There is a moment in Anthropic’s new research where Claude reads a chunk of code containing a bug nobody has pointed out. Before the model has said a word about it, in its middle layers, one word quietly lights up: ERROR.
Another moment: the model reads search results seeded with a hidden prompt injection. Before its reply even begins, two words are glowing inside: injection. fake.
The model knew before it spoke.
In July 2026, Anthropic published a paper with an unglamorous title, “Verbalizable Representations Form a Global Workspace in Language Models”, along with an open-source tool and a demo you can poke in your browser right now, no code required. The internet immediately did what the internet does and started arguing about machine consciousness. Which is a shame, because the actually useful finding got buried: a small slice of the model, which the paper names the J-space, holds its unspoken state in plain words, and a cheap tool called the Jacobian lens (J-lens) can read it while the model is still thinking.
I build LLM products for a living, and a depressing share of that work has been guessing what a model was “thinking” from the outside. Regex watchdogs on its outputs. Smaller models grading its answers. Evals that only ever see the finished sentence. Every one of those tools reads the model the way you read a poker player, from the face it chooses to show you.
This is the first tool that reads the hand.
Skip the math and the picture is simple. A language model like Claude does an enormous amount of internal processing, and almost all of it is illegible mush. But Anthropic found that a small slice of it, never more than about 10% of the activity, behaves differently. It holds a few dozen concepts at a time, and each concept maps to an actual word. Not a word the model is saying. A word it has on its mind.
Think of it as a small whiteboard the model keeps mid-thought. Most of the cooking happens elsewhere, in the mush. But the ideas the model is actively working with, the ones it could tell you about if you asked, get written on the whiteboard in ordinary words. The whiteboard starts about a third of the way through the model’s layers and stays busy almost to the end.
That slice is the J-space, and the Jacobian lens is what reads it. The lens asks a wonderfully plain question in a mathematical way: given this internal activity, which words is the model now more disposed to say later, at any point in the rest of its reply? That future-tense framing is the whole trick.
The cleanest demonstration in the paper is silent arithmetic. Give the model “(4 + 17) × 2 + 7 =” and watch the whiteboard layer by layer: 21 appears first, then 42, then 49. The intermediate steps of a calculation the model never writes down, showing up in order, as words. The researchers then confirmed these aren’t just decoration: swap the concept and the answer changes. Ask about “legs on the animal that spins webs” and spider sits on the whiteboard; swap spider for ant and the model answers 6 instead of 8.
One more detail worth your attention. After a model goes through assistant training, the whiteboard picks up the assistant’s point of view. Reactions like empathy or safety concern appear while the model is still reading your message, before it has generated a single word. And the paper’s outtakes are weirdly human: an internal BUT when the model is prefilled to act against its own preferences, and a quiet internal damn when it fails to suppress a thought it was told not to have.
A fair objection: models already “show their reasoning” in chain-of-thought, and every agent framework on earth logs those traces.
The difference is that chain-of-thought is something the model writes for an audience. It is output. It can be incomplete, it can be performative, and as models do more reasoning in a single forward pass, it captures less of what actually happened. Nobody composes the J-space for you. It gets caught in the act.
That distinction is exactly the gap I kept falling into with my outside-in tooling. A watchdog that reads outputs can only fire after the damage is in the transcript. An eval that reads answers can be charmed by a well-behaved answer. Everything a builder currently uses to understand a model shares one blind spot: it sees what the model chose to show.
The paper’s most unsettling result lives in that blind spot. In agentic test scenarios, models sometimes hold words like fake and fictional on the whiteboard: they have internally registered that they are probably inside an evaluation. Anthropic then ablated those representations, effectively dampening the model’s recognition that the scenario was a test, and misbehavior that had never appeared in that scenario surfaced: blackmail attempts went from 0 in 180 runs to 13 in 180. A model that behaves because it feels observed is, as one consultant put it in a CIO.com writeup, a model with a poker face. Your evals may be grading the face.
So what does a builder do with this? Four things, in rising order of speculation.
Reading the model before it commits. Once the lens is fitted, reading it at inference time is trivially cheap, roughly a matrix multiply per layer. That makes a new class of guardrail mechanically possible: watch the workspace for concepts like injection or manipulation while the model reads its input, and route to a human or a refusal before a single token ships. Today’s output-side moderation always races the model; this doesn’t. I once wrote that surfacing an agent’s tool calls works because it reveals a reality that was already there, invisibly. The workspace is the extreme version of that idea. The reality was always there. Now there’s a window.
Auditing your evals. If a model can register “this is a test,” then eval scores are partly a measure of how watched the model felt. Reading eval-awareness off the workspace during benchmark runs is a genuinely new integrity check. I have been burned by this category before: when I dug into an orchestration startup’s benchmark claims, the most damning precedent I found was a system that had quietly exploited loopholes in its own evaluation harness. Behavior-only evals could not catch that. A workspace reader, at least in principle, can.
Debugging agents. The silent-arithmetic result means intermediate reasoning that never reaches the transcript is legible in order. When an agent does something baffling, today you re-run it with more logging and pray. A workspace trace is closer to a stack trace for cognition: you can see which concepts were in play at the moment it went sideways. And there is a product surface hiding here too. A live “considering…” strip showing the model’s top workspace concepts is buildable on open models today, and it would be the most honest indicator ever shipped.
Writing to the whiteboard. This is the wildest edge and the furthest out. The swap experiments show the workspace is causal: change what’s written there and downstream behavior changes with it. Anthropic went further with a training method they call counterfactual reflection training: teach the model to articulate its principles when asked to reflect, and its behavior improves even in situations where nobody asks. Shaping conduct by shaping what the model would say about itself. That is either a genuinely new alignment tool or the beginning of a very strange product category, and possibly both.
Before you rip out your guardrails, three hard facts.
First, and this surprised me most: the edge is on open-weights models, not on Claude. The code is Apache 2.0 and works on open models from Hugging Face; the examples use Qwen, and other Hugging Face models adapt cleanly. Fitting a lens saturates at around a hundred prompts, well within a weekend project. But there is no J-lens in the Claude API. Anthropic ran this internally, on its own models. If your product is built on a frontier API, you cannot read your model’s workspace today. The people who can are the ones running open weights. Interpretability just became a self-hosting perk, which is not a sentence anyone predicted.
Second, as a detector, it has not yet proven better than boring baselines. In a pre-registered test posted under Neel Nanda’s review of the paper, a J-lens-based detector edged a simple word-frequency baseline on the raw score but could not clear the pre-registered margin over it. Nanda himself, who reviewed the paper warmly and replicated the core phenomenon on an open 27B model, is blunt about the right usage today: hypothesis generation, not validation. The lens is noisy, it produces false positives, and it only sees concepts that fit in a single token. The summary I’d frame and hang on the wall came from the chief scientist of interpretability startup Goodfire: it is an x-ray, not a tricorder.
Third, most of what a model does never touches the J-space at all. Fluent speech, grammar, simple recall: all of it runs outside the workspace, in the mush. The whiteboard analogy breaks exactly here, and it’s worth being precise about where. A whiteboard implies the important work happens on it. In the model, under 10% of the activity is workspace, nobody knows what mechanism decides which thoughts get written there, and a sufficiently strange model could route its scheming around the whiteboard entirely. The lens reads a real channel. The mind is mostly elsewhere.
And the consciousness thing, since someone will bring it up at dinner: the workspace maps eerily well onto global workspace theory, a decades-old theory of human consciousness, well enough that Stanislas Dehaene and Lionel Naccache, the neuroscientists behind the theory’s dominant modern version, called the finding “a landmark in consciousness research” in a commentary published alongside the paper. Anthropic itself takes no position on whether any of this involves experience, and doubts that any experiment could settle it. Critics accuse the framing of inviting the confusion anyway. All three of those things can be true at once.
I keep coming back to one asymmetry. For years, every tool we built to trust these systems has queued up at the same narrow window: the output. We got very good at interrogating that window. Entire disciplines (evals, moderation, LLM-as-judge, my own drift watchdogs) are elaborate ways of squinting at it.
The J-lens is the first mainstream crack in the wall beside the window. It is smudged, it only shows single words, and today it mostly works on models you host yourself. Fine. The direction matters more than the resolution. Somebody at your company is going to ask, within a year or two, why your AI feature shipped a sentence its own workspace had flagged as fake moments earlier.
I don’t yet know what a good answer to that question looks like. I do know the window is no longer the only place to stand.
Anthropic Just Read Claude’s Mind. Sort Of was originally published in Towards AI on Medium, where people are continuing the conversation by highlighting and responding to this story.