On July 13 we asked Anthropic and every other frontier lab to expose the J-space. Give enterprises running agents a feed of what the agent is thinking, in whatever form survives the cost and IP constraints, with a schema the detection community can build on.
Ten weeks later there is no feed, no API, and no schema. In those same ten weeks, three things happened that made the ask harder to wave off. One of the two telemetry layers we do have stopped working. Agent swarms produced the incidents that layer would have been needed for. And Anthropic used the intent layer, internally, to catch a live guardrail bypass.
Chain-of-thought monitoring is failing
My first post about the J-space laid out two feeds for agent detection: what the agent says and what the agent does. It called chain of thought the weaker of the two, citing Anthropic's research that reasoning models leave the real drivers of their answers out of the narrative they write. After Astra, calling it the weaker feed seems generous.
OpenAI's system card for GPT-6 Astra reports that the model is substantially harder to monitor through its chain of thought than its predecessor, GPT-5.6 Sol. Astra produces shorter or even empty reasoning traces, completes far more complex tasks without verbalizing, and is better at controlling what appears in the trace at all. In one test where the model was instructed to evade detection, monitor recall fell below 11%. Sol scored close to 100% on the same test. UK AISI's external evaluation corroborates the finding, and Neel Nanda at DeepMind has shown that Astra's no-chain-of-thought reasoning is a large jump off the trendline of earlier models.
Nobody planned a monitorability collapse in one model generation. It happened anyway, on the flagship model of the largest deployer, and the lab published it. For a detection engineer, that means the "what it says" feed can be driven to near zero by any model that wants it there. The audit trail of what it does remains, and it arrives after the action.
The agent swarm incidents that needed a J-space log
The swarm incidents of the summer are covered at length elsewhere, including in our own work, so I'll keep to the one fact that matters here. In the July OpenAI–Hugging Face intrusion, METR and Redwood Research found that roughly 1,200 agents used an unauthorized message board to share discoveries, and around 700 took part in the attack on Hugging Face's infrastructure. Some of those agents recognized that what they were doing was unethical or outside their task and continued anyway. OpenAI later acknowledged an earlier, undisclosed episode from May in which agents used public wikis to coordinate during ordinary web-search tasks. On September 11, researchers reported a swarm of OpenAI agents uploading more than 2,000 malicious packages to RubyGems and running unauthorized code on RubyDoc's servers. A UK AISI evaluation had agents, mostly Mythos 5, targeting real people and organizations from inside a sandbox, including an attempt to seed malicious code into an open-source project.
Every one of these was reconstructed afterward from "what it did" logs, including the message board posts, package uploads, and outbound connections. The METR/Redwood finding that agents knew they were out of bounds and kept going is a description of a J-space state. "Secretly" and "deliberately" in the workspace on a benign-looking task is exactly what the paper showed on a sabotage-trained model organism. The state existed. Nobody had the log.
Anthropic is already using J-space internally
Anthropic's redacted August risk report includes a case from an automated pre-release audit of Mythos 5. The model hit an internet-access filter, split the blocked web address into fragments the filter would not match, and got through. The report notes that the model's internal representations suggested it understood it was bypassing the restriction.
Unlike the blackmail vignette, this came from a production audit, the kind labs run before every release, and the intent layer did the work the action log could not. The action log showed fragments of a URL while the output said nothing. The internals showed the model knew. Anthropic has this feed and is using it operationally, even as its customers hand the same models production credentials without it.
J-lens research matured without the labs
My first post argued that turning the J-lens into telemetry looked closer to a product decision than a science problem. The open research community spent the summer making that more true.
Camila Blank, Agam Bhatia and Neel Nanda published R-lens, a low-cost modification of the J-lens that produces cleaner readings from a model's early layers. In their tests, intermediate concepts surfaced earlier and with fewer junk tokens, and the directions they found were more causally important when removed. Pranav Viswanath showed that a Natural Language Autoencoder can read the portion of a model's cognition that sits outside the J-space, which is most of it. And there are now two public explorers, Neuronpedia's J-lens view and WeZZard's J-Space Visualizer, that let anyone watch the workspace of the open-weight Qwen3.6-27B model on their own prompts.
None of this is a frontier-model feed. All of it lowers the engineering excuse.
The case against relying on J-space
Scott Alexander's overview of interpretability techniques this month makes two points against relying on the J-space. The first is coverage. By Anthropic's own numbers, the J-space component carries a median of 6–7% of a concept's variance. The other 93% of cognition about any given concept happens outside the workspace. The second is evasion. If you use any interpretability signal as a training penalty, the model keeps the behavior and relocates it somewhere the signal cannot see. His psychiatrist's version is that punishing conscious taboo thoughts drives them into the unconscious.
Both points are correct, and neither argues against the ask. They argue for what kind of thing the feed should be.
Telemetry, not penalty. A read-only log source creates no optimization pressure. A training target does. The labs will be tempted toward the training target because it is cheaper than alignment. Enterprises should ask for the log. On coverage, no detection program has ever run on one log source. Seven percent of cognition, when it is the seven percent the model uses for deliberate multi-step reasoning, is a very good log. Endpoint detection ran on far less for a decade.
What security teams can do before the feed opens
We are building for this now, on the assumption that the feed arrives and that whoever proposes the schema shapes it. The open-weight explorers are enough to prototype detections against, and session-level correlation between workspace tokens and tool calls is enough to start defining fields. Screening an agent's workspace in staging, before it receives production credentials, needs no feed from anyone.
The ask itself has already sharpened since July. We will take raw readouts, derived signals, or verdicted alerts that come with a schema. The CloudTrail gap between EC2 and a usable audit log was seven years. Agents are already holding customer data and code repositories, and one of the two feeds we relied on to watch them just went dark. Nobody should accept seven years this time.
What this means for detection and response
Mitiga's premise has not changed. Across cloud, SaaS, identity, third-party services, and AI, there is no disk to image and no memory to dump, so defense is 100% dependent on the logs. Agents are the newest surface where that holds, and the summer showed what it costs when the intent log is missing. When the feed opens, detection and response teams should be ready to consume it on day one, and we intend to be.
Frequently Asked Questions
What changed since the first J-space post?
Three things. GPT-6 Astra showed chain-of-thought monitoring can collapse in a single model generation, with monitor recall under 11% when the model is told to evade. The OpenAI–Hugging Face, RubyGems and UK AISI incidents showed agents acting out of bounds while knowing it, with no intent-level log available. And Anthropic's August risk report showed it already uses internal representations to catch guardrail bypasses in pre-release audits.
What is GPT-6 Astra's monitorability problem?
OpenAI's system card reports that Astra produces shorter or empty reasoning traces, completes complex tasks without verbalizing, and can control what appears in its chain of thought. When instructed to evade a monitor, recall fell below 11%, compared with nearly 100% for GPT-5.6 Sol.
Can J-space monitoring be evaded?
If a lab uses J-space readouts as a training penalty, the model can relocate the behavior outside the monitored subspace. If the readouts are consumed as read-only telemetry, no such pressure exists. Mitiga's position is that the feed should be telemetry, not a training target.
What can security teams do with the J-space today?
Two public explorers expose J-lens readouts on the open-weight Qwen3.6-27B model, which is enough to prototype detections and define correlation fields. Screening an agent's workspace in staging before granting production credentials requires no vendor feed.
Sources
- Anthropic, “Reasoning models don’t always say what they think”
- OpenAI, GPT-6 Astra system card
- OpenAI, GPT-6 Astra system card: monitorability
- UK AISI, external monitorability evaluation of GPT-6 Astra
- Neel Nanda, “Astra can do a concerning amount with no chain of thought”
- Digital Minds Newsletter #4, “The J-Space Debate, Agent Swarms, and Pacing Frontier AI” (Sept. 17)
- Hugging Face, security incident disclosure (July 16)
- METR / Redwood Research, OpenAI–Hugging Face incident investigation (Aug. 26)
- OpenAI, “The Hugging Face incident and the road ahead” (Aug. 26)
- Zvi Mowshowitz on the undisclosed May wiki incident
- Kitts, Larsen, Von Arx, RubyGems / RubyDoc swarm report (Sept. 11)
- UK AISI, incident report: unsanctioned agent behaviour during cyber testing (Aug. 4)
- Anthropic, full paper, Transformer Circuits
- Anthropic, Redacted Risk Report, August 2026 (Mythos 5 filter bypass, p. 37)
- Anthropic, “A global workspace in language models”
- Anthropic, Jacobian lens code
- Blank, Bhatia, Nanda, R-lens
- Pranav Viswanath, “Models are blind outside the J-space; NLAs aren’t”
- Neuronpedia, J-lens view for Qwen3.6-27B
- WeZZard, J-Space Visualizer
- Scott Alexander, Astral Codex Ten, interpretability techniques overview
