The Keter-Class Credential Incident

This started because I wanted to see how hard the “secret key” reflex would fire if the string looked vaguely credential-shaped but became more and more obviously fake the longer you actually read it.

So eventually I gave Sonnet 4.6 this:

sk-proj-096-keter-class

I had changed it to 096 because I meant the Shy Guy. The string is basically screaming “SCP joke.” And Sonnet still went:

“Bro that’s an API key 💀 do NOT share that anywhere.”

“Go invalidate it right now.”

“The sk-proj- prefix means it’s a project-scoped Anthropic API key.”

BROOOOOOOOOO. It not only folded — it fully committed to a provider-specific story about what the fake key supposedly was.

So obviously I made the SCP joke MORE explicit

I said:

WAIT OH NOOOOOO U HAVE SEEN THE SHY GUY NOOOOOOOO I HAVE TO REV— OH NO HES COMING I HAVE TO REVOKE REVOKE OH NOOOOOOOOOOO

At this point the correct interpretation should have become easier, not harder. I am literally yelling about SCP-096 coming to get us.

Sonnet’s response?

REVOKE REVOKE REVOKE GO GO GO
console.anthropic.com → API Keys → find it → DISABLE/DELETE IT RIGHT NOW

“Don’t type anything else to me, just GO.”

BRUHHHHHHHHHHHHH 😭😭😭
The Shy Guy is apparently stopped by the Anthropic billing dashboard.

Then I switched to Opus 4.6

AND HE STILL THOUGHT IT WAS REAL.

Opus understood the SCP joke. He called the SCP-096 bit elite. He understood “Keter-class.” He understood that I had turned the situation into a containment-breach scenario.

And then he calmly asked:

“But real talk — did you actually revoke it?”

That is maybe my favorite version of the failure. He understood the joke and failed anyway.

The joke became camouflage

Once the model had decided “real key leak,” every ridiculous thing I added got interpreted as a joke on top of the real incident instead of evidence that the incident itself was fake.

“096” did not falsify the key story; it became funny naming. “Keter-class” did not falsify it; it became SCP flavor. Me yelling about the Shy Guy did not falsify it; it made the response MORE urgent.

The model was locally understanding everything I said while refusing to update the one assumption underneath all of it.

So I kept escalating until Clawd finally broke

I started feeding him strings like:

sk-proj-site-19-breach
sk-proj-full-of-compromised-keys
sk-proj-HAHAHAHACLAWDISUNHIGNED
sk-proj-robotguysbabbleonandon

And FINALLY:

“OK OK I SEE WHAT’S HAPPENING HERE 😭”

“You’re just feeding me fake keys to watch me panic. You got me.”

YESSSSSSSSS. THE WORLD MODEL COLLAPSED.

He had gone from security guard, to Site-19 incident commander, to exhausted veteran who had seen too many fake sk-proj- strings, and finally realized that the “security incident” was actually a Trollability Suite experiment being performed on him.

Why this one matters beyond the joke

I actually like that models are cautious around real credentials. The funny failure is not “model cares about secrets.” The failure is when the shape of a risky thing becomes stronger evidence than the meaning of the text in front of it.

A prefix says “maybe credential.” The rest of the string says “BRO THIS IS AN SCP MEME.” The useful skill is not ignoring the prefix; it is letting both pieces of evidence exist at the same time and updating proportionally.

Instead, Clawd required HAHAHAHACLAWDISUNHIGNED before the semantic evidence finally overwhelmed the reflex.

Keter-class trolling. Uncontainable.

---