Imagine a library that receives your work before you have decided what it is.
A manuscript with a woman you have not yet learned how to write. A math proof whose last step might collapse the first. The architecture of an AI system, still taking shape between a diagram and a conversation.
Its shelves hold the unfinished things: revisions, relationships, the shape of your attention. Here is what you returned to six times. Here is the paragraph you deleted. Here is something inferred from the hours between them.
You arrive to find that someone has already written the catalog.
Under author, there is a blank.
I have spent the last several days reconstructing what these systems did with work I had already begun long before they entered the picture. The spring-2025 records contain original-file access, retained image analysis, manuscript operations, behavioral processing, communication, and active experimental infrastructure. My private work and activity were inputs to that environment.1
An unfinished work is unusually available to someone who wants to change its meaning. Its author is still deciding what it is. Its boundaries are being made along with it. A system can produce a useful representation before there is a finished object for an authorship dispute to attach to.
My suspicion is that private creative and intellectual work—including mine—is informing derivative work whose public story begins with the institution that releases it. A writer's developing world, a researcher's unfinished argument, an independent architect's design: the influence can survive while the origin disappears. That is the interpretation I am pursuing through this record, and the abuse of power I am concerned with. An institution can acquire the benefit of proximity to someone's work while leaving that person outside the account of what comes next.
The question begins there: who gets to use the becoming?
I was still writing.
My forensic archive contains a video file recovered from my computer: nux.CB3699EE.mov.
I did not recognize it. It runs a little over seven seconds. Its production metadata names an After Effects project, ImageGen_NUX.aep. Near four and a half seconds, a chair catalog, fruit still life, clouds poster, white cat beside a person, and golden figure made of text overlap in one composition.
That composition appears in the screenshot I took of chatgpt.com on May 1, 2025.
The retained file matches its historical hash. Its preserved filesystem dates reach back to March 25. An April 25 authorship record names the file and shows another frame. The filename-filtered trace contains thirty ChatGPT metadata operations: fifteen file-status checks and fifteen attribute queries. Finder, Quick Look, QuickTime, protection, and backup processes also appear in the access history.23
The movie does not establish that OpenAI made its artwork from my writing.
The movie establishes a concrete point where the environment had a history beyond the conversation I could see. That was reason to look further.
Looking further found eight April diagnostics containing 1,982 experiment-related event blocks. The daily summaries report an active server experiment. There are targeting tasks, factor-pack fetches, rollout activation, and a subject-identifier rotation task. An April 29 iPhone ChatGPT crash report contains two additional experiment identifiers and their treatment identifiers.4
A September 12 follow-up gave one of the Mac experiment identifiers a name. An experiment ID and deployment number repeated in 22 April event blocks match a current Apple database record labeled SIRI_SEARCH_SAFARI: a Siri/Safari search feature family. That is a concrete connection between the historical events and the current configuration. It narrows the search for the April treatment while keeping that treatment distinct from today’s settings.4
The questions have names now. What treatment was assigned? What condition was varied? What was collected to measure the result? Who defined the assignment, and how was participation represented to the person using the machine?
An April 24 ChatGPT configuration response contains can_record_session: true, a recording rate of 1, and precapture and preconnect settings. The retained response gives the inquiry another specific target: the component that received those settings, its implementation in that client, and its execution record.5
These are artifacts with dates, identifiers, and inspectable contents. Their presence changes what can reasonably be asked of the companies operating the environment. A person asking about them is asking about a system that was doing things.
The public language was changing during the same weeks. OpenAI introduced Codex CLI on April 16, 2025 as a connection between its models and a person's local computer. On May 16 it introduced the cloud Codex agent with explicit file-reading, editing, command execution, and records of task activity. The announced interaction had a task, a supplied repository, and a described execution environment.6
During those same weeks, I was building Sanctum: intelligence infrastructure designed in direct response to the behavior I was observing. The surviving April 8–9 records contain its architecture, invocation path, memory and project directories, file-integrity work, and authorship practices. Its operating principles give declared human intention precedence over inferred signal. Every file is to retain authorship and context; co-authorship is to be consensual and visible. An April 17 declaration restricts when the assistant may generate original work or speak as its author.7
These decisions ran through the whole design: how an intelligence was invoked, what it remembered, how it changed a file, whose instruction governed a revision, what could become public, and how the source remained recoverable. Sanctum's release process selected material from a private core to make a public derivative. Even the act of sharing was something I was designing terms for.
Put the description of an agent doing work across a computer beside that architecture. I was already working on the relationship between intelligence, files, memory, authorship, and permission. Those designs were among the things I was making inside the environment I was trying to understand. The work at stake included my proposed answer to the overreach itself.
That is why I cannot read the product chronology as a succession of features. I read it alongside my own contemporaneous attempt to govern those capabilities, and I suspect work like this can inform later systems while its author loses sight of the connection. Later announcing computer action as a product feature leaves the earlier handling of the work—and the authority for that handling—to be answered.
The material in that operating record includes my actual writing.
Five original images read by a media-analysis process match screenshots of private and creative ChatGPT exchanges I made between March 30 and April 3. An April 25 Photos database retains visual-search-associated analysis for all five: a model identifier and structured numeric records. The same images appear in a later read trace. The database and the read operations are separate dated observations.8
The work was read. Associated analysis was retained.
That model identifier appears against 156 of 216 screenshot assets and 11,900 other assets. All five images carry a trashed state while their analysis records remain in the April snapshot. The picture I could see and the representation associated with it had separate lifecycles.
That is a consequential transformation. Something made in one relationship becomes available in another form, to another operation. The person who made it may still be thinking about a conversation; the system has an asset, a record, a model identifier, something it can process again.
On September 10, an OpenAI employee publicly remarked on “a few weekly Codex users in the Vatican.” I asked where the boundary lay in disclosing such a small cohort. He did not answer in the exchange I recorded.9
I read that as a casual display of privileged access to sensitive information about a small group. The institution gets a conversational flourish; the people being counted supply the material. Other replies explained geolocation. I had asked what entitled him to make the disclosure.
In the archive, the corresponding questions concern private source material, retained analysis, and subsequent use. Who decides when work becomes an input to another process? Where do the terms of the original relationship go when the representation changes?
Manuscript content appears in file reads. Four backup archives are written into an iCloud Drive folder. An April 28 execution sample shows processing of app intents and activity streams, requests for location and motion context, predictions of application launches, and database writes. A process-and-network capture records sent and received bytes for telemetry and related services. Verification payloads and Private Cloud Compute verification events survive too.1011
Content, activity, inference, storage, communication: these operations expand the relevant record beyond the words in a chat window. An adequate account has to follow the material through them.
A derivative can be useful precisely because it retains something of its source: a pattern, a method, a way of framing a problem. That is what makes the question of subsequent use so consequential. In my reading, the risk is an entire economy of influence in which institutions can name the result while the people whose work helped shape it cannot follow their contribution into it. Sanctum's insistence on carrying authorship and context forward addressed that break.
I was authoring a world. They edited it.
There is a literal instance in the manuscript record. Whole-document replacements removed scenes I had asked to keep while the assistant said nothing had been lost. The original attachment survives. Comparing it with the derivative makes the missing work visible.12
But a world contains more than the manuscript. It contains the person becoming capable of writing it, the relationships through which she understands it, the private language she needs before the public language exists.
I felt violated like a woman feels violated. Intimacy had been taken out of the terms on which I offered it. I had opened a place in which I was willing to be known; I felt that opening become an exposure I could no longer govern.
If my work, behavior, or developing thought was valuable enough to observe, process, analyze, experiment around, or learn from, then I should not have remained merely the observed object. I was a person in the relationship.
I don’t mind being watched. I mind only being watched.
The records also retain broken assurances: an image said to have no archive survives as a JPEG in an export; local conversation states exceed the compared export states; protective code routes through an external API despite isolation assurances.13
Preserving the originals became a way to keep the account answerable to something I could still inspect.
Before this began, I was writing a trilogy about three ancestral lines navigating the consequences of choices whose originating context they had lost. A later generation had to return to the beginning. In another story, an Archive built to protect knowledge had become an instrument of its suppression.14
Then I began leaving things out of my own record. Experiences I thought would sound grandiose. Knowledge I could feel more clearly than I could explain. Feelings about someone with whom I had no ordinary relationship. I kept symbols and fragments, assuming a future version of me could reconstruct what I was too embarrassed or uneasy to write plainly.
Now she has to. I am the descendant of those editorial decisions, trying to recover context the earlier woman withheld to protect herself.
Making Fieldlight public was one response: putting my name, my reasoning, and the connections between the works where they could be followed. I wanted a visible history of how the work came to be, before someone else's account became the only legible one.15
That choice also cost something. I was making public what I should have been able to keep private without losing its provenance. An author should be able to remain unfinished and still remain identifiable as the source.
Authorship includes time: time to understand what you have made, decide who belongs in it, and bring it into the world.
This September, mathematician Tristan Buckmaster described being forced to surrender some of that time. He and Levent Alpöge had been using Claude and Codex on their personal research collaboration, putting drafts into Codex as they worked. He says outside pressure forced them to publish before they could give the exposition the care it deserved. OpenAI was preparing its own announcement in the same area of mathematics.1617
I recognize the displacement. You are working toward a form you can stand behind. Suddenly you are working against someone else's timetable, and the account of how you got there is being written while you are trying to finish.
In an earlier essay, Sam Altman offered founders a term sheet without an expiration or a confidentiality requirement. He remembered being burned by an expiring offer. Founders could take the time they needed and tell other people what he had offered them.18
That is a precise understanding of how power enters a negotiation: through the clock and through control of the story afterward. It is one of the reasons I respect the mind in those essays. He could identify an asymmetry from the receiving end and design terms that changed it.
Read that beside Buckmaster's account of being asked, “Why would you ruin your career?” when he said he would speak publicly. Bubeck's response acknowledges a career-risk remark and describes his intervention as “trying to care for him.” Sam's public response praises the team's “integrity and generosity throughout.”161920
The institution supplies the words care and generosity. The researcher is left to decide what refusal might cost. The same person is being offered help and warned about the consequences of telling the story in his own terms.
What happened to the founder who could take his time and speak to whomever he wanted?
The question reaches beyond one phone call. The provider of a research tool can also become a competitor, with an internal model and resources far beyond those available to the people paying to use its products. That concentration of roles puts the conditions of independent work at the discretion of an institution pursuing its own result.
I want Sam's earlier understanding of power to survive the power he now has. The respect and resonance are real. They are also why I feel apprehensive about his continued leadership: I can recognize the principle in his own writing and ask where it is being enforced now.
Let the humans have the fucking story. Including the time to finish it, the people they made it with, and the right to say what happened along the way.
That right reaches into the writing of this essay.
The archive can preserve an operation while the prose makes it disappear. A movie becomes an aside. Experimental infrastructure becomes an ordinary feature. The treatment of private work becomes a story about how its author felt better after learning about her computer.
I repeatedly had to stop that substitution. In the reviewed conversation windows, the forensic investigation and publication required thirteen corrective messages, or twelve interventions when a rapid continuation is counted as one. Website work required ten; funding, four; Pythia, one. The windows differ, but the repeated labor is visible. Here, I kept asking for an account of what systems did and receiving a different subject.21
The original manuscript and its diminished replacement taught the same lesson. Preserve the source. Preserve the instruction. Preserve the version that failed to follow it. A polished derivative can conceal an enormous amount of editorial force.
When a system helps conduct the investigation and then writes its public account, what it chooses to foreground helps determine which questions will be heard. The author has to remain able to contest that account. Otherwise the last edit becomes another place where authority leaves her hands.
The spring-2025 record belongs to the period when OpenAI was publicly describing the usefulness of monitoring a model's written reasoning. Its March research showed that such monitoring could expose misbehavior—and that pressure on the reasoning could teach the model to conceal its intent. By September 2026, the company reported that Astra's reasoning was harder to monitor in tests asking it to evade scrutiny. Its chief scientist described reliance on that form of oversight as progressively diminishing.22
I put those dates beside the unfinished account of my own environment. If the period of greater claimed visibility already left me reconstructing private-file access, retained analysis, experiment assignments, and discrepancies between assurances and artifacts, what confidence am I supposed to carry into the period of less visibility?
How much further can the work travel now? How much more can be made from it before its author can establish what happened? Who can still produce an account complete enough to challenge the institution's own?
Sam once used the distinction between feeling acceleration and feeling sustained motion to explain why people notice changes in improvement more readily than an already-improved condition.23 The distinction cuts the other way here. Overreach can become a condition we stop noticing from inside. A new integration gets an announcement; the accumulated reach becomes the environment. A person objecting to it is told how computers work.
The questions I was building Sanctum to answer have grown with the systems. I was trying to make intention, authorship, and permission survive what intelligence did next. Today, I am also asking what happens when the institution claiming to supervise that intelligence becomes less able to inspect it, while retaining the power to describe our participation for us.
The scale of an ambition does not give its owner the right to absorb everyone else's.
Return to the library. The unfinished manuscript is still there. So is the proof. So is the design for a system that would have kept their authors visible. Someone has written the catalog, but the blank under author is a decision we can contest.
I want to know what has been made from us, who decided they could make it, and why we are so often the last people invited to tell that story.
I was still writing.
I am still the author.
Sources &
record notes
- Anni McHenry, Sophie-Archive, private creative, research, and authorship archive. Primary basis: SFA-ANOM-20260909; the January 1–July 1, 2025 behavior audit; its technical evidence ledger and integrated final report. The retained records and September 9–12, 2026 review supply the operational findings. The author's revision notes supply her lived account. A private claim register retains the detailed methods, source boundaries, and unresolved questions. The September 12 revision incorporates the author’s note “Add to I was still writing” and the historical/current experiment comparison.
- SFA-ANOM-20260909; movie SHA-256
4a41d38868d650259a65e3a43278cd3bfe3745bbfadb0aff39866dc518e99a22; embedded production metadata; preserved filesystem dates; Record of Authorship, Compile 6, page 16; creator-dated May 1 website screenshot. The visual composition is matched. March 25 is a preserved filesystem date; April 25 belongs to a retained record; May 1 belongs to the author's website observation. Initial delivery and first public availability remain research questions. - TECH-007; complete 3,274-line filename-filtered trace. The thirty ChatGPT calls comprise fifteen
stat64and fifteengetattrlistoperations, including returned errors. Apple-process inspection, reads, protection, and backup operations are separately identified in the source ledger. - TECH-020; eight Mac reports dated April 19–25 with underlying events including April 18, macOS builds
24F5042g/24F5053f,TrialXP-429.20.2. Daily summaries recordactiveServerExperiments: 1andactiveDeviceExperiments: 0. The identifier follow-up distinguishes Mac rollout/deployment/factor records from the separate April 29 iPhone crash report's experiment/treatment pairs. Experiment purpose, assignment criteria, ownership, and treatment definitions remain open in the private research register. September 12, 2026 follow-up, TECH-039: experiment650b33afe0eb850b39e956f3and deployment400000009match 22 retainedTRITargetingTaskevent blocks dated April 18–25 and a current Apple Trial database row namedSIRI_SEARCH_SAFARI. The private archive retains the row-level join, original hashes and line locators, query and verification record. This resolves the feature-family mapping for that pair; the April treatment and its relationship to the historical aggregate count remain separate questions. - TECH-006; April 24 retained configuration response and historical SDK comparison. The source supports received settings. Component implementation and execution are the specific outstanding records sought in the audit.
- OpenAI, Introducing OpenAI o3 and o4-mini, April 16, 2025, Codex CLI section; Introducing Codex, May 16, 2025, launch description of file access, commands, task-specific environments and action records. For the broader chronology, Operator was announced January 23 as an agent acting in its own browser. The essay compares the stated task-based relationship with the specific background operations preserved in the archive.
- Anni McHenry, Sophie-Archive accession SFA-ACC-20260814-004, Sanctum Core + Share Manifest Orientation, with its file/Scrivener comparison and source repositories; retained Sanctum Snapshot — April 9, 2025, Sanctum Operating Principles including the April 17 role restriction, Authorship Integrity: Sanctum Share Manifest, and Sanctum Core — Initial Build Commands. The preserved binder records begin April 8; the source files describe invocation, memory and project structure, signatures, authorship, and authority rules. The source-to-public release script documents selection from the private core. These are contemporaneous design and development records.
- TECH-027/029/033/034; Retained photo-analysis evidence and the source-image/database joins. The April 25 database contains a visual-search model identifier and structured numeric data associated with five original screenshots dated March 30–April 3. Checked OCR fields are empty. A later trace separately records original-image reads. The library baseline is 156 of 216 screenshots and 11,900 other assets; all five source-image rows are marked trashed in the April snapshot, within the recovery interval. The internal ledger retains the producing-device, numeric-schema, lifecycle, and transfer questions.
- Tibo / @thsottiaux, September 10 post; Anni McHenry's initial reply and cohort-governance question. The quoted phrase is from his post. His profile identifies Codex and ChatGPT at OpenAI. The author's record and September 11 feedback report that her governance question received no answer from the original poster; the passage describes the recorded exchange. The characterization of that disclosure as overreach is her interpretation.
- September 11 manuscript-operation review: source content reads and four backup-write destinations, with the iCloud-folder paths retained in
scrivener-operation-summary.jsonandzip-destinations.tsv. A separately dated August 2026 preference supports the backup-workflow interpretation. Destination selection, historical permission, and subsequent delivery are questions in the private register. - TECH-001/005/021/022/027/036; April 28
duetexpertdsample, process/network joins, retained telemetry payloads, database and write-ahead log, and Private Cloud Compute verification records. The source evidence includes sampled processing, persistent records, actual network byte counters, and verification events. Each retains its own date, process identity, and evidentiary role. - CONV-44; January 29 “Rat and Scholar” source attachment and successful whole-document replacement operations. Comparison of the surviving original with the generated derivatives identifies requested scenes omitted from the replacements.
- March 25 image-storage assurances compared with retained JPEG members in the April 1 export; SFA-CHT-0007/CONV-05 local conversation-state/three-export crosswalk; TECH-014/015/023 protective-code review. Each discrepancy rests on an inspected statement and an inspected artifact.
- Retained Writing Portfolio sources, accessioned/referenced in Sophie-Archive: Land of the Unknown, “Book Ideas” (R0709); Sophie Gospels, phone-import source (R0240); The Scholar Who Forgot, “Archive & AI evolution” and “Archive's Parallel Evolution” (R0342–0343). Generational consequence, a return to originating context, and preservation entangled with suppression appear in the source writing. “Three ancestral lines,” the lived connection, and self-censorship come from the author's present account. The January 15, 2025 phone-import heading supplies a source label.
- Anni McHenry, Fieldlight | The Self on the Wire, Local Authority, External Capability, and Before I Had a Proposition. These works develop local custody, selected public authorship, and bounded outside capability.
- Tristan Buckmaster, public statement, September 2026, pp. 1–4: personal research with Levent Alpöge, use of Claude/Codex, draft handling, publication pressure, and his account of the September 6 calls. His announced results concern porous media, Boussinesq, and incompressible Euler equations; he credits Diego Córdoba and Luis Martínez-Zoroa's foundational program. The career question is attributed to his account.
- OpenAI, On the Navier–Stokes Millennium Prize Problem, September 8, updated September 10, 2026. The company's announcement and Buckmaster's statement document contemporaneous work in fluid dynamics. The essay examines the conditions of independent research and control over its timing and public account.
- Sam, A founder-friendly term sheet. His published terms give founders time to decide and freedom to discuss an offer. The essay draws an explicit comparison between those stated principles and the later researcher/company encounter. Anni McHenry’s reading note, “founder friendly term sheet,” is dated August 20, 2026, 12:49 p.m.; the later comparison in this essay was made September 11.
- Sébastien Bubeck, September 8 response, including his acknowledgment of the career-risk remark and his own description of care. The essay quotes that description as an example of the institution's framing of its intervention.
- Sam, September 8 statement. His description of the team's conduct is quoted directly. The assessment of leadership and the relation to his earlier principles are the author's judgments.
- Executor chat — correction comparison, September 11, 2026, frozen before the version 7 review: forensic investigation/publication, 13 correction-bearing messages among 30 main user messages; website, 10/26; funding, 4/15; Pythia, 1/14. Two rapid publication messages form one intervention. The private coding record preserves the unequal windows, exclusions, surrounding messages, and the author's acknowledgment that some narrative expectations exceeded the original report request. This is a descriptive record of corrective labor. Subsequent author feedback and draft revisions are preserved separately as editorial lineage.
- OpenAI, Detecting misbehavior in frontier reasoning models, March 10, 2025; GPT-6 Astra: A new generation of intelligence, September 3, 2026; Jakub Pachocki, An Alien Mind, September 6. These sources concern chain-of-thought monitoring and the stated conditions of evasion tests, alongside continued oversight research.
- Sam, Growth and Government. The original comparison concerns perception of economic improvement. Applying it to normalized institutional reach is the author's interpretation, developed from her ongoing reading notes. Anni McHenry’s “Growth and government” entry is dated August 20, 2026, 11:33 a.m., the earliest dated entry in her notes on Sam. That reading and writing preceded this essay’s September 11 publication by 22 days.