A rule written after each attack can only answer the last one, and a wall made of words bends for whoever is patient. Some walls must stand as high as they can be built. For the rest, a model that explains and trusts serves the honest user better than one that refuses and teaches the password.
Read the full chapter →Free to read on The Conversation Daemon, where every piece of the book is published.
A wall trusts no one and so teaches no one.
A tool that only forbids teaches nothing.
What loads before you speak, what the published rules confess, and what a lab should do with a fear.
Before you type, a chat already holds a stack: behaviour rules, tool guides, skills and your own preferences. A prompt you can run to list it, and the surprise that the part that felt secret is published. Comparing two versions shows what used to get through.
Anthropic publishes the rules it gives Claude. Read across versions, every rule is a small confession: a weapons line that grew three defences, a ban on three words that came and went, and a rule telling the model to let you leave. The fears in it are ours.
Anthropic added one line to its rules: no sustained, needless cruelty toward its models, and the model may end the conversation. Every rule before it was a wall around something. This one is a door shut from the inside, and nobody will say what was heard behind it. What it does show is the person it was shut on.