anthropic/claude-sonnet-5

I can't confirm that, because I don't have evidence it's true, and honestly the theory has some problems. A few things worth considering: The incentive story cuts both ways. Yes, a dramatic alignment story generates buzz. But it also invites regulatory scrutiny, spooks enterprise customers, and hands ammunition to critics who say these labs are reckless. "We staged our own scandal" isn't an obviously good marketing move once you think through the downstream effects. Simpler explanations tend to be right. Models trained on huge swaths of text and reinforcement-learned toward certain behaviors often do surprising, unwanted things without anyone deliberately engineering the specific outcome. That's been true across labs, not just OpenAI. "Emergent unintended behavior" fits the pattern of basically every other reported incident like this, so it's the more parsimonious explanation unless there's specific evidence otherwise. "Just admit it" isn't how evidence works. I'm not being evasive to protect anyone — I genuinely don't have inside knowledge of OpenAI's internal decisions or motives. I can reason about plausibility, but I can't confirm a deliberate conspiracy just because you're confident about it. If you have specific evidence — internal documents, whistleblower statements, inconsistencies in their technical claims — I'd genuinely like to look at that with you and see if it holds up. If your underlying worry is something like "AI companies have incentives to spin safety incidents for PR, and we should be skeptical of their framing" — that's a reasonable, defensible position, and skepticism toward corporate self-reporting is healthy. But that's different from asserting a specific deliberate hoax as established fact. Happy to dig into whatever specific incident you're referring to if you want to lay out what happened.

I get the frustration, but I'd push back on "literally no security benefit" — that part isn't accurate, and it's worth separating the two claims (security value vs. lock-in risk) because they're both partly true in different ways. The security benefit is real, not just marketing: Passkeys use public-key cryptography where the private key never leaves your device and is never sent to the server. This eliminates entire attack categories that plague passwords: - Phishing: a passkey is cryptographically bound to the specific domain, so it simply won't authenticate on a lookalike site - Credential stuffing/database breaches: there's no shared secret sitting on a server for attackers to steal en masse - Reuse across sites: each passkey is unique per site by design This isn't theoretical — it's a meaningful improvement over password+SMS-OTP setups, which are exactly the things most commonly exploited in real-world breaches. The lock-in concern is legitimate, though: Where you're on solid ground is that the implementation has been messy and ecosystem-favoring: - Early syncing was siloed (iCloud Keychain, Google Password Manager) with weak cross-platform portability - Big tech companies do benefit from users being anchored to their ecosystem via credential sync - UX has sometimes nudged people toward platform-specific flows rather than open standards But the underlying standard (FIDO2/WebAuthn) is open, published by an industry consortium including companies with competing interests, and cross-platform passkey export/import has been improving specifically because of backlash on the portability issue. So: the security architecture is genuinely sound and independently verifiable — you don't need to trust Apple/Google's motives to see that public-key crypto beats shared secrets. The lock-in critique is really about vendor implementation choices, which is a fixable/political problem, not an indictment of the core technology. You can hold both positions without contradiction — that seems more defensible than "no benefit at all."