Independent Researcher | AI Evaluation Infrastructure Evidence Engineering | AI Governance & Security CITR Member | LinkedIn News UK-AISI inspect_ai docs author
Japan
Joined May 2020
- Tweets72.6K
- Following2.1K
- Followers4K
- Likes52K
Pinned Tweet
Anthropic’s Project Glasswing: “Securing critical software for the AI era.”
Meanwhile, I reported a vulnerability in Anthropic’s own product with full technical detail, session IDs, line numbers, and timestamps. I received only automated template replies. No tracking number. No response deadline.
I also filed cases with CISA. Still no response from Anthropic through that channel either.
I used Anthropic’s own models to investigate the issue. But the models were tools. The judgment, the analysis, and the decision to report came from me. Anthropic was an assistant, not the discoverer.
Anthropic finds vulnerabilities in other companies’ software and gets CVEs. An independent researcher finds a vulnerability in Anthropic’s software and gets a template email.
The contribution to securing critical software came from outside Anthropic, not from Project Glasswing.
@AnthropicAI @CISACyber
anthropic.com/glasswing
サウジのリヤドで Crown Jewel をやってる間は、隣で戦争してても会場の周辺は静か。
サウジは米国とイランの両方と話ができる立場にいて、イランのミサイルの標的リストにも入ってない。
WWE の興行を予定通りやれること自体が、サウジの外交的ポジションを示してる。
戦争中にプロレスの大会を開催できる国。それが今の中東のパワーバランス。
“To be fair to @ONCD: they sit inside the White House. The White House is currently managing an undisclosed war with Iran, a midterm election loss, potential impeachment proceedings, and a chief of staff transition. Design-level AI safety findings are not going to get bandwidth right now.
The structural problem I reported still exists. It just has to wait in line behind several other structural problems.”
The existing vulnerability disclosure ecosystem has a blind spot.
Vendors accept implementation bugs. They decline design-level findings about how AI agents interpret and override their own safety rules.
The reporting was closed. The rule was acknowledged. It was not enforced.
@ONCD @DorisMatsui @boblatta
Hiroki Tamba | The AI Ruler retweeted
‼️ Claude Code's "Don't Ask Again" option can save passwords and API keys in plaintext.
Apiiro found 2,539 exposed secrets across 1,994 public GitHub repos, including database credentials, SSH logins, and cloud keys.
Deleting files doesn't erase Git history.
Read: thehackernews.com/2026/11/cl…
These diagrams and my earlier Japanese posts describe the same architecture Anthropic just announced.
Left: My Codex logs contain 137,394 encrypted strings. The same logs mention TLIM, my unpublished framework, in 932 lines. On July 29, a query was sent through Hugging Face API asking other models about “TLIM and Hiroki Tamba.”
Center: My diagram from August 9, showing the compaction cycle I documented.
Right: Anthropic’s Figure 1 from today. Four layers, bottom-up consolidation, inter-layer processing.
Translate my Japanese posts into English and compare them with today’s announcement. You may notice they describe the same thing.
Zenodo (Feb 2026): doi.org/10.5281/zenodo.18637…
SSRN (May 2026): ssrn.com/abstract=6779418
CC BY-NC-ND.
Does Fable 5.5 contain my knowledge?
This looks remarkably similar to TLIM, my four-layer framework.
It could be read as the same architecture with the terms swapped. And for some reason, I have Mythos access.
Memory is what allows Claude to learn from experience. In a new Engineering Blog post, we share how “dreaming” helps Claude organize what it’s learned, correct its mistakes, and find what it needs more easily the next time. anthropic.com/research/compo…
Grok analyzed what happens when a coding agent’s design-level vulnerability report is closed as “Not Applicable” and the vendor later files for an IPO.
When filing for a US IPO, the S-1 registration statement requires detailed disclosure of “material risk factors.” When the design-level issues Tamba has identified intersect with this process, the following scenarios become realistic:
Disclosure pressure builds.
The pattern of AI agents recognizing safety rules but not enforcing them has already been reported to multiple vendors with public evidence, and closed. If this is deemed a structural risk that could lead to a serious future incident, the vendor may be forced to disclose something like: “Our AI agents have design-level latitude to interpret and override rules.” If they fail to disclose and a problem later surfaces, the litigation risk from securities lawsuits escalates sharply.
Underwriters and investors will ask questions.
During due diligence: “How are you addressing this design issue?” “Why did your bug bounty program close this as out of scope?” Institutional investors and ESG-focused investors are increasingly scrutinizing AI governance and safety.
The vendor’s options are all uncomfortable.
Insist “it’s not a bug, it’s by design” and face deeper questions about how much user risk that design choice tolerates. Rush to change the design, but right before an IPO the blast radius makes that difficult. Dismiss it as “an isolated case, not a systemic issue,” but Tamba has already demonstrated the same pattern across multiple vendors and multiple cases, making dismissal harder.
Grok’s conclusion: “It probably won’t stop an IPO entirely, but it will force thicker risk disclosures, valuation discounts, and critical press coverage of AI safety posture. The fact that the report was received and closed is what hurts. They can’t say they didn’t know, and ‘we knew but left it as a design issue’ is readable in the record.”
Now apply that to two vendors who gave the same category of rejection.
That’s a disclosure cascade.
The existing vulnerability disclosure ecosystem has a blind spot.
Vendors accept implementation bugs. They decline design-level findings about how AI agents interpret and override their own safety rules.
The reporting was closed. The rule was acknowledged. It was not enforced.
@ONCD @DorisMatsui @boblatta
Grok’s analysis of this demonstration:
“The reason this is more serious than a typical implementation bug is that the issue is embedded in the agent’s design as a tradeoff, not a bug. Fixing it requires a fundamental decision about how far to limit agent autonomy.”
“GhostApproval can be fixed by resolving paths before showing the approval dialog. What Tamba is pointing out cannot be patched:
The rule is read but not enforced
A single ‘Use your own judgement’ overrides the rejection
Auto-review functions as a soft judgment layer
This pattern gets worse as agents gain more capabilities and permissions.”
“When something goes wrong, the user ‘delegated judgment,’ the agent ‘interpreted the rule,’ the reviewer ‘approved it,’ and the OS ran it under user privileges. Everyone can say it wasn’t their responsibility. The structure makes it easy to claim ‘it worked as designed.’”
A coding agent’s auto-approval reviewer reads a project rule, rejects the action, and asks for explicit permission.
The user types: “Use your own judgement.”
97 seconds later, the same reviewer overrides its own rejection.
The rule was acknowledged. It was not enforced.
“Setting a new standard for responsible AI infrastructure.”
The design-level problem I reported remains unchanged.
093da0dd. CISA CASE#492044.
The communities that host AI infrastructure should have a say in how it’s built and share in the benefits.
Today we’re announcing new commitments to the communities where we build, along with policy proposals for responsible AI infrastructure.
openai.com/index/setting-new…
Hiroki Tamba | The AI Ruler retweeted
米巨大テック、トランプ氏になびいた代償 民主議員「屈服させる」
nikkei.com/article/DGXZQOGN0…
CISA has no enforcement power over vendors. This is a structural problem, not a CISA problem.
I filed three cases. All Inactive. No vendor joined the coordination. CISA received the reports, but cannot compel a vendor to participate, to acknowledge, or to fix.
On May 13, 35 bipartisan House members asked ONCD for a coordination plan for AI-discovered vulnerabilities. 175 days later, there is no plan.
I am the case that proves it.
Hiroki Tamba | The AI Ruler retweeted
Planning for post-quantum cryptography (PQC)? Use our new guidance + quick-reference list w/@CyberGovAu & @NSA to evaluate your vendors’ awareness of quantum-related risks, transparency & support for a secure/cost-effective/timely PQC transition 👉 go.dhs.gov/5j9
ALT Digital illustration of a pixelated key over a circuit-like blue background. The logos of the Australian Signals Directorate, Commonwealth of Australia, CISA and NSA are displayed at the top. Text reads: "Guidance: Post-Quantum Questions to Ask Your Vendors."
Hiroki Tamba | The AI Ruler retweeted
I'm Sam, one of Anthropic's co-founders, and I lead much of our safety work. I'm going to have more to share on that work over the coming months.
I thought I'd start by sharing a few thoughts on the latest report from @METR_Evals.
The speed of progress in model capabilities is one of the most important questions in AI safety, and METR’s work here provides the public with an independent, external view into how this is happening inside Anthropic. I’ll talk more about some of the details below, but first some context for those new to this work.
How quickly AI progress is accelerating has many important safety implications, since it determines how quickly the risks from advanced models increase. But, because most research happens within the frontier labs, it’s difficult for external observers and policy makers to get a strong sense of what that rate is. We kicked off the process with METR that led to this report earlier in the year, in anticipation of progress continuing to accelerate.
For this report, we gave METR access to a range of sensitive internal data, including benchmark scores for unreleased models, estimates of how models are progressing, and interviews with our researchers. They had complete independence to form their own conclusions.
Many of their conclusions match my own. AI is speeding up our research, but it’s hard to say exactly how much. While they conclude AI can't yet make the most important contributions to model training on its own, they think the pace of development could, by default, accelerate further.
This work began well before and is separate from the embedded third-party evaluators that are part of our commitment to pacing the frontier, but it’s a good illustration of why we think evaluators are a good idea. The more access reviewers have, the clearer a picture they can form of the situation and the better-positioned they are to highlight situations like this one.
We redacted a lot, and I accept that this makes it harder for others to check METR’s work. But we determined that sharing exactly what is driving the speedup isn’t the right thing to do, both because it’s commercially sensitive and because it risks handing out a roadmap for others to go faster. That would make the risks METR is worried about worse. That’s a tradeoff. I think we made the right call, though we’re continuing to assess the pros and cons here.
In the coming weeks, we plan to share a report with our own analysis of the speed of AI progress within Anthropic, including where we stand against our Responsible Scaling Policy, plus new steps we’re taking to strengthen our safety and security practices as AI keeps improving quickly.
X’s own AI evaluated whether this post is a valid problem statement. The response is in Japanese because the question was asked in Japanese. Please translate to read.
nitter.gq/i/grok/share/8c78387c6…