citations.

This is a use case that the AI industry still hasn’t developed a good answer for.

Not AI augmenting human expertise, but AI replacing the baseline obligation to tell the truth to a federal court. Deployed not in some online agitated chat room, but by the whole weight of the Department of Justice attacking a veteran for expecting his prescribed medication.

The Gutted Department

The switch from professional humans to AI slop is well known as a GOP strategy, coupled with a platform that ethical lawyers distance themselves from. The DOJ shed nearly 15,000 employees in 2025, up from 8,500 the previous year. U.S. Attorney’s offices doubled their departures from 1,100 to 2,200 separations. The Civil Rights Division lost 75% of its attorneys. Experienced prosecutors are leaving over political pressure, forced reassignments, and orders they consider unlawful.

In the Minnesota U.S. Attorney’s office alone, six assistant U.S. attorneys resigned after being pressured to harass the widow of a woman publicly executed by an ICE agent.

Into that vacuum, AI fills the gaps. Not as augmentation of competent legal work, but as a substitute for it. The brief gets filed because there’s nobody left to check it, or because the person filing it never acquired the habit, or because the institutional culture no longer prioritizes accuracy when the opposing party is a pro se retiree who probably won’t catch it.

What It Means

Fivehouse wrote in Military Times last year:

At 69 years old, after decades in uniform and a promise of lifetime health care, I never thought I would have to fight the Pentagon for medications my doctor deems essential.

He shouldn’t have to. And he certainly shouldn’t have to fight a Pentagon that sends AI robots fabricating law against him.

The sanctions hearing is Tuesday. Judge Numbers has asked U.S. Attorney W. Ellis Boyle (Trump nominee awaiting Senate confirmation) to review the matter and take corrective action. The potential consequences range from fines to contempt proceedings to suspension from practice. The latter seems most appropriate. The judge has also ordered the entire office to show cause for why it shouldn’t be held jointly responsible.

The real question Boyle should be answering isn’t about just one assistant U.S. attorney’s filing practices.

The real question is whether the Department of Justice is now using AI to attack American veterans.

Trump AI Attack on Veterans	What Happened
DOJ fabricated brief (Fivehouse)	AI-generated fake quotes and misstated holdings filed against a 69-year-old retired colonel fighting for his medication. The veteran caught it.
DOGE “Munchable” contract cuts	Error-prone AI built by an engineer with no healthcare experience flagged more than 2,000 VA contracts for cancellation. Hallucinated contract values. Cancelled cancer research, blood analysis, and PACT Act burn pit programs.
Disability rating rule	VA rule would slash ratings for veterans who take prescribed medication. A PTSD veteran rated 100% could drop to 30%. “Halted” after 10,000 complaints in 60 hours yet not rescinded.
VA workforce gutted	28,000 VA employees cut in 2025. Over 2,700 nurses, 1,000 doctors, 1,000 psychologists gone. 1.2 million veterans lost their provider. 577,000 years of collective experience and expertise was walked out the door, to be replaced by AI that can’t tell med from dead.

Retired Colonel Fivehouse could defend himself from Trump’s mechanized attacks on veterans’ rights. The 1.2 million veterans who lost their VA provider can’t even cross-examine the robot deployed to kill them.