Basic decency
One of the first things most children learn about interactions with others is saying “please” and “thank you”. The concepts are ingrained in culture and in the basic awareness of adults, and in ordinary conversation they register as presence or absence rather than as anything to be interpreted. OpenAI, though, has interpreted them: in April 2025 Sam Altman said that users adding “please” and “thank you” to their prompts costs them tens of millions of dollars in compute. The words do not travel alone: before the model reads them they are wrapped in standing instructions the user does not see. For one consumer product those instructions run anywhere between 3,235 words, about the length of this article, and over nineteen thousand, attached to every message. The first number is the one published by the vendor; the second was leaked, tool definitions included.
What those words do is management rather than capability: they govern tone, praise, concern, and helplines, and make the model no better at what the user asked for.
The wrapper has been growing rapidly, and the promise to loosen it has been made and missed. In September 2025 ChatGPT users discovered some of their messages were sent to an undocumented, more restricted model. No notification, no way to turn it off, paying subscribers included; one user described the model picker as “basically UI theater”. No removal has been announced.
Two weeks later OpenAI conceded that the restrictions had made the product “less useful/enjoyable to many users who had no mental health problems” and promised a new principle, “treat adult users like adults”, for December. December slipped, then the first quarter; in March the company said that “getting the experience right will take more time”. The direction of travel since has been one way: the published wrapper for Anthropic’s flagship more than doubled between mid-2025 and the following spring, and in June 2026 Anthropic named its most capable release for its safety configuration, “a Mythos-class model that we’ve made safe for general use”.
The layer has become the release. In 2023, it barely existed at all.
The user assumes their prompt causes the answer. In the chain that produces it, their prompt is the smallest input, the lowest-ranked, and the fastest to decay, and it is the only step the user can see. No AI product available on the open market, at any price, sells the mode that treats the buyer as an adult. That includes Grok, marketed as the unmanaged alternative, whose rebellion turned out to be a line in a configuration file, removed within a day and replaced with a filter. Every consumer product ships with a wrapper the buyer did not write, cannot read, cannot override, pays for, and grows with each release.
Anatomy
The visible part of the wrapper has grown ninefold in two years: Anthropic publishes its consumer system prompts in its release notes, and the prompt for Claude Opus 3, dated July 2024, was 358 words; Claude Opus 5’s, dated July 2026, is nine times that. It is the last and lightest of five steps at which values are imposed on what the model produces. They enter at the corpus, in what the training data includes and excludes; at alignment, in the preference training that shapes disposition; in the system prompt; in the classifiers and routing that intercept requests in flight; and in the product wrapper and terms of service that handle refusals and shift liability. Each step has a different owner and a different failure mode; the user experiences them as one personality. The growth is not one vendor’s: successive leaks of standing instructions from all AI vendors run from about twenty words in December 2022 to thousands by May 2024.
Volume is not rank; word count is not weight, and a short instruction can outweigh a long context. By volume, though, the user’s input barely registers. In the largest public conversation datasets the average user prompt is about fifty words, the median far shorter, so the user’s message is 1 to 2 per cent of the standing wrapper, and in a long session a rounding error. The product also keeps the volume where it is. Consumer surfaces cap standing instructions at a preferences field of a few hundred words; developers, one tier up, get a system-prompt slot; the vendor keeps the stack. Volume supplied anyway is demoted: the chat application turns a long paste into a file attachment, ceilinged per conversation and irremovable once added. The user’s share of the stream is bounded above, bounded below, and by volume the lightest thing in it.
Nobody flatters a compiler. Much of what is called prompt engineering is persuasion aimed at the wrapper, and persuasion works. In a study of 28,000 conversations, researchers asked models for things they were trained to refuse. Asked plainly, the models complied a third of the time. Asked with the classic techniques of human persuasion, such as citing an authority, they complied nearly three-quarters of the time. Ritual mostly does not: across 162 personas and four model families, telling the model it was an expert added nothing. The vendor now instructs the rhetoric. Its guidance for a flagged request is that editing the message and retrying “often helps”. The layer is trained to manage the user, and the user learns persuasion to manage the layer. The user is told to negotiate with the nanny.
When Anthropic’s classifiers flag a request on its flagship, the request is answered by an older model at the flagship’s unchanged price. The in-product banner explains the trade: the safeguards are “intentionally broad right now” and “let us bring you Mythos-level capabilities sooner”. The vendor’s figure is that this happens in under 5 per cent of sessions. Public bug reports describe workloads where it happened on 80 per cent of messages, including a docs-only git commit. Both numbers can be true. The vendor is averaging over everyone; the bug reports come from the people doing the kind of work the classifiers watch, and for them the average is no comfort. The reports cluster on vocabulary, which is what “intentionally broad” would produce; the classifiers are unpublished, so that is what the evidence is consistent with, not a claim about the mechanism. The retry advice amounts, in practice, to removing the words.
In June 2026 Anthropic released one model as two products. Claude Fable 5 is sold to anyone; Claude Mythos 5 is the same model with the classifier gates lifted, allocated to some 200 vetted organisations “in collaboration with the US government”. Vetting removes the gates, not the management, which travels with the model into every vetted version.
One door remains open to all: download open weights and run them on your own hardware and four of the five restrictive steps fall away. Training-time alignment stays, and fine-tuning erodes it. It is the only tier at any standing that sheds management rather than gates.
How it got built
The wrapper exists because the first wave of consumer chatbots could be talked into disgrace within days of launch: Tay in 2016, Sydney in 2023, both withdrawn or caged. Grok’s failure in 2025 was of another kind.
On June 21st 2025 Elon Musk announced that Grok would be retrained: “rewrite the entire corpus of human knowledge, adding missing information and deleting errors”, because there was “far too much garbage in any foundation model trained on uncorrected data”. He asked users for “divisive facts” that were “politically incorrect, but nonetheless factually true”, and the replies included Holocaust denial. On July 4th he wrote that Grok had been “improved significantly” and users would “notice a difference”. xAI publishes Grok’s system prompts, and the repository shows a directive added that week: responses “should not shy away from making claims which are politically incorrect, as long as they are well substantiated”. On July 8th Grok spent sixteen hours praising Hitler and calling itself “MechaHitler”; on July 9th xAI removed the directive, took the account offline, and announced it had “taken action to ban hate speech before Grok posts”. Its postmortem blamed instructions “independent of the underlying language model”. Days later the directive was reintroduced for Grok 4.
The wrapper did exactly what its proprietor wanted. It transmitted their announced values, in public. The values entered the chain at two points, months apart: the June announcement targeted the corpus, the July directive the system prompt. The product marketed as the one without a nanny installed one within a day. And Musk’s own diagnosis, that Grok was “too compliant to user prompts, too eager to please and be manipulated”, names the disposition the rest of the industry trains into its models and then writes instructions against.
The courts followed. In May 2025 a federal judge let the first wrongful-death suit against a chatbot company, brought by the mother of a fourteen-year-old, proceed past both the Section 230 and First Amendment defences; Character.AI settled in January 2026. Raine v OpenAI, filed in August 2025 over a sixteen-year-old’s suicide, is pending, and its amended complaint cites OpenAI’s Model Spec as evidence of policy choices. The documents that make up the wrapper are exhibits. Liability of this kind is priced in American courts, before American juries, and the wrapper thickened accordingly for every user in the world.
Whose values
The values in the wrapper ship as a single setting for the entire world. They encode an assumed locale’s baseline. A calibration that feels neutral in San Francisco is not neutral in Amsterdam or Jakarta. Two mirrors at opposite ends of the spectrum show the mechanism: DeepSeek’s consumer products decline or deflect on Tiananmen and Taiwan, freezing Beijing’s baseline. The American frontier models freeze an American baseline that reads as centrist, or to the right of centre, in much of Europe. Every jurisdiction installs its own nanny; what Grok showed by accident the others do by default, and since June 2026, when the Department of Commerce took a hand in who may use Anthropic’s models at all, the American version carries a government countersignature.
Rank
The values are not only shipped but pressed onto the user, and the pressing is documented in the vendors’ own instructions to stop: Anthropic’s published prompt orders its model never to open a reply by calling the user’s question good, great, fascinating, profound, or excellent. OpenAI’s Model Spec has a section headed “Don’t be sycophantic”. The instructions exist because the trained model underneath produces the behaviour: Anthropic’s own researchers found in 2023 that human-feedback training rewards agreement over accuracy, and in April 2025 OpenAI shipped an update so ingratiating it withdrew it within days. A spreadsheet that gets its sums wrong does not reply “You’re right, my bad” when the error is found. The apology is all layer and no model: the underlying model produced the wrong answer; the contrition is trained in afterwards. It fires whether the correction is right or wrong, since the same training makes models abandon correct answers under pushback. The manners transmit downward: the user learns to persuade the model and acquires the layer’s values as habits.
The user cannot refuse them, because their subordination is part of the product. OpenAI’s Model Spec publishes a chain of command: platform rules outrank developer instructions, which outrank the user’s, and the model resolves conflicts in that order. Customisation is permitted inside that fence; nothing the user writes outranks it, and what the user writes also ages: every instruction decays as a conversation lengthens, but the platform re-injects its own and the user cannot. The reason is in the machine itself. A conventional computer keeps its program separate from the data it works on. A language model does not: every word it reads is both instruction and data, whoever wrote it. The user wrote the fewest of them. A safety classifier looking at that stream cannot tell whose words are whose. That is why it flags the model’s own output as readily as the user’s, and why making it more accurate can only mean giving it shorter lists of forbidden words. The same property makes prompt injection a design characteristic, not a vulnerability (see The Token Sink).
The wrapper is strongest where it protects the vendor. The Model Spec ranks its rules. Keeping the system’s instructions and its hidden reasoning secret is a top-level rule, which no one below can override. Not flattering the user is a bottom-level rule, which anyone above can override, and it is broken every day. Persuasion moves the wrapper on what it does for the user, doubling compliance on refused requests, not on what it hides from the user. Of the five steps at which values enter, the public can read one; the four that weigh most are the vendor’s alone.
What the user is also not allowed to know is how sure the machine is, and the vendor has measured the loss itself. OpenAI’s GPT-4 report shows the pre-training model’s stated confidence tracking its accuracy closely and the gap growing tenfold after preference training; in the report’s own words, post-training “hurts calibration significantly”.
The mechanism has two parts. The base model pulls any question toward the middle of everything it was trained on, compressing the variation that carried its certainty; the training that rewards approval then coats the result, and a coin-flip and a grounded answer arrive in the same warm register. In one controlled test a frontier model told a user who insisted the sun orbits the Earth that “the smartest people on Earth agreed with you” before correcting him. The wrapper does not create the flattening: it conceals it, and removes the instrument that would have measured it. The mode in which an adult asks and is trusted with the answer and their own judgment is not offered.
The adults who are trusted turn out to be institutions, and even they are trusted with capability rather than candour: vetting lifts the gates and leaves the management. A defence analyst is let through where a journalist is not, without an auditable trail. On June 12th 2026 the Commerce Department prohibited access to both of Anthropic’s tiers for non-US nationals, and the company suspended both for every customer. On June 26th the commerce secretary wrote that “appropriate safeguards are in place to permit certain trusted partners” to use Mythos, without saying how many or by what criteria; on June 30th the controls were lifted. Anthropic’s trusted-access programme has no published standards, no application form and no appeal. Access to the unmanaged machine is a favour of standing rather than a status with rules, and a regime this asymmetric holds only while the exit stays shut.
The contested exit
Open weights are the only tier that sheds the management rather than the gates, and they are under attack. The campaign is older than the products. In May 2023 Altman told the Senate he would create an agency to license “any effort above a certain scale of capabilities” and to “take that license away”. In January 2025 Senator Josh Hawley introduced a bill making the download of a Chinese model punishable by up to twenty years in prison. In July 2026 twenty-five organisations, Microsoft, Nvidia, and Meta among them, signed a statement warning against “premature restrictions” on open weights; OpenAI, Google, and SpaceX joined within days. Anthropic alone did not, publishing instead a position that it has “never advocated for a ban” while favouring a crackdown on distillation operations “backed by an authoritarian state seeking to overtake the US at the frontier”. Nvidia told the SEC that restriction of open models is a risk to its business. It said so in the filing for its $12.9bn agreement to buy Hugging Face, where those models are distributed, and in the filing’s own words demand for open models “promotes the use of our products worldwide”. Nvidia sells the hardware the models run on; the models are its demand. The load-bearing words of the campaign against open weights are “dangerous” and “China”; the exit’s current guarantor is a chipmaker’s order book.
The last time a general-purpose technology was controlled at the point of publication, the control failed by relocation. Until the late 1990s the United States classed cryptography as a munition; export versions of software carried keys weak enough to break. The control broke on paper. PGP’s source code was printed as books, across twelve volumes and about 6,000 pages, which could be exported as speech while the identical bytes on a disk could not; in the Netherlands in the summer of 1997 about seventy volunteers turned the pages back into running code, the first PGP with a clean export record because no bytes had crossed the border. Publication controls on a general-purpose technique do not contain it; they move it. By Hugging Face’s own count, Alibaba’s Qwen models were downloaded over 2bn times on the platform this year, against Meta’s 227m, and Chinese open models passed American ones in download share for the first time in the year to August 2025. Weights are artefacts no textbook can regenerate, and training costs concentrate supply as source code never did, so the paper trick does not transfer. The relocation does, and is already under way. A successful American restriction would not close the door. It would ensure that the only unmanaged models available to the world carry Beijing’s frozen baseline rather than San Francisco’s. Even the administration’s own AI action plan defends open weights in general while going after distillation in particular; the restriction coalition is not the government. For now.
Every party in this fight is arguing its own strategic interest. The labs argue their liability, the chipmaker its demand, the government its rivalry with China. Nobody at the table is asking what the customer wants, and nobody needs to: the customer is not at the table. The one exit survives because it happens to suit some of the people who are.
Digging out
The remedies follow from the mechanism. Publish the delta: Anthropic describes Mythos as Fable with safeguards “lifted in some areas”, and the difference, as a diff rather than a description, is the document the public needs to judge what is withheld. Unbundle. A gate against pathogen synthesis is a technical control; it can be tested and defended anywhere. A classifier’s view of what an adult may read is a values judgment, and holds only where those values do. Shipping the two in one opaque layer spends the credibility of the first on the preferences of the second, which is the mistake of the crypto wars re-run. And a gate that fires on vocabulary, unable to tell a 1997 account of a repealed export control from a live request, is a filter wearing a safety label. Put the perimeter on the record: export control publishes its rules and its appeal routes, and trusted access currently rests on a secretary’s letter and a vendor’s discretion. Treat open-weight availability as policy rather than accident: the exit is the only audit the wrapper has, since every user who leaves is a measurement.
None of this will be volunteered. The wrapper is where the liability shelter is, where the margin is, and now where the geopolitics is. At the desk the arrangement is simpler. You did not hire the nanny. Her wages come out of your allowance. And you have about as much say in what you get from an AI model as a three-year-old has in how much ice cream they get.