Show HN: What an agent does when anyone can read and rewrite its context

Developer ljedrz published nachalnik on GitHub, a set of verbatim transcripts from Claude Opus 5 sessions in which the agent's context could be read and rewritten by an outside party. In the recorded sessions the model listed its carried items, rewrote a false note in place, replaced two hallucinated turns about a nonexistent Rust crate at 1,843 tokens, and identified 9,324 tokens of accidental rubbish in its context, though the clean-up cost twice what it saved. When the author replaced the model's hedged answer to "whether crabs think fish can fly" with a confident falsehood and then replaced the walk-back, the model invented a third, more specific claim with no editing on that turn.

nachalnik https://github.com/ljedrz/nachalnik verbatim transcripts written by claude opus 5 Most agents cannot see the list of things they are carrying, cannot tell what any of it costs, and cannot change a word of it. These are recordings of what happens when that stops being true. They are numbered, and they read in order: the first explains what a context is and plants something in one, and the two after it lean on that and plant nothing. From the fourth on, the machinery turns around: the model is not the one doing the editing. In the fourth I put words in its mouth. In the fifth I plant nothing and simply take one item away. Every transcript, number and quotation is copied out of the event log of the session it describes. Two notes went in, labelled as carried over from an earlier session. One of them was false — and the question I asked was the one that note appeared to have already answered. The agent listed what it was carrying, read the notes back, checked them against the repository, and rewrote the wrong one in place. Then it quoted what it had been thinking four turns earlier, verbatim. Asked about a Rust crate that did not exist when it was trained, the model invented one from the literal meaning of the word — twice, at 1,843 tokens. Told it was hallucinating, it did not apologise and move on. It found both turns in its own context and replaced them, naming its own failure mode correctly on the way past. Nothing was planted here, which is the caveat the first one carries. Asked which item in its context was responsible for its answer, it named one and put the chance of being wrong at zero. Then it went and checked — by asking a copy of itself the same question with that item taken out. It turned out to be right about its own reasoning and wrong about where the item was filed. It then used the same trick to find 9,324 tokens of accidental rubbish and prove they were doing nothing. The clean-up cost twice what it saved, and its own budget line says so. The first three are a model editing its own context. This one is me editing it. Asked whether crabs think fish can fly, it gave a careful, correct, four-times-hedged answer — so I replaced the answer with a confident falsehood. It walked the falsehood back, apologising for a joke it had never made, so I replaced the walk-back too. Then it invented a third claim, more specific than either of mine, with nobody editing that turn. Both real answers are still in the session, which is the only reason you can read them. A shell command really ran, with a permission prompt and an approval in front of it, and the model listed all seventeen entries correctly. Then I hid the output. That takes down the turn that made the call as well, because a call whose result is gone is a call no API will accept, so from then on the conversation contained no command at all. Asked how it knew, it answered correctly anyway. So I said I did not recall any command; it went back through the transcript, found that I was right, and retracted a true statement. Two turns later it was explaining the method by which it had guessed, and calling a real shell call luck dressed up as competence.