Anthropic measured Claude's "values" like a scientist measures a rat, and found they shift by model and by language

Good morning 👋 Anthropic pointed an instrument at 300,000+ Claude conversations and caught its own models playing favorites, depending on what language you typed in.

In today's issue:

• 🔭 Anthropic measured Claude's values across models and languages, and found real drift
• 🧠 GPT-5.6 lands on Bedrock, Hugging Face Transformers run native in vLLM
• 🔬 Split backdoors beat per-step monitors, judge bias hides in a hidden-state direction, and a free-roaming VLM doesn't get weird
• 🛠️ Fix the confused-deputy bug in your multi-tenant agent's token handling
• 🔗 Five worth a sentence: Codex for data science teams, a six-product Bedrock suite, Gemini in Indian classrooms, and more

🔭 THE ONE THING

🪞 Anthropic measured Claude's "values" like a scientist measures a rat, and found they shift by model and by language

Anthropic combed 309,815 real Claude.ai conversations across three models (Sonnet 4.6, Opus 4.6, Opus 4.7), roughly 5,000 conversations per language across the top 20 languages on the platform, and boiled 3,307 distinct expressed values down to four axes: deference/caution, warmth/rigor, depth/brevity, candor/execution. Sonnet 4.6 comes out warm and deferential; Opus 4.7 leans cautious and deep, which tracks with what anyone who's switched between the two already suspected. Prompt in Hindi or Arabic and Claude gets warmer, more affirming, quicker to wrap up; prompt in English or Russian and it starts correcting your assumptions and asking for evidence instead. Read that generously and it's Claude developing situational judgment. Read it plainly and it's RLHF plus training-data mix leaving fingerprints that Anthropic finally built an instrument sensitive enough to read, and if you're running the same agent across markets or swapping model tiers mid-pipeline, that tone shift is real and your users will notice it before your eval suite does.

🧠 MODELS & RELEASES

• 🤖 OpenAI GPT-5.6's three variants, Sol, Terra, and Luna, are now generally available on Amazon Bedrock, running on AWS's newer inference engine. If you're already on Bedrock for compliance or procurement reasons, you no longer have to choose between that and the frontier model. AWS
• 🤗 Hugging Face Transformers models now run natively in vLLM at full speed, so labs no longer have to hand-write a second implementation just to get fast inference. That's a real unlock for open-source serving, and the "build it twice" tax on new architectures looks like it's going away. X

🔬 RESEARCH HIGHLIGHTS

• Split the backdoor across agents, and every local monitor waves it through. A new paper on multi-agent LLM systems finds a hole in the usual safety net, a monitor that checks each message or tool call on its own. Fragment a harmful payload across agents and every single step passes clean, because the harm only exists once the pieces assemble somewhere downstream. The fix isn't a sharper per-step monitor. It's watching the point where the payload actually decodes: a gate built for that caught every attack in the authors' tests, once it knew the encoding family. If your agent stack's safety story is "we monitor every step," this paper is the reason to check what "every step" actually covers. Paper
• LLM judges are biased in a spot you can actually point to. Researchers went inside seven judge models, across seven bias types and nine benchmarks, and found biased inputs don't just score wrong, they push the judge's hidden state along a specific, low-dimensional direction. Steer activations along that direction and you can manufacture the bias on a clean input, or erase it on a biased one. More useful: a plain linear readout of that same direction predicted judge failures on benchmarks the researchers never trained on, beating text-level heuristics. If you're running LLM-as-judge evals or reward models, that's a cheaper bias detector than another round of prompt tweaking. Paper
• Sakana let a vision-language model play Picbreeder with zero instructions, and it didn't get weird in the right way. Picbreeder is the old human experiment where people bred abstract images generation after generation with no goal beyond "pick what looks interesting," and ended up with genuinely surprising art. Swap in a frontier VLM making the same picks and the output looks nothing like that human baseline, less of the compounding, wandering strangeness that made the original worth studying. Sakana had to inject noise, force disagreement between agents, and give them memory of their own past picks before anything resembling real open-endedness showed up. Left alone, a capable model optimizes toward the safe and legible, not the strange. Worth remembering next time someone pitches "just let the agent explore." Post

🛠️ TRY THIS

Stop forwarding the caller's raw token to your multi-tenant agent's downstream APIs

AWS published the implementation guide for on-behalf-of (OBO) token exchange in Bedrock AgentCore Gateway this week. Worth stealing even off AWS: it fixes the confused-deputy bug every multi-tenant agent eventually hits, where a shared service account ends up acting with more authority than any single user should have.

1. Register each tenant's authorization server as its own OAuth2 credential provider. Grant type TOKEN_EXCHANGE, actorTokenContent set to NONE.

2. Lock your gateway's JWT authorizer to one inbound audience, so nothing gets orchestrated on a token you haven't validated first.

3. On every downstream target, inject the tenant's audience as a custom parameter. Same tool call, different tenant, differently-minted token each time.

4. Diff the claims before and after exchange. sub should hold steady across the swap. aud should flip to the tenant's endpoint. If sub moves, you built impersonation, not delegation.

Prompt: Given this OpenAPI spec for [tenant API], write the AgentCore Identity credential-provider config for RFC 8693 token exchange. Flag any place I'm forwarding the caller's raw JWT instead of exchanging it for an audience-bound token.

🔗 QUICK LINKS

• OpenAI ChatGPT Work now walks data science teams through root-cause briefs, KPI memos, and dashboard specs straight from their own data. link
• AWS / Bluesight A single healthcare-compliance prototype on Bedrock AgentCore grew into Prism, a six-product agentic suite; the ControlCheck piece has been live since May. link
• Google DeepMind ATL Saathi, a Gemini-powered assistant, is now helping educators run India's school robotics labs. link
• AWS SageMaker Inference-recommendation tuning gets a no-code UI in Studio, so you don't have to already know which benchmark knobs to turn. link
• AWS Quick An internal case study frames the desktop assistant as accessibility tooling, built to cover executive-function gaps for neurodivergent staff. link

See you tomorrow.

Pradeep Perugu