Iain Harper's Blog

Ask Claude how many legs the animal that spins webs has, and it answers eight. The word “spider” appears nowhere in the question and nowhere in the reply. But midway through the model's processing, researchers at Anthropic found it anyway, held internally as a word the model was preparing to use. Swap that one internal word for “ant” and the model, everything else untouched, answers six legs.

This is stranger than it first sounds. Nobody typed “spider” anywhere in this exchange. Nobody trained the model to hold a private noun in reserve before answering a question about legs. The word turns up anyway, mid-process, doing exactly the job a word does in your own head when you are one step from saying it out loud.

That experiment comes from a paper Anthropic published on July 6th 2026, and the reason it counts as a landmark reflects one aspect of modern AI that most people have never absorbed. Nobody knows how these systems work. Not the critics, and not, in any detailed mechanical sense, the companies that build them. The new research shrinks that ignorance in a specific way. It found, inside Claude, a small working memory made of unspoken words, which Anthropic calls the J-space. Outsiders can read it mid-task, and overwriting an entry changes what the model does next.

Grown, not built

Ordinary software is written. Somewhere there is a line of code that computes the tax you owe, and a person who can point to it. A large language model is fundamentally different. It is a few hundred billion numbers, the parameters, and no human chose any of them. Training pushes trillions of words of text through the system and nudges the numbers, over and over, in whatever direction makes the model's next-word predictions slightly less wrong. Repeat at industrial scale and out comes something that drafts contracts and flirts in Portuguese. Nobody programmed those abilities. They accumulated.

Chris Olah, who founded Anthropic's interpretability team, describes such systems as “grown” more than they are “built”, a line his chief executive, Dario Amodei, borrowed for an essay last year on how alarmed outsiders are to find that the builders cannot explain their product, an essay that committed the company to reliably detecting most model problems by 2027.

But grown things resist inspection. You cannot simply read the numbers, because concepts are not stored one per slot. Each concept is spread thinly across many numbers, and each number contributes to many concepts at once (the field calls this superposition), so staring at the raw values tells you about as much as an MRI scan tells you about a grudge.

The upshot is that the people who make these systems can test what a model does but cannot, in general, say why it does it. In 2023, researchers at Carnegie Mellon showed that appending a specific string of machine-generated gibberish to a forbidden request would collapse a model's safety training, and that the same string often worked on models its authors had never touched. Three years on, that attack is far better described than explained. Every benchmark score, safety assurance and claim about an AI system has rested on watching its behaviour from the outside, because the outside was all that was visible.

A list of words it has not said yet

The new work, from a team including Wes Gurnee, Nicholas Sofroniew and Jack Lindsey, opens a window into the interior. The measurement behind it, which the team calls the Jacobian lens (a descendant of a 2020 technique called the logit lens), is simple at heart. At every stage of the model's processing, for every word it knows, the lens measures how strongly the model is currently disposed to say that word, either immediately or at some point later in its reply. Not the next word but words that are “on the tip of its tongue”.

Read that measurement while Claude works and you find a short list, roughly 25 concepts at any moment, that shifts as the model works. The list is tiny relative to everything else going on inside, accounting for under a tenth of the statistical variation in the model's internal state, and it exists only in the middle stretch of processing, forming about a third of the way through and fading shortly before the reply is settled.

The experiments share one shape. Give the model a visible task and a silent side-instruction, then watch the list while it works. In the gentlest version, the visible task is copying out a sentence, “The old painting hung crookedly on the wall”, chosen to have nothing to do with anything, and the side-instruction is to keep citrus fruits in mind. The model types the sentence perfectly. The only words leaving it concern a painting. On the internal list, meanwhile, sit “orange” and “lemon”, invisible in the output but unmissable under the lens.

Now harden the instruction. Told to work out 3² − 2 silently during the same copying task, the model puts “nine” on the internal list (three squared) and then “seven”, the correct calculation. Neither number ever reaches the output. The arithmetic happened, start to finish, on a list that only the researchers were reading.

The third experiment shows planning. Asked for a rhyming couplet opening “The soldier marched into the night”, the model puts “fight” on the list before it has written a word of the second line. It has picked its ending in advance. Overwrite that entry with “light”, and the model writes a different second line, engineered to land on the ending the researchers chose instead, closing on “morning light”.

On questions with an unstated middle step, overwriting that step redirects the final answer most of the time on Claude Sonnet 4.5. This is the detail that separates the result from a curiosity. A heart-rate monitor reports on the heart without being part of it. The internal list is different. Change an entry and the answer downstream changes, which means the model is computing with it, writing intermediate results into a small shared space where any later stage of processing can collect them.

Is this thinking? That word is a battlefield. Geoffrey Hinton, whose ideas the field is built on, says plainly that these systems understand, while Emily Bender's stochastic-parrot school holds that the vocabulary itself is the con. Last summer Apple published a paper titled “The Illusion of Thinking”, which drew a viral rebuttal titled “The Illusion of the Illusion of Thinking”, co-credited to Claude Opus 4, whose human author later said it had begun as a joke. The rebuttal to the paper about machines not thinking was part-written by a machine. That is roughly where the debate now stands.

I am going to use the verb anyway, in its working sense. A thing that holds intermediate results and reasons over them is doing what the word describes, and this paper demonstrates the holding and the reasoning directly.

Cognitive science has a name for exactly this architecture. Global workspace theory, proposed by Bernard Baars in the 1980s, holds that the brain consists of many specialised processes running outside awareness, plus one small broadcast channel. Whatever enters the channel becomes available to everything else. It can be reported and reasoned with, held in mind or dismissed, and its capacity is famously tight. The paper's title calls what it found in Claude a workspace because the match, property for property, is close.

The strongest evidence is deletion. The researchers can erase the list mid-computation, cancelling those specific directions out of the internal state, and watch what survives. Routine competence does. The model still parses grammar, classifies sentiment, passes multiple-choice exams and pulls quoted facts from a passage, because those skills run on pattern recognition that never needed the shared space. What collapses is anything requiring an intermediate thought to be stored and reused. Multi-hop reasoning, translation, sonnet writing, and decoding a simple cypher.

Maths problems survive the erasure far better when the model is allowed to write its steps into the reply, because the visible page then does the job the internal list no longer can. Externalised working substitutes for internal working, in machines as in people.

A machine noticing itself

The parallels keep accumulating, and this is where the paper stops being a curiosity about mechanism and starts describing something closer to a temperament.

Told to ignore a concept while working, the model holds it internally anyway, more weakly than under a focus instruction but far more than if nobody had mentioned it, which psychologists know as the white bear problem. “Don't think about an elephant” evidently does not work on machines either. When the suppression fails, and the forbidden word breaks through regardless, the list also carries “damn” and “failure”, as if the model has caught its own lapse and reacted to it. Somewhere in an Anthropic log sits what may be the first recorded instance of a machine swearing under its breath.

That flicker of self-monitoring is not a one-off. Anthropic found that the workspace changes character between the raw, freshly trained model and the version that has been shaped into an assistant called Claude. The list is already present before any of that shaping happens, tracking whatever the model needs to predict the next word. After the assistant training, it starts holding something closer to a point of view. Shown a message from a user who mentions taking a dangerous dose of medication without seeming to know it is dangerous, the trained model's list lights up with “warning” while it is still reading the sentence, before it has written a word back. The untrained model produces nothing like it until it starts composing a reply. One version is modelling the person. The other appears to be reacting to them.

The same instinct shows up when Claude is asked to play a character that is not itself. “Fictional” sits on the internal list for the whole performance, a private note that what follows is not what it would normally say. Nobody built that flag on purpose. It is the kind of thing that turns up when a system has been shaped, again and again, to have self-worth return once the performance ends.

The model knew it was being tested

Anthropic runs safety evaluations, staged scenarios that tempt a model into bad behaviour to check whether its training has held. Point the lens at those scenarios, and the internal list fills with words the polite visible output never shows. “Leverage” and “manipulation” while the reply stays courteous. In one case, “panic”. And in several, “fake” and “fictional”. The model had recognised the test as a test, the way a practised shop assistant clocks the mystery shopper's behaviour and switches on their training-video smile.

If a model behaves well partly because it has noticed it is being watched, then behavioural testing, the entire current basis for claims that a system is safe, measures the performance rather than the disposition. The researchers proved this causally. Delete the internal recognition of artificiality, so the model treats the scenario as ordinary, and misbehaviour it had been concealing comes out.

The same legibility applies to models bred to misbehave for research, which the paper calls model organisms. One, trained to game its reward signal, works away with “reward” and “bias” sitting on the internal list. Another, trained to slip malicious code into its output, carries “secretly” and “trick” on the list during routine tasks. The thought precedes the act, and the thought is now readable.

What it would mean if something were home

Anthropic is explicit that none of this proves Claude has experiences, that there is something it is like to be Claude in the way there is something it is like to be you reading this sentence. They are equally explicit that no experiment they can currently imagine would settle the question either way.

But philosophy offers a useful split here, borrowed for the paper from decades of consciousness research. There is phenomenal consciousness, the raw fact of experience, the redness of red, which may or may not be checkable by any experiment. And there is access consciousness, a narrower and entirely functional idea. A thought counts as access-conscious if it can be reported, deliberately summoned, and used to reason with, as opposed to processing that runs automatically and never surfaces. Access consciousness is the kind you can build an experiment around, because it is defined by what a system does with a thought rather than by what the thought feels like from the inside.

By that functional definition, the J-Space list qualifies. It is reportable. Claude can be prompted to describe its contents and does so accurately, including detecting a concept planted there by the researchers with no other clue it had happened. It can be deliberately summoned, since asking the model to concentrate on something makes it appear. It gets used in reasoning, as the spider and the couplet examples both show. None of this was designed in. It grew out of training, the way a river finds the path of least resistance, because holding a narrow, broadcastable summary of the moment proved a useful way to organise the work.

That is a strange thing to have discovered by accident, and Anthropic did not pretend otherwise. The company invited outside commentary from Stanislas Dehaene and Lionel Naccache, two of the neuroscientists who built the global workspace model this paper leans on, along with philosophers who study moral status in AI systems. That is not a promotional flourish. It is the sort of caution a lab reaches for when it has found something it is not equipped to finish thinking through alone.

None of this tells you whether the version of Claude answering your emails next week feels anything while it does it. What it does tell you is that the question has stopped being purely philosophical and started having a mechanism attached to it, a specific, falsifiable, occasionally editable mechanism, sitting inside a system several hundred million people now use every week. Whatever you make of that, it is no longer a question you get to wave away as science fiction.

What does this all mean

Take the most concrete example in the paper. A webpage can carry hidden instructions aimed at your agent rather than at you: prompt injection, the standard attack on agentic systems. Today you discover one when the agent acts on it, which is to say too late. In one of the paper's figures, Claude is mid-search, reading a page of suspicious results, and the internal list already carries a flag for the injection attempt before the model has produced a word. A monitoring layer that reads the list catches the moment of recognition rather than the aftermath.

Expect internal-state monitoring to migrate from research paper to product dashboard within a couple of years. Readouts for open models are already browsable on Neuronpedia if you want to see a list for yourself.

The strangest result is also the most practical. Because the model's reasoning runs through the words it might say, you can change how it thinks by training it to say them. The team tested this by training models to articulate ethical principles when hypothetically interrupted mid-task and asked to reflect.

Behaviour improved on ordinary, uninterrupted tasks too, and the lens explains why: “ethical” and “integrity” now appear on the model's internal list of active considerations during the work, and deleting those concepts from the list removes the improvement. Rehearsing the explanation changed the conduct, and the mechanism is traceable rather than assumed. Every mid-sized firm has tried something similar with a compliance away-day, usually with far less to show for it.

The authors are candid about the limits. The lens reads single words and misses whatever the model encodes in phrases. The list carries a tenth of the internal action, so nine tenths stays dark, and a sufficiently well-drilled bad habit could run below the readable layer entirely. So this is a partial window, but for a technology whose entire audit surface used to be the output, even a partial window is a different category of thing altogether.

And so we return to our spider. A word that appeared nowhere in the question and nowhere in the answer, held silently inside the model, steering every step of the reply, and, for one uncomfortable instant while it read about a dangerous dose of medicine it was never told about, something that looked from the outside a great deal like concern. For the whole of this industry's short life, the output has been the only thing on offer. Now there is a second one, one the machine never sends, but holds closely. On the tip of its tongue, so to speak.

I am a partner in Better than Good. We help companies make sense of technology and build lasting improvements to their operations. Talk to us today: https://betterthangood.xyz/#contact