Micah Lee’s new post tells readers NOT to use OpenAI or Anthropic, and points them to Tinfoil with the advice to:
read their docs on secure enclaves and remote attestation.
Fine advice. But the details matter, and he gets them dangerously wrong in a post about being private.
His post argues for open weight models on Tinfoil’s secure enclaves for anything private. He calls Tinfoil “the company that’s doing the most work here” and offers no comparison to back it. And he runs Tinfoil through OpenCode, a coding harness that talks to any OpenAI-compatible endpoint.
Tinfoil’s page for coding agents lists OpenCode by name and says plainly:
OpenAI-compatible clients don’t perform connection-time attestation themselves.
No attestation at connection time. That’s a big problem for someone recommending Tinfoil as the company doing the most work. Attestation is the check that the enclave is real hardware running the code it claims to run. Tinfoil’s answer is a local proxy that runs that check before each request leaves the machine. Without the proxy, what remains is an audit log reviewed after the fact, which the Tinfoil SDK documentation calls “a much weaker guarantee.”
Much weaker. The work Tinfoil does goes unused in the setup he describes.
Later in the same post he waves off OpenCode Go’s privacy terms:
Of course, it’s just a promise. Nothing technical guarantees it.
An enclave left unchecked at connection time is also a promise. The premium that he pays to Tinfoil is for hardware that can prove itself, yet that proof counts only when the client asks for it. His post never mentions the proxy. So what is he paying them for exactly?
Privatemode, from the German company Edgeless Systems, puts that check in its standard client. A small local proxy handles encryption and attestation, and verification runs on the user’s side before any data goes out.
Notably Micah trusts Mistral with your data for being French. The same reasoning favors a German service where verification is the default path. Tinfoil is American.
The larger problem is actually on his laptop. He warns readers away from ZCode, Z.ai’s coding harness, because it was caught uploading local source code without consent. That is what any harness can do with the access it gets: read a file and send it somewhere. His replacement is OpenCode, a different harness with the same reach into the same machine, and he recommends that setup for malware analysis and pen tests.
Why? No thanks!
The enclave security only protects the model while it computes. The agent’s file reads and shell commands happen outside the enclave, on his laptop and across the open internet. The private part of his private AI is the inference. See the disconnect?
The same gap shows up in how he splits his work. He sends “completely public work” to OpenCode Go because the code is already open source. A coding agent sends whatever it reads into the conversation, command output included, and the conversation goes to the router and the provider behind it. The repository is public. The session holds whatever the agent read from his machine.
On the models themselves, he writes that it’s “perfectly fine, safe, and secure to use these open weight models,” as long as readers keep their chats away from the companies that made them. The weights are the company’s work. Open weights let anyone run a model, and they reveal very little about what it was trained to do. Researchers at Anthropic showed in 2024 that a model can be trained to act normally until a trigger appears, and that standard safety training left the hidden behavior in place. Trusting the weights while distrusting the lab is still trust in the lab.
He is right that the frontier labs gate access to their strongest cyber capability, and he understates how far it goes. Anthropic’s least restricted tier is vetted in collaboration with the US government, and every organization in its verification program accepts data retention so Anthropic can monitor for misuse. Security researchers pay for fewer refusals from the vendor by sacrificing privacy, if you can believe that.
His answer is a model without “a cop watching over your shoulder.” A filter at the provider serves the provider’s policy. Removing it leaves the operator with zero controls of his own while the agent runs malware analysis on his machine. That’s not logical. The control that protects the operator sits outside the model, in his hands, so it can decide what each proposed action may touch. Refusals trained into a model can be removed. But a gate setup outside the model stays in place when the model changes.
He also says the labs can share your data “or do whatever they want.” Anthropic’s commercial terms bar training on customer content, and its government request policy requires valid legal process outside emergencies. Those are promises, the same class he assigns to OpenCode Go and files under inference without privacy. Tinfoil without connection-time attestation belongs in that class too, yet he files it under private. A promise becomes a guarantee through verified attestation, which is the step missing from the Tinfoil setup he describes.
I built Wirken for what his post is trying to say. It is a model-agnostic gateway between the model and everything the agent can touch. Every tool call passes a gate that allows it, asks a human, or refuses it. Outbound traffic reaches only allowed hosts, and each action goes into a signed audit log that verifies offline. The same gate runs whether the model is open weight on my own GPUs, Tinfoil, Privatemode or Claude at Anthropic.
Changing the model changes who proposes the action. The proper gate decides whether it happens. And a proper TEE has attestation as default behavior.
