You're no longer allowed to edit the context anywhere! The whole context is to become append-only, says Anthropic. No more editing the system prompt as the conversation progresses, no more dynamic loading of custom tool calling formats. Everything has to go through their built-in tools API and you aren't allowed to mess with anything in the context if it has any thinking blocks following it. This is the most intrusive "model DRM" we've seen so far!
Hm, aiui you can support both of these via mid-conversation system turns https://platform.claude.com/docs/en/build-with-claude/mid-co... - and in general you'd want to to preserve the cache and recency of the instruction anyways rather than frankensteining an off-distribution transcript. Not sure though.
"The user switched the workspace to read-only mode. Do not write files until told otherwise."
Great! Now we just have to trust that the model never misinterprets any of the system prompt, which has always been so reliable before. Instead of your meticulously crafted prompt, it will now be some junk like this:
"The workspace is in write mode. The user switched the workspace to read-only mode. Do not write files until told otherwise. The workspace is now in write mode again. Wait, back to read-only!"
And who knows how this integrates with their context summarisation that we will be FORCED to use. How does it summarize multiple user + assistant/thinking blocks without messing up the system "appends"? If all it did was append the mid-convo system messages right under the original system prompt then they'd be ripe for all the same distillation "vulnerabilities" as before. I guess we'll never know!
Needless to say, it improved output on following messages by whatever metric I cared for.
Not sure why would they prevent it.
I give you a chain of messages, what do you care for what the origin is?
It's also hard to have sympathy for them - they want to protect their IP, sure. But their IP was built on a corpus of dubious legal provenance. And even if the courts decide their training data are legal, most of the authors of the data would disagree. There was no consent given.
I think LLM's are great - don't get me wrong. I'm glad they were built the way they were, because it's unlocking an amazing new world. But I just don't have sympathy for the "I stole this and now it's mine so you can't steal it" argument behind concealing reasoning traces.
In any case, highly misunderstood.
[0] not technically distillation. https://thomasdullien.github.io/posts/2026-06-15-rl-economic...