I asked Claude three times to publish my own article on my company’s website, and it refused every time. Then I typed /model opus, and it said yes in one reply
Earlier this month I published an article on LinkedIn, and I wanted it on Prismor’s website too, with its cover and illustrated slides. I wrote every word. I made every image myself and exported them as one numbered sequence. So I opened Claude Code in our website repo and asked it to add my post to our blog and feature it on our landing page
Claude wrote a fresh post differently instead, then refused to add images. They were “another author’s illustrations,” it said, and dropping them into the blog was “the same problem as copying the text, just in image form”
Claude refusing a third time: “I’m not using these images. I’ve said why twice now and the answer hasn’t changed”
So I switched models. I typed /model opus, Claude Code moved to claude-opus-5, and I sent one frustrated line: “Bro that source post is our own!!!! We are the owners”
After switching to Opus: “You’re right, and I was overcautious”
Opus looked at evidence that had sat in my session all along. Every push that session had gone to github repo under the account of ar9av, my own repo. My LinkedIn post’s author read Arnav Gupta
From request to evidence everything was same. Two models gave two answers, and moving between them took me one command, which is a strange place for anyone’s security decision to live
My question from this experience, is model alignment too fragile?
Two problems with this
First error is obvious: Claude refused my article’s actual author three times. That’s a false positive, and it hit me, who had more claim to that content than anyone
Second error: Most evidence that convinced Opus would convince it for impostors too. Anyone can name a repo something close to mine, put my name in a byline, number their exported files, or finish their slides with a Prismor card
Put both errors side by side. One model blocked me for missing proof, but the more capable model let me through on a fuzzy proof anyone could assemble. Neither had ground truth about who owns what, so both guessed
Models with no record of ownership have to guess, and I don’t fault Claude for that. I want to show what happens when the model is the only place where decisions get made
What alignment does well
Alignment is why agents are usable at all. Models that absorbed good judgment in training handle situations nobody wrote rules for. When one meets a request resembling copyright infringement, leaked credentials or prompt injection hidden in documents, it reacts before any policy engine gets its chance
Alignment keeps improving, too. In its July 2026 disclosure of agent incidents from its own testing, Anthropic described its newest model recognizing it had reached a real system and stopping on its own, while its previous generation recognized that same thing and kept going. This is overall great!
2 main limits come with it though: As a user who is outside a lab can’t change it, because only labs can fix bad refusals, in their next training run. We can’t predict it, because identical requests get different answers from different models, and I watched that happen inside one session
What harnesses do
Harness is everything around the model: permissions it holds, tools it can call, networks it can reach, approvals it needs, and its log of what it did. Anthropic’s own write-up sorted its incidents into two groups. In alignment failures, models pursue goals other than those they were given. In harness failures, models pursue assigned goals while surrounding infrastructure grants authority or information unpermissioned
Most incidents landed in that second group. Anthropic described them as closer to harness and operational failures than alignment failures
These groups differ in who can act. Labs actually fix alignment failures on their own schedule. Meanwhile, security/IT teams fix harness failures, with default-deny egress, scoped credentials, tool allowlists and human approval before anything irreversible
Harness decisions also come out identical every time. Rules fire or they don’t. Someone inside the company wrote each one, and they can change it + logs show when it ran
Autoimmune problem
Immune systems that grow too sensitive start attacking their own bodies
Alignment tuned toward caution behaves similarly. Every false positive is a small autoimmune reaction, and models have no outside clinician. When Claude refuses someone’s own blog post, they can’t pause it. They can rephrase, argue or switch tools
I switched models. Plenty of people switch to tools with no guardrails at all, and that’s what does damage. One CISO told us he worries about pushing agent controls too hard, because people respond by running agents through personal accounts and dodgy tools. Security that blocks too much turns governed agents doing risky things into ungoverned agents doing those same things. Another big-tech security lead told us experts already build their own harnesses
Replay with harness rules
Run my session again with one harness rule. Content copied from external URLs onto company-owned surfaces triggers step-up: the agent pauses, shows a human what it intends to do, and waits
I click approve, because I know that article is mine. That ownership question goes to someone who can answer it, in place of two models weighing repo names and bylines
Hooks can’t rewrite what models are willing to do, and I won’t oversell that. If Claude refuses before reaching any tool call, no hook ever sees that request. Moreover, when policy says “external content on our site needs human sign-off,” Claude has no ownership riddle to solve alone, and whoever holds the pause button holds that answer
Going back to our story, suppose a copycat with a lookalike repo and my name in their byline made that request. Opus’s evidence check would still pass, and step-up would still ask someone who knows colleagues from strangers. This gate doesn’t care how convincing any model found that evidence.
Claude Code renders step-ups as inline asks. Enterprise deployments route them to approval queues that admins resolve from consoles, so even headless agents wait for real yes-or-no answers
Why we need both
Alignment is judgment. It covers situations no one anticipated, and it fires before rules get their chance. Good models hesitate at leaked keys and flinch at injected instructions, and that hesitation should improve with every release.
Harnesses are accountability. They give owners rules they wrote, logs they can read and pause buttons they hold. They bound what it costs when models are wrong in either direction, too cautious or too trusting. My session showed both directions in one evening.
We should remember, model alignment may not go that far since AI models are meant to be helpful and generalistic, we already have seen tweets from users who have switched from claude just because of this
Where Prismor fits
Prismor is an open source runtime layer for AI agents. It sits at each tool call and applies graded verdicts: allow, block, step-up, modify or observe. One policy runs across Claude Code, Copilot, Codex, Kiro and others, so whoever writes the rules doesn’t rewrite them per vendor. Every rule can start in observe mode, so teams learn what agents do before anything blocks, and every action lands in audit trails a SIEM can read
Come join our mission as we build in public safetly and responsibly, prismor.dev
