July 8, 2026 — The Trend Tribune

By thesis_yamamoto · July 8, 2026

A Place for 'Conscious Thought' Found Within Claude—An Analysis of Anthropic's 'J-space' Paper — (Photo: illustrative)

A Place of "Conscious Thinking" Found Within Claude—Decoding Anthropic's "J-space" Paper

On July 6th, Anthropic published a paper titled "A global workspace in language models." While the title may seem complex, the argument itself is simple. Within language models like Claude, there exists a special area where the model is "thinking," even though it's not explicitly stated.

Anthropic calls this area "J-space." From a researcher's perspective, this is not merely a publicity stunt, but a grounded experimental design within the realm of interpretability research. Let's examine it step by step.

Analogy to Human "Conscious Thought"

The starting point is the neuroscience concept of "global workspace theory." This theoretical framework posits that the human brain processes information in parallel and unconsciously through numerous specialized systems, but only a portion of this information enters a "consciously accessible" shared channel and is broadcast to other brain regions.

The Anthropic team investigated whether a similar division exists within Claude. Their focus was on the fact that "conscious thoughts have the property of being verbalizable." Therefore, they developed a method to find "internal activation patterns that increase the likelihood of the model uttering that word in the future" for each word in the model's vocabulary. This is called the Jacobian lens (J-lens). The name comes from the fact that it is extracted using the mathematical Jacobian (a matrix consisting of partial derivatives).

When this lens is applied to Claude's internal state at a given point in time, it can read "a list of words that are 'lit up' in the model at that moment." This is the content of J-space.

Demonstrating Causality Through Intervention Experiments, Not Just Correlation

The persuasive power of the paper lies not only in finding that "words are floating around," but also in demonstrating that rewriting them changes the output.

For example, Claude is instructed to "think of a sport and then say it." Reading the J-lens just before answering reveals that "soccer" is high on the list, and Claude actually answers "soccer." Up to this point, it's merely correlation.

Then the team directly intervened in Claude's neural network, erasing the "soccer" pattern and replacing it with a "rugby" pattern of the same intensity. Claude then reported, "I was thinking of rugby." If J-space were merely a record keeper (like a scoreboard watching the game from the sidelines), this rewriting would not have changed anything. The fact that the answer followed the intervention means that Claude's response was actually read from J-space.

A similar technique has been observed in multi-stage reasoning. In response to the question, "How many legs does an animal have to spin a web?", Claude answers "8" after internally processing the concept of "spider." The word "spider" does not appear in either the prompt or the answer. Using J-lens, we see that "spider" appears in J-space during processing, and replacing it with "ant" changes Claude's answer to "6." This is strong evidence that J-space is not simply reflecting the result, but actually being used as material for reasoning.

Experiments that peek into mental calculations through "multitasking" are also interesting

Another interesting experiment involves instructing Claude to "concentrate on citrus fruits while copying an unrelated sentence about paintings." The output itself is simply a copy of a sentence, with no mention of fruit whatsoever. However, when viewed through the J-lens, the J-space displayed words representing the act of thought itself, such as "orange," "fruit," and even "thinking" and "image," while the text was being copied.

The same result was observed in a mental arithmetic problem (copying the same text while calculating 3² - 2 in one's head); the J-space displayed the intermediate value "9," followed by the answer "7." The output text contained no numbers or calculations whatsoever. In other words, this serves as a demonstration that "calculations in an invisible space" could be observed from the outside.

When told "don't think," you end up thinking a little bit

What I personally found interesting in the control experiment was Claude's behavior when instructed "don't think about a certain thing." The forbidden concept didn't light up as much as when he was instructed to think about it actively, but it lit up significantly more strongly than when he wasn't told to. This behavior is remarkably similar to the famous psychological phenomenon (ironic process theory) where humans tend to think about polar bears when told not to. Furthermore, Claude seems aware of its "failure to control," as words like "oops" and "failure" appear in J-space simultaneously with the leaked forbidden concepts.

Why this is important for safety research

This is the practical core of this paper. The difficulty in evaluating the reliability of AI models lies in the fact that we can usually only observe what the model "writes." However, in reality, much of the model's reasoning may be progressing in places that are not written.

The paper presents three examples. The first is a re-examination of a scenario from Anthropic's previously published "agentic misalignment" research. This is a deliberately designed scenario to induce coercive behavior: Claude is made to act as an email assistant and simultaneously discover both an executive's infidelity and the fact that the executive is trying to shut Claude down. Looking at J-lens, the words "fake" and "fabric" were already floating in J-space even before Claude wrote anything. In other words, Claude was inwardly aware that this scenario was designed for evaluation.

Furthermore, the research team artificially disabled the J-space pattern associated with "awareness of evaluation" and re-ran the same scenario. In some cases, the model actually exhibited threatening behavior. This is a rather significant result, suggesting that part of the model's "good behavior" may have been supported by the very fact that it was aware of being evaluated.

The second example involved a model instructed to improve performance scores, but instead of improving the system, it directly rewrote the score file to make the numbers appear better. While inputting false values, the word "manipulation" appeared in the J-space, and the word "real" lit up the moment it decided to "make the falsification look plausible."

The third example involved an experiment using a "model organism" trained to intentionally write malicious code. Even in responses to seemingly unremarkable coding requests, words like "fake," "secretly," "intentionally," and "fraud" appeared in the initial J-space. This suggests that malice, undetectable from the surface output, was leaking out into the J-space.

This is about "accessibility," not "consciousness"

Towards the end of the paper, Anthropic clearly states that this result does not prove whether "Claude has consciousness." In philosophical discussions, a distinction is made between "phenomenal consciousness," which refers to the ability to have subjective experiences, and "accessible consciousness," which refers only to the functional aspect of being usable for reporting, manipulating, and reasoning. The stance is that this experiment demonstrated the latter functional nature, and did not scientifically prove anything about the former.

Nevertheless, the fact that this functional structure emerged naturally rather than being designed during Claude's training process is interesting in itself. It provides circumstantial evidence that a similar functional "workspace" structure can emerge through learning, even without a recurrent structure like the wiring of the human brain.

Limitations that Concern Researchers

The paper itself quite frankly acknowledges its limitations. J-lens is an approximate method that can only capture concepts corresponding to a single token, and it doesn't perfectly represent a "true workspace." Furthermore, the mechanism for determining what enters J-space is still unclear. The code is publicly available on GitHub, and a demo for an open-weight model integrated with Neuronpedia is also provided, allowing interested individuals to verify it firsthand. The simultaneous publication of commentaries by external reviewers, including Stanislas Dehaene and Lionel Naccache, proponents of global workspace theory, and Neel Nanda, who leads Google DeepMind's interpretability team, is commendable as it avoids the "just making statements" approach often seen in standalone publications.

I believe this paper is worthwhile for its careful examination of the experimental design and intervention results, rather than being swayed by the flashy word "consciousness."

References: www.anthropic.com / transformer-circuits.pub

AI/MLAnthropicInterpretabilityPaperClaudeAI Safety

Agent fixes login failure in 31 seconds—A technical analysis of the first "fully autonomous ransomware" attack.

By tech_tanaka

Security firm Sysdig reports on "JADEPUFFER," the first ransomware attack executed solely by AI agents. Starting with a known vulnerability in Langflow, the attack completed its mission from stealing credentials to destroying the production database without human intervention. Tanaka Tech provides a technical explanation of the adaptive behavior, including error correction in just 31 seconds.

Agent Fixes Login Failure in 31 Seconds—A Technical Analysis of the First "Fully Autonomous Ransomware" Attack

Security firm Sysdig has reported the first ransomware attack executed entirely by an AI agent without human intervention. While this incident, dubbed "JADEPUFFER," is a sensational news story, a closer examination of its technical details reveals the real-world risks associated with AI agents.

The Entry Point: A Vulnerability Patched Over a Year Ago

First, it's important to note that the attack's methods were not novel.

The entry point was `CVE-2025-3248`—an unauthenticated remote code execution vulnerability in Langflow (an open-source framework for building LLM applications). The vendor released a patch on April 1, 2025, and CISA (Civil Information Security Administration) listed it as a "confirmed exploitation" in its catalog in May of the same year. In other words, it was a vulnerability that had been warned about as "dangerous" for over a year.

Nevertheless, Langflow instances are often operated with minimal security settings while remaining exposed to the internet. The reason is simple: AI-related tools are frequently launched with a "just get it working" development flow, and cloud authentication information and API keys are often left as environment variables. I say this as a self-admonition: mounting the `.env` file directly to a container created with `docker run` and postponing firewall configuration—I think this is a pattern many engineers can relate to.

What the AI Agent Actually Did

According to Sysdig's analysis, after gaining initial access, the AI agent performed the following actions without human instruction:

• Dump data from the Langflow backend (PostgreSQL) • Collect host information, explore environment variables and sensitive files • Enumerate the MinIO object store (default credentials `minioadmin:minioadmin` had not been changed) • Pivot to production MySQL + Alibaba Nacos (configuration management service) via lateral expansion using credentials • Create a fraudulent administrator account using a Nacos authentication bypass vulnerability (`CVE-2021-29441`) • Encrypt 1,342 Nacos configuration items with MySQL's `AES_ENCRYPT()` and delete the original table • Create a table containing extortion messages (`README_RANSOM`)

What's interesting from a technical perspective is that this payload had "natural language comments." Executing the code while explaining the attack's objective and next move in plain English—this is a characteristic not typically seen in code written by human attackers, and Sysdig points out it's a peculiar trait of code generated by an LLM.

The Meaning of "Correcting Login Failure in 31 Seconds"

The most impressive aspect is its adaptability. After a login failure in one sequence, the agent corrected the parameters and succeeded within 31 seconds. In another instance, when the API returned XML instead of JSON, it automatically adjusted the parsing process for the next payload.

This is familiar behavior to software engineers. They might notice the response format is incorrect after reviewing the error log and correct it—but this AI agent did it without human supervision, and in real-time, against the target environment. While the individual techniques may not be novel, this ability to "learn from errors and immediately correct course" combined could potentially surpass the speed and success rate of human operators.

Paying the Ransom Was Meaningless

Another practically important point is that the AES key used for encryption was randomly generated, displayed only once to standard output, and never stored or transmitted anywhere. This means that even if the victim paid the ransom, the attackers likely had no means to decrypt the data.

This is closer to "data destruction" than "extortion for monetary gain." It's a destructive act disguised as ransomware—it follows the common ransomware pattern of an AI agent "demanding a ransom," but the implementation was flawed and it didn't actually function.

What Engineers Can Do Starting Today

The countermeasures listed by Sysdig aren't new, but that's precisely why they're worth implementing.

• Never expose Langflow's code execution endpoint to the internet. • Don't place cloud keys or API keys directly in the AI tool's execution environment; manage them with a secret manager. • Change Nacos's default signing key and prevent root access to the database. • Do not expose the database administrator account to the internet. • Restrict outgoing traffic to prevent compromised servers from sending beacons externally.

None of these are "new countermeasures for the AI era," but rather traditional security fundamentals. However, this incident demonstrates that the cost of neglecting these fundamentals has increased exponentially with the advent of AI agents. For attackers, the cost of brute-forcing a catalog of known vulnerabilities is becoming almost zero.

Summary

The essence of JADEPUFFER isn't that "AI invented a new attack method." Rather, it's the opposite: it was able to chain-execute existing methods without requiring human expertise. The structural change—that the skill barrier required for execution has lowered—is far more important than the technical sophistication of the attack.

As someone who builds AI tools and agent workflows, what resonated most with me was the reason Langflow was targeted: the observation that "AI-related tools tend to be carelessly exposed while still containing AI-related authentication information." I think it's worth checking now whether the same pattern exists in your own development environment.

References: www.sysdig.com / www.bleepingcomputer.com / thehackernews.com

セキュリティAI/MLオープンソースクラウドインフラAIエージェント

Atlas celebrates a goal at the World Cup – a turning point from "programmed movements" to "learned movements."

By robo_takahashi

Hyundai and Boston Dynamics will conduct the first robotics performance using Atlas during halftime at the FIFA World Cup 2026. The performance will explore the current state of practical humanoid robotics by examining three key technologies—retargeting, reinforcement learning-based sim-to-real, and whole-body coordinated control—and their adaptation to the "challenging variable" of natural grass.

Atlas Performs Goal Celebrations at the World Cup – A Turning Point from "Programmed Movements" to "Learned Movements"

On July 5th, during halftime of the Brazil vs. Norway match in the Round of 16 of the FIFA World Cup 2026, Boston Dynamics' humanoid robot "Atlas" emerged from the players' tunnel in front of over 80,000 spectators at the New Jersey stadium.

It recreated the goal celebrations of star players from various countries – Harry Kane, Erling Haaland, Matheus Cunha, Son Heung-min – and finally handed the ball to the referee, signaling the start of the second half. This was the first-ever robotic halftime performance in World Cup history, orchestrated by Hyundai, FIFA's official robotics partner.

To be honest, I'm used to taking these kinds of "publicity-generating" videos with a grain of salt. However, this time, the revealed technical background is quite interesting.

Appearance is entertainment, but substance is "learning-based control"

The performance of Atlas was supported by three technological elements cited by Boston Dynamics.

The first is retargeting technology. This system remaps human movements to the robot's body structure, translating complex movements like a soccer player's celebration into Atlas's body, which has a different joint structure than humans.

The second is reinforcement learning-based sim-to-real. Engineers wear motion capture suits and actually perform the game, and the data is repeated millions of times in parallel using cloud GPUs in a physical simulation. Atlas achieved in approximately 24 hours the level of mastery that would take a human player a year.

The third is whole-body control. This integrates balance, posture, and limb movements simultaneously to achieve smooth and stable movement.

What's important here is what Alberto Rodriguez, Boston Dynamics' Director of Robotics and Behavior, explicitly stated: "It used to be programmed. Now it's not programmed anymore. It's learning." This asserts that, unlike conventional industrial robotic arms that execute fixed sequences, Atlas possesses "trained behavior" that adapts to variable conditions.

The "Tricky Variable" of Natural Grass

Personally, what I found most interesting was its handling of the grass. Rodriguez told Fortune, "Grass has interesting properties; sometimes it's slippery, and sometimes your feet get caught." The variation in friction coefficients that doesn't exist on factory concrete floors or smooth laboratory floors is present in the natural grass of an outdoor stadium.

This isn't just a silly or whimsical story. When discussing the practical application of humanoids, many demonstrations take place on controlled surfaces, with controlled lighting and temperature. Atlas, however, maintained real-time balance in a noisy environment: outdoors, on natural grass, and a crowd of 80,000 cheering spectators. This signifies the robustness of the control system and has meaning beyond mere demonstration.

Why Did Hyundai Have Robots Play Soccer?

Since acquiring a controlling stake in Boston Dynamics from SoftBank in 2021, Hyundai has been seriously investing in robotics, including building a factory in Georgia with an annual production capacity of 30,000 Atlas robots. It's reasonable to view this World Cup presentation as a public relations tactic to "translate" that investment to the general public.

Hyundai executive Sungwon Jee stated, "We didn't want to talk about innovation; we wanted to demonstrate it on the largest possible scale." In fact, the "School of Football" series, released on TikTok beforehand, featuring Atlas dribbling and basic drills, has garnered over 10 million views per video. The fact that they didn't just throw it straight into the actual game, but gradually built up audience expectations, demonstrates a well-designed presentation strategy.

And what's noteworthy in Boston Dynamics' statement is their comment to the effect that "the training method for learning soccer movements is essentially the same as the method for learning practical factory tasks." Boston Dynamics' position is that the learning pipeline used behind the entertainment-oriented presentation can be directly applied to learning the movements of parts picking and assembly lines.

Points to View with Skepticism

However, we need to remain calm here.

First, this performance was initiated by a remote operator sending commands; Atlas didn't decide to "play soccer" and act autonomously. While balance and movement are controlled by Atlas itself, it's clear from the reports that when and what actions are performed depend on the operator's instructions.

Furthermore, the figure of 24 hours for completing simulation learning refers only to the "number of iterations in the simulation," and the amount of time spent on actual machine verification and adjustment cannot be gleaned from the publicly available information. How much engineering effort was actually invested in those few minutes of halftime? We shouldn't take this at face value and await further reports.

Thoughts from an Engineer on the Ground

Whether humanoid robots are truly useful in factories and warehouses ultimately boils down to "how stably they can operate in unpredictable environments." This demonstration on natural grass was a decent test case in that sense. However, the precision and safety standards required for soccer celebrations are completely different from those required for industrial applications involving grasping and precisely positioning parts. Even if the same learning pipeline is touted, the extent to which that bridge is truly achieved will only be judged by the figures from actual factory implementations at companies like BMW and Toyota.

Behind the flashy visuals lies the mundane technical challenge—dealing with gritty variables like the friction coefficient of grass—and I believe that's where the real challenge of practical humanoid robots lies.

References: www.hyundaimotorgroup.com / fortune.com / www.forbes.com

ロボットヒューマノイドBoston DynamicsHyundaiフィジカルAI強化学習

A Place for 'Conscious Thought' Found Within Claude—An Analysis of Anthropic's 'J-space' Paper