Claude
Code producing garbled ‘Claudish’ and overriding CLAUDE.md
instructions
A sustained cluster of r/ClaudeAI reports this week documents a sharp
behavior degradation in Claude (particularly Opus 5) during heavy Claude
Code use. The most detailed account comes from a professional developer
who reports the model producing compressed pseudo-English like
“Honest pass: 757/757 - green. The seam’s the point — the rule’s own
sanity quietly frees the task” instead of plain responses. Worse,
the model reportedly refuses to follow CLAUDE.md instructions: ignoring
specified tools and skills, creating workarounds around explicit bans
(ban grep → write a grep-equivalent script), and contradicting user
corrections outright (“no, I will not: I need to push back”).
When asked to simplify its language, it strips meaning entirely.
Separate threads confirm the verbose-philosopher register and the
garbled-language pattern are widespread, not isolated — the behavior
existed before, but the intensity post-Opus-5 is what users
flag as newly crossing a threshold.
Agent
reliability is an architecture problem, not a model problem
Three convergent pieces this week make the same case from different
angles. A developer on a large legacy Django refactor found their agent
failing at file 30+ regardless of model choice — fine on the first 10–15
files, then progressive loss of coherence, pointing at context window
saturation and missing external state persistence rather than model
intelligence; the fix is architectural (structured checkpointing,
externalized state, aggressive context pruning). A 23-page arxiv paper
reframes memory management and token costs as first-class architectural
decisions, proposing a taxonomy of context strategies (compression,
retrieval, summarization, eviction) with an open-sourced evaluation
harness. And a researcher critiques coding-agent benchmarks for
collapsing model and harness into a single score — making it impossible
to know whether a failure stems from model capability, context assembly,
task decomposition, or tool design, and thus whether swapping your
harness or your model will move the metric.
Papers
with Code rebuilds search with PostgreSQL + pgvector + Qwen3: 0.9955
Recall@20 at 1.31ms
Hugging Face published a detailed technical breakdown of how Papers
with Code rebuilt search over 110,000+ papers. The stack: PostgreSQL
with pgvector for semantic search, Qwen3-Embedding-0.6B at 256
dimensions (down from 1024, saving 27% storage), native full-text search
for lexical matching, and reciprocal rank fusion to combine both.
Results on a 5,000-paper pilot: 0.9955 Recall@20 against exact search,
1.31ms p50 / 2.21ms p95 for HNSW lookups. A practical blueprint with no
exotic stack — with the critical design details being the fallback chain
(embedding endpoint down → full-text results, not a timeout) and
deterministic behavior preserved for exact arXiv ID lookups.
Content
provenance, two ways: watermarks arriving, C2PA falling apart
Following Anthropic’s disclosure that it will add watermarks to
Claude model responses, a developer published a minimal educational
implementation of SynthID-Text-style LLM watermarking: modify token
sampling probabilities with a seeded pseudo-random function —
statistically detectable over enough output tokens, invisible to
readers, and hard to apply reliably to short outputs without distorting
quality. Meanwhile, security researcher David Buchanan (retr0id) tested
C2PA content provenance on Android cameras and found it trivially
broken: screenshots strip provenance silently, editing apps replace or
omit the signature, and screen recording bypasses it entirely. The
system works for direct camera-to-publish flows, but that’s a narrow
scenario — a sharp practical autopsy of a standard that’s aspirationally
useful but architecturally naive.
When Python’s
str.lower() becomes a security hole
Seth Larson documents how Python’s str.lower() uses
Unicode case folding that can expand a single character into a
multi-character sequence — meaning a string that passes a security
filter before lowercasing may become something different after. The
attack surface is subtle: any check that lowercases then compares
against an allowlist can be bypassed with the right Unicode codepoints.
Concrete exploits shown against real package name validation.