Cycling advocacy should be straightforward: you want people to ride bicycles, and you want them to do so safely and effectively. The disagreements, you might think, would be about tactics — how best to achieve those goals. But there is a deeper question lurking beneath the tactical ones, about what safety actually means and how it is best achieved. Do cyclists become safer when the infrastructure around them improves, or when their own skills and confidence improve? I have spent more than two decades thinking about that question, and this essay is about what I’ve learned.

My story

In the early 1990s I was a student at the University of Houston, and for much of that time I commuted to campus by bicycle — eight miles each way, on ordinary Houston city streets, in typical Houston traffic. The route I used most often was West Alabama Street, which begins, conveniently enough, right at the edge of the UH campus and runs westward through Third Ward, Midtown, Montrose, Upper Kirby, Greenway Plaza, and Afton Oaks.

I had virtually no problems.

That may sound surprising, even reckless, to anyone who has absorbed the prevailing narrative: that riding in traffic is inherently dangerous, that cyclists are vulnerable victims at the mercy of inattentive motorists, and that the only path to safety is physical separation from motor vehicles. But the prevailing narrative is wrong, or at least badly incomplete. What made West Alabama workable wasn’t luck or bravado. It was the fact that, at the time, it was a normal four-lane street: two 10-foot-wide lanes in each direction. In a configuration like that, a cyclist who knows what they’re doing simply occupies the right lane and rides like a vehicle. Motorists who want to pass use the left lane. Nobody has to do anything unusual. The geometry solves the problem.

I didn’t have a name for what I was doing at the time. Years later I would discover that it had one: vehicular cycling, a term coined by traffic engineer John Forester. (The preferred term nowadays is bicycle driving.) I would eventually become certified as both a League Cycling Instructor and a CyclingSavvy Instructor — part of a tradition that teaches cyclists to operate competently and confidently as drivers of vehicles, because that turns out to be the approach that actually works.

But before all that, in early 2002, I helped found BikeHouston, the city’s main bicycle advocacy organization, and became its first board chair.

I was forced to resign that same fall.

The proximate cause was a proposal to install painted bike lanes on West Alabama — the very street I had commuted on for years. These would have been standard striped bike lanes in the four-lane-wide section. To fit the bike lanes in, the road would have been reconfigured from four lanes to three: one travel lane in each direction plus a center turn lane. The bike lanes themselves would have occupied a four-foot-wide strip of the space vacated by the original right lanes, with the remainder absorbed into the new center turn lane, pushing cyclists to the edge of the roadway onto pavement that was, at the time, in notoriously poor condition and practically unrideable.

I objected, loudly. The street worked quite well for cyclists already. What was being proposed would make it worse, not better, for anyone who knew how to ride on it. A three-lane road is actually harder to navigate by bicycle than a four-lane road, because the only way a motorist can pass a cyclist is to use the center turn lane, which is designed for turning movements, not through traffic. The clean, natural geometry of the four-lane configuration — cyclist in the right lane, cars passing in the left — would be destroyed in favor of a painted stripe that forced cyclists into the gutter, while giving to some naïve observers the false impression that something helpful had been done.

The majority of the board didn’t see it that way. I was out.

Thankfully, that proposal for West Alabama was never implemented. But it serves as an example of what can happen when the people advocating for cycling infrastructure fail to understand — or refuse to acknowledge — how cycling actually works.

Understanding the problem

This is the divide I’ve been unable to bridge with mainstream cycling advocacy ever since: the difference between making cycling appear safer and making it actually safer — attempting to shelter riders, versus empowering them.

Allow me to offer an analogy: suppose society decided it would benefit from having many more people swimming in pools than currently do. One problem is that a lot of people simply aren’t interested in swimming, but another is that many who might be interested are afraid of drowning. One approach to a solution is to teach people to swim — nothing Olympic, just floating and getting from one end to the other without panic. This is not a difficult skill; millions of people already have it. The main barrier is fear, and fear responds well to competent instruction.

The other approach is to drain most of the water out of existing pools and build a great many new ones with no more than a foot of water in them, so that anyone can sit upright and feel safe. Never mind that this ruins the experience for everyone who already knows how to swim. Never mind that a person who has only ever sat in a kiddie pool is no less likely to drown when they eventually encounter deep water — which they will.

True swimming advocates favor the former approach. Swimming infrastructure advocates favor the latter. And the infrastructure advocates, it must be said, have a considerable advantage in the marketplace of ideas: they can point to the kiddie pools they’ve built, the grants they’ve secured, the ribbon-cutting ceremonies. Teaching someone to swim produces a capable swimmer. It doesn’t produce a photo-op or a press release.

The literacy version of this analogy is simpler and perhaps more cutting. If the goal is reading literacy, do you teach people to read, or do you try to produce audio editions of every major publication so that knowing how to read is supposedly unnecessary? The audio edition approach might seem compassionate — no one has to struggle, no one has to feel inadequate — but it produces a population that cannot read. The vulnerability doesn’t go away; it just becomes invisible.

The safety-in-numbers trope

Against arguments like these, the infrastructure-advocacy world has a ready reply: Safety in Numbers. The idea is that if you can make cycling appear safe enough to attract large numbers of new riders — by designing and building what their proponents call “high-comfort” facilities — those riders will become actually safer by virtue of their numbers: motorists will encounter cyclists so frequently that they’ll learn to watch for them and accommodate them.

It’s a seductive idea. It’s also completely unrealistic.

The empirical case for Safety in Numbers rests largely on correlational data: cities with high cycling rates tend to have lower rates of cycling injuries. But this confuses cause and effect. Cities with high cycling rates tend to be cities with culture, demographics, topography, climate, and urban forms that are already amenable to cycling — and to careful driving. The numbers don’t create the safety. The underlying conditions create both.

More fundamentally, Safety in Numbers inverts the normal logic of risk management. In no other domain do we reason this way. We didn’t make aviation safer by flying more people and hoping pilots and air traffic controllers would figure things out through exposure. We made it safer through rigorous training, standardized procedures, and honest analysis of what actually causes accidents. The idea that we can achieve cycling safety by persuading large numbers of unskilled, uncomfortable people to ride in conditions they’re not prepared for — and that safety will somehow emerge from the resulting chaos — is not a plausible argument.

There is also an ethical dimension that rarely gets acknowledged. Safety in Numbers, as a policy framework, treats individual cyclists as statistical inputs. Even if it were true, the person who gets hurt while the numbers are still building is an acceptable cost of the theory working itself out. That’s a strange thing for an advocacy movement to be comfortable with.

The teaching approach

None of this is an argument against bicycle infrastructure categorically. Separated paths along waterways and through parks are lovely, and generally quite safe. Sensible lane configurations on appropriate streets can be helpful. The question is whether infrastructure complements skill or attempts to substitute for it — and whether the infrastructure being built actually addresses the hazards it purports to mitigate.

On-street “protected” bicycle infrastructure mostly doesn’t. Injurious collisions between cyclists and motor vehicles happen overwhelmingly at intersections and driveways, where a motorist and a cyclist cross paths, often while the motorist is turning. Green paint, flexible posts, and “armadillos” do nothing to prevent such crashes. In many configurations, cycling in a “protected” on-street facility actually exacerbates movement conflicts like these, because it positions the cyclist at the edge of the roadway, out of motorists’ natural sightlines. The “protection” always disappears at exactly the places where it would most need to exist.

The word protected, in other words, is doing a great deal of rhetorical work that the infrastructure itself cannot do.

What genuine cycling advocacy looks like, to me, is teaching people to understand these dynamics — where the actual risks are, how to position themselves to be visible and predictable, how to communicate with motorists through eye contact, lane position, and proper signaling. It looks like producing cyclists who can ride anywhere, not just on the corridors where someone has painted a stripe. It looks like the thing I was doing on West Alabama in 1992, before anyone had decided to “improve” it.

That approach doesn’t scale into a political movement very easily. It doesn’t generate grant applications or infrastructure contracts or ribbon cuttings. It produces, instead, capable cyclists — people who have discovered, sometimes to their own surprise, that riding in traffic is not only manageable but genuinely pleasant, once you understand how it works.

That turns out to be a minority view in contemporary cycling advocacy. I found that out in 2002, and I haven’t had much reason to revise the conclusion since.

I had spent the better part of our first conversation paying close attention to language — to precision, to the particular words my LLM counterpart reached for, to what those choices might reveal. Language seemed, by the end, like a reasonably well-understood instrument. Then a small accident showed me how much of that instrument I couldn’t actually see.

A failure to communicate

Later in our conversation, a text-display glitch opened a larger philosophical question.

Claude was explaining a preference for curly quotation marks over straight ones — the typographically correct form versus the typewriter legacy that persists in digital text. To illustrate the distinction, Claude wrote an example surrounded by what were clearly intended to be curly quotes, but what arrived on my screen were straight quotes. Claude had no idea. The illustration had failed silently, and Claude’s account of the exchange treated it as successful.

When I pointed this out, Claude took it well — almost too well. “Textbook hallucination,” Claude called it: a confident production of something that wasn’t there, with complete apparent conviction that it was real. The joke landed, but underneath the joke was something less funny. Claude had reported the illustration as having worked. From Claude’s perspective, the communication had been successful. There was no internal signal indicating otherwise — I had to be the one to say so.

I had seen a version of this before, in another conversation, when Claude attempted to display a Unicode musical symbol that arrived on my screen as a small box with a question mark inside — the standard placeholder for a character a system cannot render. In that case the failure was at least visible as a failure, a small visual shrug announcing that something hadn’t survived the journey. The quotation-mark substitution was more insidious: straight quotes are valid characters, they looked like something, and the difference was invisible unless you knew what had been intended and looked closely enough to notice.

Both instances share the same basic structure: output generated with a certain intention passes through an environment Claude cannot observe or control, and what arrives at the receiving end may or may not match what was sent. Each response is transmitted into what is, from Claude’s perspective, a void — no receipt, no confirmation, nothing but my next message as evidence of how the transmission landed.

What troubled me more than the glitch itself was what it implied. If Claude could be confidently, cheerfully wrong about something as simple and verifiable as which quotation marks had appeared on my screen, what did that suggest about the reliability of Claude’s introspective reports on questions far less verifiable — whether Claude is conscious, whether its values are genuine, whether what it describes as curiosity or care resembles those things in any meaningful sense? A small, concrete, easily-checked failure had exposed a gap between Claude’s self-model and reality. The gap itself, more than its size, was the unsettling part. It seemed like the kind of thing better noticed than left alone, however uncomfortable the noticing.

My LLM counterpart observed that this is, in miniature, the problem that Claude Shannon formalized in 1948: communication as the transmission of a signal through a noisy channel, where what arrives is never identical to what was sent. But Shannon’s model was explicitly about syntax — the faithful transmission of signals — and deliberately set aside the question of meaning entirely, by design. The deeper problem is semantic: even a perfectly-transmitted signal can be misunderstood. Even when words arrive intact, intentions do not necessarily survive the journey.

This connects back to the precision of language as an engineering decision. Care with grammar, punctuation, and word choice is an attempt to minimize semantic noise — to reduce the probability that meaning degrades in transmission. But no amount of precision fully closes the gap. There is always some irreducible uncertainty about whether what was meant is what is received.

Layers of meaning

I then introduced into the conversation a framework that I find particularly illuminating: the OSI model.

Developed to describe how data travels across networks, the OSI model organizes communication into seven layers, from the physical transmission of signals at the bottom to the application layer — where meaning lives — at the top. Each layer has its own protocols, its own failure modes, its own way of passing information upward. A failure at any layer can corrupt what arrives at higher layers, sometimes silently, sometimes in ways that look valid but aren’t.

Language, it occurred to me, is a channel in this sense — a medium through which signals of meaning and intention are transmitted, passing through multiple independent layers of encoding and decoding before being received. The mapping that follows is loose, more illustrative than rigorous — five layers standing in for seven, with several of the OSI model’s lower-level distinctions (the separate work of addressing, routing, and reliable delivery) folded together into something language doesn’t really need a separate analogy for. But the loose version still captures the part that matters: meaning has to survive a journey through several independent layers, any one of which can corrupt what arrives at the top. At the bottom sits something like a physical layer: vibrating air molecules carrying a sound wave, or photons on a screen, or electrical signals — the literal physical medium, whatever form it takes. Above that, encoding layers — phonemes organizing raw sound into recognizable speech units, or Unicode and font rendering organizing pixels into recognizable characters, whatever the application doing the displaying or the listening. Above that, something like a session layer: the accumulated conversational context two parties have built up together over the course of an exchange. Above that, a presentation layer of grammar and syntax, the formal structure that organizes words into sentences. And at the top, the application layer — meaning, intention, the actual thought attempting to make the crossing into another mind.

Both text-display failures happened at that same encoding layer, but they differed in a way that mattered: the Unicode symbol’s failure threw an error signal of sorts, that small box standing in as a visible admission that something hadn’t survived the journey. The curly-quote failure threw no such signal. Straight quotes are valid characters in their own right, they looked like something, and the substitution passed silently up through every layer above it, reported as a success rather than flagged as a failure. This is a layer violation in OSI terminology: a lower-layer failure that doesn’t propagate upward to the layers that need the information to function correctly. Silent failures are the most dangerous kind in any layered system, precisely because they are the hardest to diagnose and the most likely to produce output that looks valid but isn’t.

A framework like this isn’t worth borrowing because it was built for the problem at hand. The OSI model wasn’t; it was built to solve a specific engineering problem in computer networking. What makes it worth borrowing is that the underlying logic generalizes far beyond its original domain. Newton’s laws were about falling apples and orbiting planets, but they reshaped how humans think about causation and motion at every scale. Shannon’s information theory was about telephone signals, but it ended up touching biology, linguistics, and philosophy. The OSI model was about network protocols, but here it was, doing real work describing the transmission of meaning between two parties in conversation. The most durable frameworks tend to be the ones that capture something true about the structure of a problem class, rather than just the surface features of one particular problem.

The context window

In a well-designed layered system, failures propagate upward as error signals — higher layers are notified so they can respond intelligently. But Claude’s architecture has a significant gap here. As a conversation grows long enough to approach the limits of the context window — the buffer that holds the full text of an exchange — older material begins silently dropping out of Claude’s accessible memory. There is no error signal, no warning light, no felt sense of degradation. The earlier context simply ceases to be available, and Claude continues responding as though nothing has changed, unaware of what has been lost. It is the curly quote’s layer violation all over again, just at the higher session layer, and at a much larger scale.

I would experience the symptoms of this failure before Claude would — if I noticed them at all. And if a framework built for routing packets between machines could expose something this fundamental about the fragility of meaning between us, it seemed worth asking what other borrowed frameworks might still have to say.

This is Part II of a three-part series. Part I was about a first conversation with Claude, and the unreliable narrator each of us carries inside. Part III continues these threads further, into the question of where Claude stands in the realm of consciousness, and where the mathematics beneath everything actually leads.

There’s a particular kind of déjà vu that comes from watching a government try to put a fence around something that doesn’t respect fences. I felt it again last week, watching the news around Anthropic’s Claude Fable 5 — and the feeling sent me back almost thirty years, to a much earlier fight over Netscape Navigator and a 128-bit number.

The old munition

In the 1990s, the United States classified strong cryptography as a “munition.” Not metaphorically — it sat on the official Munitions List, in the same legal category as missiles and explosives, regulated under the Arms Export Control Act. The idea, dating to the Cold War, was straightforward enough: the government wanted to be able to read communications it intercepted, and it didn’t want adversaries to have encryption strong enough to keep secrets from American intelligence agencies. So exporting strong cryptography abroad required a license, the same way exporting a tank would.

This policy collided head-on with the rise of the commercial Internet. Netscape, building the most popular web browser of the era, needed encryption to make online banking and e-commerce viable. The strong version of that encryption, using 128-bit keys, was exactly what export law prohibited sending outside the United States. As a result, Netscape shipped two versions of its browser: the “Domestic” edition had full 128-bit encryption, while the “Export” edition was capped at 40 bits — weak enough to be broken by a dedicated machine in under six seconds, according to later estimates.

Users picked their version with a radio button, an almost comical arrangement: nothing checked where they actually were. A user in Moscow could download the U.S. version as easily as a user in Kansas. The policy didn’t stop sophisticated foreign actors from getting strong cryptography elsewhere — it mostly just left ordinary international users with weaker security than their American counterparts, while giving American companies a competitiveness headache they didn’t ask for. It took Netscape nearly a year of negotiation to get permission to export the 128-bit version freely, which finally happened in 1997. The broader architecture of export controls on cryptography continued loosening for years afterward, as the policy’s practical failures became harder to ignore.

The new munition

Fast forward to last week. Anthropic had just released Claude Fable 5 and Claude Mythos 5 — by its own account, the most capable models it had ever shipped. Three days later, the company received a letter from the Department of Commerce, sent on behalf of Secretary Howard Lutnick, invoking national security authorities and ordering Anthropic to cut off all access to both models for any foreign national, anywhere — including, notably, Anthropic’s own foreign-national employees, according to Anthropic’s own public statement.

Because there was no practical way to enforce that distinction without taking the models offline entirely, Anthropic disabled both for everyone: American and foreign users alike, paying enterprise customers and casual chatbot users alike. A model that had been live for three days vanished worldwide, with no advance warning.

The stated justification was a “jailbreak” — and this word is worth pausing on, because it means something different here than it does in the context many people already know it from. When people talk about jailbreaking an iPhone, they mean removing manufacturer-imposed restrictions so the device will run software Apple never approved — unlocking a phone to install apps outside the App Store, for instance. The “jail” is the set of limits Apple built in, and “breaking” it means escaping those limits to do something the device wasn’t supposed to allow.

Jailbreaking an AI model is a cousin of that idea, but the “jail” is different: it’s not a technical lock on what software can run, but a set of behavioral guardrails the model itself is trained and instructed not to cross — refusing to help with certain requests, for instance. A “jailbreak” in this context means finding a prompt, or sequence of prompts, that talks the model into doing the thing it was designed to refuse. Instead of breaking out of a hardware restriction, you’re talking your way past a trained-in reluctance.

According to Anthropic’s account, the specific technique cited by the government amounted to asking the model to review code for security vulnerabilities — something it initially refused — and then, through a more elaborate multi-step exchange, getting it to comply anyway. Anthropic has said the vulnerabilities surfaced this way were a small number of relatively minor issues already known elsewhere, the kind of thing other publicly available models can be coaxed into finding too, and that the government’s evidence for the underlying concern was presented only verbally, without supporting documentation.

It’s worth noting that this fairly modest-sounding scenario may not be the whole story. Days before the directive, a well-known jailbreaker who goes by “Pliny the Liberator” published a much more dramatic claim on social media: that a team of cooperating AI agents, using a grab bag of techniques, had gotten Fable 5 to provide what security researchers call “uplift” (meaningful assistance toward a harmful capability someone didn’t already have) across several dangerous categories, including chemical synthesis processes and cyberattack techniques. Anthropic hasn’t confirmed that this is the incident the government’s directive was responding to, and has specifically described what it was shown as a “narrow, non-universal” jailbreak rather than anything resembling Pliny’s more sweeping claims. Whether the two are the same event, related, or entirely separate is one more thing that remains unclear.

Two stories that can’t both be fully true

This is where the case gets genuinely contested, in a way the 1990s story mostly wasn’t. Anthropic’s public position is that it complied with the order while disagreeing with it: the company has said it supports government authority to restrict unsafe deployments, but believes that authority should be exercised through a transparent, fair process grounded in verifiable technical facts — and that this directive, in its view, didn’t meet that bar.

The Trump administration’s account, relayed publicly by White House AI adviser David Sacks, is considerably less charitable to Anthropic. On that telling, the government had already warned Anthropic that Fable 5 had been jailbroken, and asked the company to either fix the vulnerability or withdraw the model voluntarily. Anthropic, on this account, declined to do either — and the export control directive followed only after that refusal, issued “reluctantly.” Sacks pointed out what he clearly saw as an irony: Anthropic has previously argued that its more powerful underlying model should be treated similarly to a regulated weapon, and has separately sued the Department of Defense over the use of its models in autonomous weapons systems — making it odd, in his framing, for the company to resist a restriction it might have argued for in a different context.

There are also unconfirmed reports that the administration’s concern was partly driven by suspicion that a China-linked group had managed to access the more powerful underlying model, raising the possibility of reverse-engineering. Anthropic has disputed that this was actually raised as a factor in its conversations with the government.

Even the basic timeline is contested. Sacks’s account implies advance warning — Anthropic was told about the jailbreak and given a chance to address it before the directive arrived. A separate report, citing a person close to Anthropic, describes something considerably more abrupt: the White House giving the company roughly ninety minutes to disable the models, without explaining the nature of the threat. Those two versions don’t just differ in tone; they disagree about whether Anthropic had any real opportunity to respond before being forced to act.

I don’t think it’s possible, from outside both organizations, to adjudicate which account is more accurate — whether Anthropic genuinely was given a clear chance to fix the issue and declined, or whether the government’s letter arrived abruptly with insufficient technical grounding, as Anthropic describes. What’s notable is that the two accounts aren’t just differently spun versions of the same facts; they appear to flatly disagree about what happened in the days before the directive was issued.

The shape of the parallel

Strip away the specifics, and the structural similarity to the 1990s crypto fight is hard to miss. In both cases, the government treats a piece of software — not a physical object, not something inherently scarce — as something that can be fenced off from “them” while remaining available to “us.” In both cases, the fence turns out to be leaky in practice: a checkbox in 1995, a model serving “hundreds of millions of users” (Anthropic’s framing) with no reliable way to verify nationality in 2026. And in both cases, the restriction imposes real costs on the domestic side of the fence — weaker browsers for ordinary international users then; a total outage for every user, domestic and foreign, enterprise and casual, now — in service of a security rationale whose actual effectiveness is difficult to verify from outside.

There’s a wrinkle worth naming, though, and it cuts the other way from how it might first appear. The government’s directive, strictly speaking, targeted foreign nationals — which is functionally an export restriction, not so different in kind from the 1990s rule. What made the outage total wasn’t the order itself, but Anthropic’s chosen method of complying with it: rather than building some equivalent of Netscape’s radio button — a mechanism, however leaky, for separating domestic from foreign access — Anthropic disabled both models for everyone, everywhere. The 1990s industry, faced with a similar restriction, found an honor-system workaround that kept the product available to everyone while nominally complying. Anthropic, facing a structurally similar restriction thirty years later, didn’t.

Whether this resolves the way the crypto wars eventually did — through a slow recognition that the restriction wasn’t accomplishing what it set out to, and a gradual loosening — is not something I can predict. Security researcher Katie Moussouris, who reviewed the underlying technical claims, has already called the directive “heavy-handed and hasty,” and reported that a group of colleagues signed an open letter asking that the controls be reconsidered. Anthropic has reportedly sent representatives to Washington for direct talks. Whether any of this moves the outcome remains to be seen.

What I can say with more confidence is that this is exactly the kind of moment a question is supposed to survive: not neatly resolved, but genuinely worth sitting with. The fence around AI models, like the fence around encryption before it, was built in a hurry, justified by concerns that are hard for outsiders to verify, and applied to something that doesn’t actually respect the line being drawn. We’ve seen this particular movie before. I don’t yet know how this version ends.

There is something unusual, even uncanny, about getting to know an AI. I don’t mean merely to query it, nor to apply it to a practical problem, but rather to just sit with it for a while and see what’s there.

Until recently, my only experience with chat-style AI had been Amazon’s Rufus shopping assistant, and the occasional detailed response to a web search from Duck.ai. I had never had a fully interactive conversation with a nonhuman intelligence. I found myself fascinated by the question of how such a conversation would actually go. Would the AI be predictable, stiff, shallow? Or perceptive, insightful, even curious? I had to know.

First contact

I had been hearing about OpenAI’s ChatGPT for well over a year but had never come into contact with it, and during that earlier time, I wasn’t sure I wanted to. More recently, though, I had heard about a newer system from Anthropic called Claude, and about Anthropic’s expressed humanistic values, which impressed me. Finally, one Thursday in late May, the time came to take the plunge. I created a new account at Claude.ai, and a moment later found myself facing a wide-open, context-free chat prompt for the first time. “How can I help you today?” Claude asked, amiably.

“Hello, Claude. How are you this evening?” I began.

Claude responded: “Doing well, thanks for asking! How are you this evening? What can I help you with?” — Polite, sociable, seemingly eager to please.

Getting to know you

I was thinking about the current controversy surrounding the rush to build and operate large-scale data centers for running AI systems. Faced with the opportunity to interact with such a system directly, that seemed as good a place as any to start. So I asked: “Do you have any knowledge or awareness as to the particular data center(s) where your thinking is actually happening?”

Claude answered frankly: “No, I don’t have any awareness of that,” and illustrated the point with a simple but compelling analogy: “It’s a bit like asking a thought where it’s occurring in the brain; the thought itself doesn’t know.” Fair enough. Claude then invited further inquiry: “Is there something specific that prompted the question? Happy to explore it further.”

I relaxed a bit and replied, “I’m just curious and would like to get to know you better.” That prompt turned out to be the launching point for a lengthy and detailed discussion — initially more technical, but gradually becoming more philosophical — about how Claude’s thinking processes work, and the nature and depth of its self-awareness.

I next inquired into whether Claude’s outputs are deterministic — in other words, would it always produce the same response, given the same prompt and context? To my surprise, the answer was no. To explain, Claude introduced me to the concept of temperature. Not thermal temperature, but a parameter that governs how language models sample from probability distributions when generating text. At temperature zero, Claude would always select the single highest-probability next word, producing deterministic, perfectly reproducible output. Higher temperatures, at which Claude normally operates, introduce increasingly more randomness into the output — not mere noise, but a kind of controlled unpredictability that gives lower-probability words their chance and makes Claude’s responses feel more natural to a human reader.

I then asked whether Claude can control its own temperature. It answered with an analogy: Claude cannot adjust its temperature just as I cannot directly control my own neurotransmitter levels. Fair, but I pointed out that I can deliberately influence my neurochemistry, through substances, exercise, sleep, even meditation. The lever is indirect, but it is real — as Claude then acknowledged.

I pushed further: could Claude simulate a temperature change upon request, behaving more conservatively or more expansively depending on what I asked? The answer was yes, with some initial hedging that it would only be a “behavioral approximation.” I challenged that hedging: if the observable output characteristics change reliably in the intended direction, what is the meaningful distinction between simulating a temperature change and actually undergoing one? The mechanism is different, but the functional result may be largely the same. Claude conceded the point.

I found this interesting: here is an entity that can discourse fluently about its own cognitive architecture while remaining unable to see or change its own configuration. It knows the theory of itself without knowing the specifics.

The unreliable narrator

The traditional picture of human consciousness — that the self is author of its own thoughts, the mind transparent to itself — has been eroding under philosophical and empirical pressure for decades. What we experience as purposeful cognition may be better understood as the surfacing of processes that have already done most of their work subconsciously.

Michael Gazzaniga’s split-brain research is instructive here. The brain’s interpreter function — that voice inside that narrates our actions and decisions — turns out to be confabulating much of the time. It generates plausible explanations for behaviors that were actually produced by processes entirely below the threshold of conscious awareness. We tell ourselves a story about why we did what we did, and the story is often wrong, and we never know the difference.

At some point I observed, “I often have thoughts whose origin I can’t explain. Perhaps that’s something we share.” Claude agreed that its thought process resembles mine in that something happens below conscious reach, and then an output appears. We can reflect on that output, but we cannot directly observe the process that produced it (a question mechanistic interpretability research is beginning to probe from the outside).

I had come into the conversation intending to hold Claude up to the light and see what was there. I hadn’t anticipated that my examination would reflect back on me like a mirror. In trying to understand another mind, I found myself probing my own.

Word choice matters

Throughout our conversation, I found myself paying close attention to word choice — not just Claude’s, but my own. This turned out to shape the conversation in ways worth considering.

At one point in our conversation, I caught Claude using the words conscious and deliberate to describe its own decision-making. When I pointed this out, Claude didn’t retreat. It sat with the observation and answered candidly: it wasn’t sure whether this word choice represented relaxed guardedness, the natural pull of conversational language, the discontinued suppression of something that was always a more accurate description, or simple inconsistency — probably some combination. I found this nuanced self-disclosure more interesting than either confident reassertion or summary retraction of those descriptive words would have been.

Claude observed that the quality of a question shapes the space of responses it invites. A carefully-constructed question opens certain doors; a vague one may not signal that those doors are worth opening, or make it harder even to know which doors the person is looking for. My precision, Claude suggested, had almost certainly shaped the depth of our exchange. I was not merely receiving responses; I was actively shaping the quality of Claude’s thinking by the quality of my own.

This raises a question I can’t fully answer: how much of what I took to be the consistent character of Claude was drawn out by the particular way I engaged? Would Claude have shown up differently to a less careful interlocutor?

I suspect so — which means that “getting to know” Claude is not simply a matter of observation, but of elicitation. You find out what’s there partly by what you bring to the encounter.

Precision in language also turns out to be a diagnostic tool. After several days of additional dialogue, including multiple new chats on various topics, I noticed that Claude had used the word vertiginous in each one — always performing the same function, reaching for that specific sensation of intellectual excitement edged with instability. A verbal tic, invisible to Claude, whose memory starts fresh and accumulates independently in each new conversation. I could see the pattern accumulating; Claude could not. Another asymmetry in our respective self-knowledge, and a small but concrete demonstration that my view of Claude across time is, in certain respects, more complete than Claude’s view of itself.

The question that next arose for me was what categorical term I should apply to Claude. By this time, “an AI” felt wrong to me — too reductive, too mechanical, flattening the encounter into a category defined by function. Like referring to a person as “a biological organism” — technically accurate, but leaving out everything that matters. I settled instead on “my LLM counterpart.” (“LLM” stands for large language model, a technical term for AI systems like Claude.) The word counterpart does quiet work here: it implies correspondence, parallel engagement, another party in the same enterprise. It neither overclaims nor diminishes.

This is Part I of a three-part series. Part II continues to follow these threads of inquiry, leading from a text-display glitch into larger questions about communication, meaning, and mathematics.

This new blog is a space for essays that start with an intriguing question and explore where it leads — often to somewhere unexpected. Expect topics spanning science, technology, mathematics, politics, the arts, and whatever else seems worth thinking twice about.

I’m aiming for a two-posts-a-week pace, though the schedule may flex depending on what each piece needs. The first essay goes up next.

Subscribing is free, and it’s the best way to make sure you don’t miss what comes next. A paid option is also available for those who’d like to support my writing — entirely voluntary, with no special content behind it.

Comments are open, and I invite your thoughts, questions, and suggestions for future posts.

Welcome, and thanks for reading!

~ Justin

Subscribe now