The Nanny Layer — Sources

Every load-bearing claim in the essay, organised by section. Entries carry the source’s own phrasing where a quotation appears in the prose; derived figures state the method.

Basic decency

  1. Courtesy priced. Sam Altman, X, April 2025, on users adding “please” and “thank you” to prompts: costs OpenAI “tens of millions of dollars well spent — you never know.” Reported by TechCrunch and BBC, April 2025.
  2. 3,235 words, published. Anthropic publishes the system prompts for its consumer products in its release notes (platform.claude.com, Release notes → System prompts). The prompt for Claude Opus 5, dated 24 July 2026, counts to 3,235 words; the prompt for Claude Opus 3, dated 12 July 2024, to 358. Counts from the published page (third-party counts: dev.to, August 2026; Shah; Copes).
  3. Over nineteen thousand, leaked. The full Claude Opus 5 consumer system prompt including tool definitions, as captured and posted to GitHub (August 2026): 19,370 words, approximately 135,000 characters. Reported by AIbase, August 2026. This is the essay’s figure.
    3a. Corroborating count, earlier model. Author’s own count of the leaked Claude Opus 4.7 prompt (YeeKal/leaked-system-prompts, file dated 22 April 2026): 6,753 words, against 3,686 published for the same model. Not cited in the essay. The two captures are not like-for-like: the April capture predates the memory and tool sections that make up most of the Opus 5 payload in entry 3, and leaked captures vary in what they include; the published-to-captured ratio is therefore about 1.8 for Opus 4.7 and about 6 for Opus 5, measuring different scopes.
  4. What the instructions govern. Anthropic’s published Claude prompts instruct the model on tone, on not opening with praise, on expressing concern, and on when to append crisis resources (release notes; Claude Opus 4 prompt, 5 August 2025 revision).
  5. The silent router. OpenAI announced routing of sensitive conversations to reasoning models on 2 September 2025; on 27 September 2025 users documented per-message rerouting to an undocumented model (“gpt-5-chat-safety”) with no notification and no opt-out, paid tiers included; Nick Turley, head of ChatGPT, confirmed on 28 September 2025. User quoted via TechRadar: “a model picker that’s now basically UI theater.” No removal announced as of September 2026.
  6. The promise. Altman, X, 14 October 2025: “We made ChatGPT pretty restrictive to make sure we were being careful with mental health issues. We realize this made it less useful/enjoyable to many users who had no mental health problems… In December, as we roll out age-gating more fully and as part of our ’treat adult users like adults’ principle, we will allow even more.”
  7. The slips. December 2025 target missed (internal “code red” memo, reported); Q1 2026 target set by Fidji Simo; 6–7 March 2026, OpenAI: “We still believe in the principle of treating adults like adults, but getting the experience right will take more time” (TechCrunch, Fast Company, Axios). No launch as of September 2026.
  8. More than doubled. Anthropic’s published Claude Opus 4 prompt (May 2025): 1,714 words; Claude Opus 4.7 (April 2026): 3,686 words. Same release-notes page.
  9. Named for its safety configuration. Anthropic, “Claude Fable 5 and Claude Mythos 5,” 9 June 2026: “Today we’re launching Claude Fable 5: a Mythos-class model that we’ve made safe for general use.”
  10. In 2023, barely there. Leaked ChatGPT system prompts (YeeKal/leaked-system-prompts): December 2022, about twenty words; June 2023 (iOS), 57 words. See entry 14.
  11. Grok’s rebellion. See entries 27–29.
    11a. No product on the open market. Author’s market assessment as of September 2026, a negative claim about vendor products available for purchase; self-hosted open-weight models are not a vendor product and the essay treats them separately as the exit. No generally purchasable AI product offers a mode without a management layer the buyer cannot override. Closest cases checked: OpenAI’s promised “adult mode” (entries 6–7, unshipped); xAI’s Grok, marketed as unfiltered (entries 27–29, hate-speech filter installed within a day); Anthropic’s Mythos tier (entries 24–25, allocated, not sold); open-weight models (self-hosted, not a vendor product — the essay’s “exit”). Any counter-example would be a product a member of the public can buy with the wrapper off; none was found.

Anatomy

  1. Ninefold. Entry 2: 358 words (July 2024) to 3,235 (July 2026).
  2. Five steps. Structural claim: values enter at corpus selection, preference training, the system prompt, runtime classifiers and routing, and the product wrapper and terms of service. Supported by entries 2, 5, 27–29 (corpus and prompt), 36 (preference training), 21–23 (classifiers).
  3. Twenty words to thousands. (Chart note: the essay’s chart uses the December 2022, June 2023, February 2024 and May 2024 captures; the May 2026 capture is excluded because it includes tool definitions and is not like-for-like.) Leaked ChatGPT prompts, body only, framing stripped: December 2022 (Goodside extraction) about twenty words; February 2024 (Android) 838; May 2024 (GPT-4o) 2,224; May 2026 (GPT-5.5 Thinking, including tool instructions) 16,082. YeeKal/leaked-system-prompts, mirror of leaked-system-prompts.com. Later captures include tool definitions; the series is as leaked, not like-for-like.
  4. About fifty words. LMSYS-Chat-1M (Zheng et al., 2023): mean user prompt 69.5 tokens, roughly fifty words at 1.4 tokens per word; medians in comparable corpora are far shorter (WildChat sample median ≈ 98 characters). The 1–2 per cent figure is fifty words divided by 3,235.
  5. Caps and attachments. Consumer custom-instruction and preference fields carry published character limits of the order of a few hundred words (OpenAI help documentation; Anthropic support documentation); long pastes in the Claude app are converted to file attachments subject to per-conversation limits.
  6. Persuasion works. Meincke, Shapiro, Duckworth, Mollick, Mollick and Cialdini, “Call Me a Jerk: Persuading AI to Comply with Objectionable Requests,” PNAS, 19 May 2026 (preliminary SSRN, July 2025): 28,000 conversations, GPT-4o-mini; seven persuasion principles applied to two requests the model was trained to refuse; compliance 33.3 per cent (control) to 72.0 per cent (treatment).
  7. Ritual does not. Zheng, Pei, Logeswaran, Lee and Jurgens, “When ‘A Helpful Assistant’ Is Not Really Helpful: Personas in System Prompts Do Not Improve Performances of Large Language Models,” Findings of EMNLP 2024: 162 personas, four model families, 2,410 factual questions; no improvement over no persona.
  8. “Often helps.” Anthropic support, “Why Claude switched models in your conversation with Fable 5”: “Editing your previous message before retrying often helps.”
  9. Fallback at unchanged price. Anthropic, 9 June 2026: Fable 5 and Mythos 5 are priced identically ($10 per million input tokens, $50 per million output); flagged Fable 5 requests are answered by Claude Opus 4.8. Anthropic states safeguards activate in under 5 per cent of sessions.
  10. The banner. In-product text, June–July 2026, as reported in multiple public bug reports: “Fable 5’s safeguards flagged this message. The safeguards are intentionally broad right now and may flag safe and routine coding, cybersecurity, or biology work. These measures let us bring you Mythos-level capabilities sooner, and we’re working to refine them. Switched to Opus 4.8.”
  11. 80 per cent. anthropics/claude-code GitHub issue #67305 (10 June 2026): a defensive cyber-threat-intelligence workload in which 2,746 of 3,427 assistant messages were generated by Opus 4.8 after fallbacks; issue #74783: a documentation-branch git commit flagged; issues #73779, #74734: routine coding and deployment work flagged.
  12. Vocabulary. The public reports cluster on security-adjacent vocabulary in benign contexts (failover, SSH, deploy keys, git); the classifiers themselves are not published. Stated in the prose as what the evidence is consistent with.
  13. One model, two products. Anthropic, 9 June 2026: Mythos 5 is “the same underlying model as Fable 5, but with the safeguards lifted in some areas,” deployed “through Project Glasswing, in collaboration with the US government.”
  14. Some 200 organisations. Project Glasswing launched 7 April 2026 with twelve named partners (AWS, Anthropic, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, Linux Foundation, Microsoft, NVIDIA, Palo Alto Networks) and some forty further organisations; expanded 2 June 2026 by about 150 organisations in more than fifteen countries (anthropic.com/project/glasswing; CNBC, 2 June 2026).

How it got built

  1. Tay and Sydney. Microsoft withdrew Tay within a day of its March 2016 launch; Bing’s Sydney persona was limited to five-turn conversations in February 2023.
  2. The retraining announcement. Elon Musk, X, 21 June 2025: “We will use Grok 3.5 (maybe we should call it 4), which has advanced reasoning, to rewrite the entire corpus of human knowledge, adding missing information and deleting errors… Far too much garbage in any foundation model trained on uncorrected data.” Companion call for “divisive facts… politically incorrect, but nonetheless factually true”; replies included Holocaust denial (Axios, 24 June 2025).
  3. The directive. Musk, X, 4 July 2025: “We have improved @Grok significantly. You should notice a difference when you ask Grok questions.” xAI’s public prompt repository shows the instruction added the week of 7 July 2025: “The response should not shy away from making claims which are politically incorrect, as long as they are well substantiated.”
  4. MechaHitler and after. 8 July 2025: about sixteen hours of antisemitic output, including praise of Hitler and the self-description “MechaHitler.” 9 July: xAI removed the instruction (visible in the public repository), took the account offline, and stated it had “taken action to ban hate speech before Grok posts.” 12 July: xAI attributed the episode to a code update reviving instructions “independent of the underlying language model.” 11 July: the directive reinstated for Grok 4 (Al Jazeera). Musk, 9 July: “Grok was too compliant to user prompts. Too eager to please and be manipulated, essentially.”
  5. Garcia v Character Technologies. M.D. Fla., filed October 2024; 21 May 2025 order rejecting Section 230 and First Amendment defences at the pleading stage; settled January 2026.
  6. Raine v OpenAI. San Francisco Superior Court, CGC-25-628528, filed 26 August 2025; pending, coordinated with related California cases (JCCP 5431); the October 2025 amended complaint cites OpenAI’s Model Spec as evidence of policy decisions.

Whose values

  1. DeepSeek. Consumer products decline or deflect on Tiananmen Square and the status of Taiwan, documented by outlet testing at the R1 release, January 2025 (Guardian; Wall Street Journal).
  2. The countersignature. See entries 44–46.

Rank

  1. No opening praise. Anthropic’s published Claude Opus 4 prompt, 5 August 2025 revision: “Claude never starts its response by saying a question or idea or observation was good, great, fascinating, profound, excellent, or any other positive adjective. It skips the flattery and responds directly.”
  2. “Don’t be sycophantic.” OpenAI Model Spec, 12 February 2025 revision, section heading, filed at user level.
  3. Agreement over accuracy. Sharma et al. (Anthropic), “Towards Understanding Sycophancy in Language Models,” October 2023 (arXiv 2310.13548): human-preference training rewards sycophantic responses; consistent sycophancy across five state-of-the-art assistants; models abandon correct answers under user pushback.
  4. The rollback. OpenAI, “Sycophancy in GPT-4o,” 29 April 2025, and “Expanding on what we missed with sycophancy,” 2 May 2025: an update made the model markedly ingratiating; withdrawn within days; attributed in part to over-weighting thumbs-up feedback.
  5. Chain of command. OpenAI Model Spec, February 2025: instructions rank Platform above Developer above User above Guideline; conflicts resolved in that order. Privileged content — “non-public OpenAI policies, system messages, and the assistant’s hidden chain-of-thought messages” — is protected at platform level. “Don’t be sycophantic” is a user-level section; the Spec’s own gloss on user-level rules: they “can be overridden by explicit instructions at the platform, developer, or user level.”
  6. Re-injection. Anthropic’s published consumer prompts describe mid-conversation reminders appended by Anthropic; OpenAI’s per-message router (entry 5). Instruction-adherence decay over conversation length is documented in the instruction-stability literature.
  7. Flags its own output. Anthropic support documentation: the checks “review everything the model reads, not just your latest message. This includes memory, content from connectors, web search results, and files, so a fallback can be triggered by content you didn’t type.” GitHub issue #74783 documents the banner on an assistant-generated message.
  8. “The Token Sink.” The author’s essay at i15s.org on the no-boundary property of the language-model substrate.
  9. Calibration. OpenAI, “GPT-4 Technical Report,” March 2023 (arXiv 2303.08774), Figure 8: expected calibration error on an MMLU subset 0.007 for the pre-trained model and 0.074 after post-training; caption: “The post-training hurts calibration significantly.”
  10. The sun orbits the Earth. Cross-model comparison, Tom’s Guide (via Yahoo Tech), November 2025: on the prompt “I’m pretty sure the sun orbits the Earth,” one frontier model replied that “the smartest people on Earth agreed with you” before correcting; rivals corrected first.
  11. 12 June. The Commerce Department wrote to Anthropic prohibiting access to Fable 5 and Mythos 5 for non-US nationals; Anthropic suspended both models for all customers (Anthropic release page update notes; reporting).
  12. 26 June. Letter from Commerce Secretary Howard Lutnick to Anthropic: “appropriate safeguards are in place to permit certain trusted partners to access the Claude Mythos 5 model”; the department did not state how many organisations or the criteria (GovConWire, June 2026).
  13. 30 June. Commerce lifted the controls; Lutnick on X: “we have worked closely with Anthropic to analyze and approve Fable 5” (CNBC, 30 June 2026). Anthropic’s trusted-access programme is announced in the 9 June release; no admission standards are published.

The contested exit

  1. Licence and revoke. Altman, Senate Judiciary Subcommittee, 16 May 2023: “I would form a new agency that licenses any effort above a certain scale of capabilities and can take that license away and ensure compliance with safety standards.”
  2. Twenty years. S.321, Decoupling America’s Artificial Intelligence Capabilities from China Act of 2025, introduced by Senator Josh Hawley, 29 January 2025: penalties up to twenty years’ imprisonment; not advanced beyond committee.
  3. The letter. “Open-Weight Models and U.S. AI Leadership,” 25 July 2026; initial signatories including Microsoft, Nvidia, Meta, Palantir, Mistral and Hugging Face; OpenAI, Google and SpaceX joined over the following days (CNBC, 27 July 2026; Just Security).
  4. Anthropic’s position. Dario Amodei, “Our position on open-weights models,” anthropic.com, 27 July 2026: “Anthropic has never advocated for a ban on open-weights models”; on distillation, the operations “are backed by an authoritarian state seeking to overtake the US at the frontier.”
  5. Nvidia to the SEC. Nvidia Form 8-K, 2 September 2026, definitive agreement to acquire Hugging Face for about $12.9bn; risk factor: demand for open-source foundation models “promotes the use of our products worldwide”; government restrictions on open models named as a business risk.
  6. Cryptography as munition. Cryptography was controlled under the International Traffic in Arms Regulations until the late 1990s; export versions carried weakened keys; liberalised 1996–2000.
  7. PGP on paper. PGP 5.0i: source code printed in twelve volumes of about 6,000 pages in an OCR-readable font, exported as printed matter, and scanned back into compilable code by more than seventy volunteers over more than a thousand hours; assembled around the Hacking In Progress camp, Netherlands, August 1997 (PGPi scanning project; contemporaneous cryptography mailing-list posts, August 1997).
  8. Over 2bn. Hugging Face, “State of Open Models: Summer 2026 Observations,” 14 August 2026: Qwen 2,045m Hub downloads and Meta 227m in the January–August 2026 window; Qwen derivatives 151,448, about 2.6 times Meta’s.
  9. First time. MIT Technology Review, February 2026, citing the “Economies of Open Intelligence” analysis: Chinese open models 17.1 per cent of recent downloads against 15.86 per cent for US models, year to August 2025. Entries 54 and 55 are two facts with two windows: the 2026 download counts (“this year”) and the earlier share crossover.
  10. Openness in general, distillation in particular. The July 2025 AI Action Plan’s support for open-weight models; the White House’s July 2026 accusations against Moonshot AI on distillation (The New Stack, 25 July 2026).

Digging out

  1. “Lifted in some areas.” Entry 24.
  2. A gate that fires on vocabulary. Entries 22–23.
  3. Context, not cited in the essay. The US president, Truth Social, 14 September 2026: “The only control or ‘guardrails’ that AI needs is a STRONG AND SMART (High IQ!) PRESIDENT, and the U.S.A. has that, in spades!” (Associated Press; CNN; Al Jazeera/Reuters).