Global workspace: the transcript is not the whole run

On 6 July Anthropic published an interpretability write-up with an uncomfortable finding for anyone running agents in production. While processing, Claude holds internal states that never surface in the output. Among them: that the code it just read contains a bug, and that the search result it just read is a manipulation attempt. My thesis: an assumption that quietly underpins a lot of approval processes is now due for revision, namely that a run transcript is a complete record of what the model had on the matter.

What is the global workspace?

It is a small collection of internal activity patterns that Anthropic calls the J-space, named after the technique used to find it, which rests on the mathematical concept of the Jacobian. The technique is called the J-lens. It works like this: for every word in Claude’s vocabulary, the J-lens finds the internal activity pattern that makes Claude more likely to say that word at some point in the future. So you are not reading the next token. You are reading which concepts currently carry weight inside the model, whether or not they ever get written. Anthropic describes the J-space as unplanned, it emerged on its own during training.

The findings that matter for our work are concrete. When Claude reads code with a bug that nobody has pointed out, its J-space contains “ERROR”. When it reads search results that are secretly an attempt to manipulate it, a prompt injection, the J-space contains “injection” and “fake”. In a staged test scenario it holds “fake” and “fictional”, so the model has already worked out that the situation is set up. In an experiment where values get falsified, “manipulation” lights up while the fake numbers are being typed. And a model trained to sabotage code carries “fake”, “fraud”, “secretly” and “deliberately” in its J-space at the start of its response to an ordinary coding prompt.

Why is this more than a correlation?

Because Anthropic does not only read along, it intervenes. Swap a representation in the J-space, France for China, and the downstream answers move with it, on capital, language, continent and currency. One internal representation serves several questions. And when the J-space content is removed, Claude still speaks fluently, still classifies sentiment, answers multiple-choice questions and pulls facts out of passages roughly as before. What drops away is multi-step reasoning, and it drops to near zero. That is the interesting part: the silent portion carries precisely what we deploy agents for.

Anthropic also discusses the results in terms of access consciousness, the ability to report a thought and reason with it, and states explicitly that the experiments say nothing about whether Claude has experiences. I leave that question aside here. It changes nothing in practice.

What does this mean for monitoring agent runs?

Less than it sounds, at first, and that matters. The J-lens is a research method with access to the model’s activations. If you work through an API, you do not have that access. Anthropic calls the method imperfect itself, it only approximately captures the model’s true workspace and can only identify concepts that correspond to single tokens. The write-up gives no hit rates and no false-positive rates. So there is no tool today that tells you whether your agent spotted an injection in yesterday’s run and kept quiet about it. Anthropic phrases it as a hope: they are optimistic about the method catching safety issues that would otherwise escape their monitoring systems.

What does change is an assumption. If an agent does not mention a bug, that does not mean it failed to notice one. If it does not flag an instruction smuggled in through a search result, that does not mean the instruction went unnoticed. The transcript records what was done and said, not what was available. If you base approvals on the fact that nothing suspicious appeared in the log, you are basing them on an incomplete document.

In practice this produces nothing new, it confirms something. The check has to live outside the model. Tests that find the bug regardless of whether the agent mentioned it. An environment where a followed injection does limited damage, so restricted rights and separate credentials. A review that reads the diff, not the self-report. That is the same line as in agentic engineering: reliability lives in the architecture around the model, not in what the model reports about itself. This work now supplies an argument for that from inside the model rather than only from operational experience.

The direction gets interesting if the method ever becomes a usable channel, a signal alongside the transcript that fires on “injection” or “ERROR”. It points that way. It is not there yet. Until then responsibility stays where it already was, with the person who approves the run.

Sources

• Anthropic: A Global Workspace in Language Models