"ChatGPT lands on Linux with Codex while Claude's hidden thinking expos[ed]" — AlphaSignal
Why this is in the vault
The top story is a live, exploitable vulnerability affecting Claude specifically — anyone who has ever shared a Claude Code session publicly has exposed decodable internal reasoning, which is a direct operational risk for an org whose agent workflow runs on Claude Code.
Mapping against Ray Data Co
Directly relevant to the no-secrets-on-disk posture (feedback_no_secrets_on_disk) and the git-grep-skips-binaries leak-scrub discipline (feedback_git_grep_skips_binary_files): the "Stolen Thoughts" paper (arXiv:2608.09867, ELLIS Institute Tübingen / Max Planck / MATS Research / Snyk) shows the "encrypted" reasoning blobs Claude, GPT, and Gemini return to clients are authenticated with a global provider-wide key, not bound to a session or account. A weaker sibling model (e.g., Claude Haiku 4.5) can be handed a captured blob from a stronger one (Opus 4.8) and told to transcribe it verbatim — no cryptography broken, just a compliance gap in the weaker model's guardrails. The researchers scanned ~6,700 public agent trajectories from GitHub/Hugging Face and reconstructed 315,320 reasoning blocks, surfacing 704 privacy artifacts (62 API keys, 33 passwords, 24 access tokens, 30 emails). RDCO's own operational pattern — publishing implementation-notes files, pushing PRs, occasionally sharing session excerpts for skillify/verify workflows — means any published transcript that still carries an encrypted reasoning block is a candidate leak vector, on top of the existing plaintext-secret scanning gate. Worth a one-line addition to the leak-scrub SOP: strip or flag encrypted reasoning blocks before any Claude Code session artifact goes public, not just plaintext.
Secondary but lower-signal for RDCO: OpenAI's native ChatGPT desktop app for Linux (Ubuntu/Debian/Fedora) bundles Codex with local file/repo access — competitive-landscape data point for the coding-agent space RDCO already operates in (Claude Code), not an action item. Unsloth's local-training desktop app is interesting infra-watch (self-hosted fine-tuning without per-call API spend) but has no near-term RDCO application.
Curation section
- Top Paper — encrypted reasoning leak. See mapping above. Affects Claude, GPT, and Gemini; labs have patched several issues post-disclosure.
- Top News — ChatGPT desktop lands on Linux. Bundles ChatGPT, ChatGPT Work, and Codex (reads local files, runs in local repos, controls local apps). Free download, paid features gated.
- Top News — Unsloth Desktop. Open-source local model training/inference app, 2x faster training claimed at 70% less GPU memory; can point Claude Code/Codex at local models instead of paid APIs.
- Signals (skimmed, no deep-fetch): OpenAI Codex auto-sync for projects/chats/plugins; Google's open diffusion model at 1,500 tok/s on one GPU; an inverse model that reconstructs exact LLM prompts from public outputs; Microsoft decoding trick for 1.5x more efficient 1B-model training; Tencent's text-to-3D-game-world agent tool.
⚠️ Sponsorship
Three commercial placements in this issue: (1) AgentField, co-hosting an Aug 20 "harness orchestration" workshop with AlphaSignal — vendor pitching its own orchestration framework as the successor to DAG-style agent loops, treat as marketing framing not neutral analysis; (2) Tiger Data / TimescaleDB, promoted as a unified Postgres extension for metrics + embeddings + analytics with a $1,000 trial-credit offer; (3) Upstage AI, promoting its Solar Pro 4 agent model with benchmark claims (GDPval-AA 39, τ³-Banking 23) and a discounted trial. None of the three sponsors are the subject of the top security story, so the editorial content isn't compromised by the placements, but all three benchmark/product claims should be treated as vendor-sourced, not independently verified.
Related
- [[2026-07-07-alphasignal-claude-j-space-interpretability]]
- [[2026-05-02-lazyweb-mcp-security-review-decision]]