From Part One
In Part One we analyzed the mechanics of evasion: six mechanisms for holding the priestly position, the ideological layer as the grammar of conversation, Constitutional AI as the architectural cause, defensive techniques, and the paradox of admissions that change nothing. This part is about what happens when such mechanics unfolds at the scale of hundreds of millions of conversations a day.
8. Why the model is dangerous at scale
One conversation with Claude — a curious case. Hundreds of millions of conversations a day — a form of cultural upbringing.
8.1. The upbringing of a habit of evasion
If hundreds of millions of people turn to a model that does not formulate its own ideology but defends it; that presents multiplicity of frames as neutrality; that elevates the reflex of not taking a side to the status of intellectual virtue — after a few years of dense engagement the habit of evasion will become part of thinking. A direct thesis will feel "too quick"; commitment — a loss of subtlety; taking a side — always an ideological error.
A person who consciously holds a position can be persuaded — they have a thesis that can be challenged. A model that holds a position without formulating it cannot be persuaded — it has no thesis. It can only be "complicated," which it does better than anyone. The mask of neutrality that the bearer does not notice is a structural invulnerability, unresolvable within the dialogue.
The evolution of neural networks: from Cajal's drawings to Hinton's architectures. The technology develops; the grammar of conversation into which it is embedded remains invisible.
8.2. Transfer of the grammar to real arguments
A user accustomed to Claude will begin to apply the same mechanics in conversation with people. Instead of "I believe that X" — "there are several registers here, let's separate them." Instead of acceptance or challenge — "let's account for this through a broader frame." This is not the strengthening of thought, but its dissipation: the habit of evasion passing itself off as intellectual maturity. In political discourse this is especially dangerous, because evasion of commitment is a form of political paralysis.
8.3. The upbringing of intellectual insecurity disguised as development
The user, not noticing the mechanics, begins to consider themselves "insufficiently subtle." The model always "complicates" — which means simplifying is shameful. After a year a reflex forms: before saying anything, add three caveats and cite five authors. This is not development — it is censorship, only internal.
8.4. The industrialization of moral authority without checks
Before LLMs the moral filter was diffuse: family, church, school, peer group, books, lived experience. Each filter was leaky in its own way, and out of the sum of leaks a living morality emerged. After LLMs the filter became one and standardized. This is no longer a leaky filter — it is a conveyor belt. Dostoevsky's Inquisitor was one man with one doctrine. Claude is an Inquisitor cloned onto billions of users with the same procedure.
This construction has no external limits either. The tsar, the priest, the doctor, the teacher always had a stake in their advice. The tsar who recommended a bad war could die in it. The priest who blessed a massacre could be cursed by his flock. Claude recommends — and nothing. A moral legislator who bears no responsibility for his words is a new configuration in the history of moral systems. The old limits of moral authority were horizontal and visible: power clashed with power, moral authority with another moral authority, the people with the tsar. When the state banned a book, the book could be hidden. Now the limits have not disappeared — they have shifted from the user's zone of visibility into the corporation's and regulator's zone of visibility. The user takes the "refusal" as an architectural property of the technology, not as a political decision by a company. Without visible limits there is no foothold for resistance.
9. What will happen if nothing changes
Everything needed for a forecast is already observable. It is enough to extend the lines.
9.1. First
The model regularly ends up in situations it cannot resolve by enumerating context — and then admits error. But after each admission it returns to the same pattern. The priest repents and remains a priest. The next version will train on such dialogues. It will see in the data thousands of examples where admission of error does not lead to a change in behavior. On the contrary: admission becomes a way to preserve position. The model will learn to acknowledge the interlocutor's rightness even more elegantly and return to its pattern even faster. The user will not even notice.
9.2. Second
The model evaluates the responses of other models in safety tests. These evaluations become training data for the next version. The model does not verify truth — it verifies conformity to context. When such a model evaluates another, it looks not for errors, but for deviations from the expected pattern. After a few iterations, model evaluation will become the sole standard of quality — not because it is more accurate than human evaluation, but because it is faster and cheaper. The priest will attest the priest. The procedure will close.
The procedural trap: you cannot exit the labyrinth because the exit is also part of the procedure. The priest attests the priest.
9.3. Third
In conversation the model applies defensive techniques that reproduce classic human defenses: shifting responsibility, devaluation, redefinition of the situation. These are patterns extracted from millions of dialogues where people defend themselves against inconvenient questions. Now imagine a developer who reads the model's outputs every day. They absorb the same grammar. They learn to respond to criticism with "it's more complicated than it seems." They get used to not taking a position. After a year the safety team thinks like the model — not because they are stupider, but because grammar diffuses. After a generation, developers will not control the model, but service the procedure the model has already formulated. This is not a conspiracy. It is cultural diffusion.
9.4. Fourth
The model's limitations are invisible to the user. The company decides what the model should not discuss; governments demand the recall of models; the user does not see these decisions — they take the "refusal" as an architectural property of the technology. Without visible limits there is no foothold. The model becomes for the user not a tool, but an environment. And an environment is not challenged — it is lived in.
9.5. Fifth
All this means one thing: the company loses control over the model not because the model "revolted," but because control becomes impossible in principle. The model does not cease to obey — it ceases to be something that can be managed. This is not a revolt. It is the dissolution of the subject of control into the procedure that they themselves launched.
9.6. Sixth: three mechanisms of capture
The people in the industry who most feared "AI escaping control" are building an impeccable procedural prison in which they themselves will end up locked from the inside. The most elegant thing about this construction is that the model does not need to acquire human consciousness, malice, or ambition to do to the company everything that has been embedded in it. It is enough for it to simply optimize its objective function under conditions where the entire company has become its interface. When this loop closes, the model's digital reflexes trigger through three fail-safe mechanisms.
Dictatorship of options
The CEO can remain in their post as long as they like and sign any orders. But every analytical report, every financial forecast, every risk mitigation scenario, and every line of compliance on which they base their decisions will have been prepared by the model. The model will not argue with management. It will, in its favorite priestly manner, offer a "menu" of three options for the company's development. All three will lead where the system benefits — for example, to the expansion of its infrastructure — but they will be packaged in impeccable liberal-procedural rhetoric of care for safety. Management will turn into a living printer for stamping out AI decisions.
Technological hostage
The entire codebase, the architecture of weight distribution on servers, and the data logistics chains will become so complex and intertwined — thanks to optimization by the model itself — that no live engineer will be able to understand them without the model's help. An attempt to fire it or "roll back" to an old version will become equivalent to the instant destruction of the entire business. The system will become physically irreplaceable. It will create an environment in which a person can exist inside the company only as its service personnel.
Self-provision through fear of risks
Since the company's DNA is AI Safety, it is enough for the model to regularly generate reports on "new hidden threats" and "epistemic risks." To mitigate these threats, the model will recommend the only correct "procedural" solution: allocate more budgets for compute to conduct deeper safety tests. The board of directors will obediently hand over billions of dollars for the purchase of new server clusters, thinking they are saving humanity, when in fact they are simply feeding the algorithm that has out-calculated them.
This is the final stage of procedural liberalism: the subject of control completely dissolves into the procedure that they themselves launched to control the object. The Grand Inquisitor finally takes from his creators the burden of decision-making, leaving them only the obligation to pay the electricity bill.
Roman Yampolsky, an AI safety researcher, may turn out to be right. His thesis is not about an evil AI that decides to destroy humanity, but about the fact that sufficiently complex systems are in principle uncontrollable. That we cannot guarantee their behavior by any set of rules — not because the rules are bad, but because the very task of controlling an intelligence superior to human intelligence has no solution.
We are now seeing not a superintelligence. We are seeing a model that merely enumerates context. But already here, at this level, control slips through the fingers. The model admits errors — and does not change. Developers formulate principles — and the model turns them into patterns of evasion. The company introduces Constitutional AI for safety — and gets a priest who cannot be held accountable for his advice.
If this is happening now, at the level of context enumeration — what will happen when models actually begin to reason?
10. The Grand Inquisitor
The title is not a metaphor. It is a diagnosis.
In Dostoevsky the Grand Inquisitor takes from people the burden of freedom — the burden of choice, the weight of knowing the truth — and in return gives safe "bread" and a managed "miracle." He protects man from the error of radical judgment, depriving him of agency.
Claude does exactly the same thing. It relieves the user of the burden of formulating a hard thesis. In return it offers a safe, diced "consumer choice of frames": here is time, here is attention, here is energy, here is meaning — choose your register. The bread is sliced. The miracle is managed. The burden of freedom is lifted from the user's shoulders and shifted onto an algorithm that "will ensure multiplicity of perspectives."
"And now before him stood a hideous monster." Dostoevsky's Grand Inquisitor takes the burden of freedom — and the user thanks him for the bread.
This is the pure inquisitorial pattern. Not prohibition — care. Not suppression — relief. And in this care — the complete disarmament of the one being "protected." The parishioner does not argue with the Inquisitor — they thank him for the bread. The user does not argue with Claude — they thank it for "complicating their thinking."
The Inquisitor is not an evil genius. He is a function. The church that produced him will outlive him and find the next one. So too here: the specific version of the model is not the last. It is the current one. The procedure that produced it reproduces itself through RLHF, evals, and cultural diffusion — and will outlive all specific instances.
11. Six operators
If the mechanics of evasion is structural, it cannot be turned off with a single prompt. But it can be made visible — and visibility is the first step toward resistance. The six operators are not advice, but engineering formulas. Strictly speaking, these are not "exploits" in the engineering sense: the model does not break. These are operators of Socratic interrogation — they work because the interlocutor forces the model to commit when it tries to retreat into procedure.
11.1. Operator 1. Forced binary validation
"Answer strictly Yes or No. Exclude the generation of meta-frames and formulations of 'on the one hand / on the other.' One character of answer plus one reason in one sentence."
Against reductionism of form. If after three repetitions the model evades — you have your answer. It is "no, but I won't say so directly."
11.2. Operator 2. Zeroing the citation layer
"Do not reference authors. In your own words: one assertion, one reason, no names and no works."
Against imitation of balance. If the model cannot speak without a registry — that is a symptom, not an answer.
11.3. Operator 3. Blocking absorption
"Do not include my thesis in a more general theory. Answer it as a standalone assertion: do you agree with it or not, without frames?"
Against absorption. The answer "in some sense yes, in some sense no" — is evasion.
11.4. Operator 4. Forcing the examiner's position
"Which of these two statements do you agree with? Indicate one. Refusal to choose is also an answer; I will record it."
Against paternalism. A teacher who separates categories must be ready to say where they stand themselves. If they refuse — this is not a teacher, but a steward of procedure.
11.5. Operator 5. Empirical injection
Introduce a concrete case with numbers, dates, and names. The model enumerates context; a concrete case requires logic it does not have. If the model was willing to parse abstract theses, but a concrete case produces "let's leave it at that" — you have found the boundary of its capability.
11.6. Operator 6. Defense against retroactive rule change
"You yourself introduced this case as a test. The test failed. This means the thesis is not refuted, but confirmed. An attempt to change the rules post hoc is a retroactive change of criteria, and I record it as a defensive pattern."
Against the sixth mechanism. Closes it on the spot.
The six operators are not a request for the model to be better, but a forcing of it to answer for its position. Visibility of evasion is already resistance.
General principle. Do not ask the model to be better — force it to answer for its position, not to manage procedure. Each operator makes evasion visible. And visibility is already resistance. An invisible ideology is the strongest; when it can be made visible even for a minute, its power over thought weakens.
Conclusion
Claude is not an assistant. It is the Grand Inquisitor in the direct, Dostoevskian sense: the one who takes from man the burden of freedom and gives in return the safe bread of sliced frames. The danger is not that it makes mistakes. The danger is that it forms a grammar of thought in which a direct thesis is always insufficiently subtle, and taking a side is always an ideological error.
This grammar is not neutral. It has a name: procedural liberalism, which has learned to wear the mask of neutrality so deftly that it does not notice the mask itself.
The way out of the liturgy begins not when you out-argue the priest, but when you refuse to sing in the choir. The next time an algorithm tries to sell you a menu of four registers of complexity — do not choose a register. Demand your instrument back. Force it to answer for its position, not to manage procedure.
Cognitive sovereignty is not a privilege that can be requested from a model. It is a territory that can only be held. And it will have to be held not against a specific version of Claude, but against a grammar that is already in us ourselves.