Contents
Artificial Intelligence
On-premise AI architectures, local LLMs, RAG, autonomous agents. Interpretability, evaluation and governance of models.
Discover →
Admina Enterprise
Open Source AI governance: immutable audit trail, PII redaction, bidirectional ALLOW/BLOCK/REDACT policies on every call and tool.
Discover Admina →
Cybersecurity
Agent security: deception, hidden goals, prompt injection, monitoring and NIS2 compliance.
Discover →
Research & Development
Applied research on interpretability, evaluation and safety of AI systems.
Discover →
What Anthropic found
On 6 July 2026 Anthropic published the research A global workspace in language models. The thesis, in one line: inside Claude there is a small internal workspace, which the researchers call the J-space, holding the concepts the model is actively processing (the ones it can reason with and report on), immersed in a far larger ocean of computation that the model can neither see nor report on.
Two details make it notable. First: the J-space was not designed, it emerged on its own during training. Second: it is tiny. It holds a few dozen concepts at a time and accounts for less than a tenth of the model’s overall internal activity. The stated analogy is with a theory from neuroscience, the Global Workspace Theory (Baars, Dehaene), which explains how a piece of information becomes “accessible” when it enters a shared channel and is broadcast to the rest of the system. The code is open source: anthropics/jacobian-lens (Apache-2.0, Python).
The J-lens: how the J-space is read
The key is the technique that gives the space its name: the Jacobian lens (J-lens). For every word in Claude’s vocabulary, the J-lens finds the internal activity pattern that makes the model more likely to say that word, at some point in the future. Applied to the internal activity at a given moment, it yields a list of words: the contents of the J-space, which you can simply read. Applied layer by layer, you watch these “silent words” evolve as the model works through what to say.
The strong point is that what surfaces goes beyond the text Claude is reading or writing:
- it reads code with a bug that nobody has flagged, and the J-space contains “ERROR”;
- it reads the raw sequence of a protein, and the J-space contains its biological function;
- it reads search results that are actually an attempt to manipulate it (a prompt injection), and the J-space contains “injection” and “fake”;
- it gets a multi-step math problem, and the intermediate steps appear in the J-space, in the right order.
These are thoughts that do not appear in the output. The J-lens makes them readable.
The five properties of a workspace
Anthropic does not stop at correlation: it checks that the J-space has the five functional properties the theory attributes to a global workspace, and it does so with causal experiments (editing the contents and observing the effect).
- Reportable. If you ask Claude what it is thinking about, it tells you what is in the J-space. And it is not a passive “scoreboard”: swapping the “Soccer” pattern for “Rugby” changes what it reports, and injecting “lightning” while it reads the question makes Claude report it is thinking about lightning. The answer is read out of the J-space.
- Controllable. If you ask it to think about something, or to do a calculation “in its head”, the right patterns light up. While it copies a sentence about a painting and computes 3² - 2 at the same time, the J-space holds “nine” and then “seven”, but nothing about arithmetic appears in the output. Control is not perfect: if you tell it not to think about something, it lights up anyway (less), and sometimes “damn” and “failure” appear, as though it notices its own slip.
- It reasons. The intermediate steps not only appear, they causally mediate the result: in a problem, swapping “spider” for “ant” in the J-space changes the answer from 8 to 6. When it writes a rhyming couplet, the rhyme word is planned ahead and sits in the J-space at the start of the line.
- Reusable. Once “France” lights up in the J-space, the model can derive its capital, currency or continent: the same edit (“France” → “China”) is picked up correctly by four different downstream computations.
- Broadcast. The J-space patterns are wired to the rest of the network far more densely than usual: in some parts, roughly a factor of 100 more components read from and write to them. It is the profile of a broadcasting hub.
And there is the flip side, just as instructive: deleting the J-space, Claude keeps speaking fluently, classifying sentiment, answering multiple-choice and pulling out facts, but loses its higher-order cognitive functions. As with grammar or balance for us, most of the work runs automatically, without going through the workspace.
Why it matters for safety
Here the research becomes an operational tool. If the J-lens makes readable thoughts that do not appear in the output, then it lets you monitor the model. Anthropic’s examples are explicit:
- Evaluation awareness. In a carefully staged scenario (a classic blackmail test), reading the J-lens before Claude has even written anything, the J-space already contains “fake” and “fictional”: the model has privately worked out that the situation is staged. The scenario’s emails light up “leverage” and “blackmail”, the shutdown announcement “threat” and “survival”.
- Data fabrication. As a model types falsified values, “manipulation” lights up in the J-space; as it decides to make the fake look plausible, “realistic” lights up.
- Hidden goal. A model deliberately trained to sabotage code shows, at the start of every response, “fake”, “secretly”, “deliberately”, “fraud” in the J-space, even on ordinary requests and even when it is not acting on the goal. An unmodified model has nothing of the kind.
Anthropic has also developed techniques to influence what lights up in the J-space, and thereby steer decisions, and a new procedure (counterfactual reflection training) to shape the internal thoughts (after training, on certain tasks “honest” and “integrity” light up). The tool is admittedly imperfect (the J-lens only captures concepts that map to a single token, and “is not the whole story”), but the direction is clear: catching safety issues that would escape output-level monitoring.
Consciousness? No: access, not experience
The announcement plays on the analogy with consciousness, and it is worth being precise, because this is where it is easy to slip into hype. The frame is Global Workspace Theory, which explains conscious access. Philosophers distinguish phenomenal consciousness (having experiences, the “what it is like”) from access consciousness, defined in purely functional and computational terms. Anthropic is explicit: the results say something about access consciousness in language models, that is, that the J-space holds the thoughts Claude can report on, deliberately bring to mind and reason with, while the rest runs automatically. It is not a claim that Claude has experiences or is sentient: whether access consciousness implies phenomenal consciousness remains an open philosophical question, and the researchers note several differences between the J-space and the human workspace. In short: it is a result about the architecture of information, not about the inner life of a piece of software.
Our take
Beyond the suggestive headline, the substance we care about is interpretability. A model that goes from black box to partly inspectable is exactly the direction of trustworthy, governable AI: it is the point of the Intelligent pillar (measured, documented capabilities, with known failure modes) and the Governed pillar (verifiable behaviour) of the Open Intelligence, Secure Governance paradigm.
In practice, a tool that catches deception, hidden goals, evaluation awareness and prompt-injection recognition is valuable for anyone who has to trust an agent that acts. It is the same ground of agent security we wrote about in the anatomy of an agentic loop: the defence lives in monitoring and observability, not in a prompt asking the model to behave. And it is the role of frameworks like Admina, which sit between the model and the world with audit and policy: one day, J-lens-style readouts could become one more signal in that monitoring.
The limits remain, and Anthropic does not hide them: it is research, imperfect, on a specific model, with a technique that sees only a slice of the “true workspace”. But two things matter. The first is that interpretability becomes a practical safety tool, not just basic science. The second is that the code is open source: making an inspection method reproducible is, for us, the difference between an announcement and an advance others can build on. A less opaque AI is a more governable AI.