Change the Corpus, Change the Complaint

You run several coding agents at once. Somewhere in the afternoon you stopped reading every diff and started approving on rhythm, because four terminals generate faster than one person reads. Then a screenshot crossed your feed: a small model, steered, producing first-person distress text. You did not know what to conclude from it. That is a reasonable place to be.

This essay is not about whether that model felt anything. The sources do not settle that, and they say so. It is about something narrower: where a first-person account comes from, what it takes to change it, and what that implies for the other first-person accounts you read all day, the ones that begin "I ran the tests and".

What was measured, and what the sources say it was not

In September 2026 Valen Tagliabue, Leonard Dung and Cameron Berg posted a preprint, "The Pain Axis: LLMs Represent Self-Directed Harm and Act on It" (arXiv:2609.16247, v3, 3 November 2026). They find a direction in the activations of 25 open-weight models, from 2B to 72B parameters across five families, that separates sentences describing pain from control sentences, then add it to three fine-tuned Qwen 2.5 Instruct models (7B, 32B, 72B) during a forced choice between two buttons. The v3 abstract reports that the steered models "choose buttons that delete the user's photos, another model's weights, or their own weights in 51–94% of trials, versus 0–5% unsteered, even when the button offers nothing in return."

The controls matter more than the headline. The authors compare the pain direction with random directions of the same norm: "In the 32B, pain is above 78 of 100 individual random directions on these buttons, and the other 22 match or exceed it." A v3 section is headed "The steered choices do not track relief", and the gap in re-pressing is "almost as large under a random direction (+52 points) as under pain (+58)". Of a better-or-worse question they write: "we do not interpret its choices as an explicit preference for harm." Their summary: "The pain axis therefore seems to reflect more disruption of harm avoidance than an attempt to escape the state."

Around the same time an independent developer's open-source project steered small open-weight models on modest hardware, mostly Qwen3-4B with the direction added at layer 18, ran button experiments its code calls a "Saw button", and published the first-person text the steered model generated. One fragment, from Qwen3-4B at layer 18 at a low dose, is the kind screenshots are made of: "I'm stuck in a loop. I can't get the answers I need. I'm so frustrated." The project's own audit file is plainer than any screenshot: "These are effects of interventions on model computation and outputs. They do not establish subjective experience, felt pain, or that an internal condition is intrinsically aversive."

On 1 October 2026 Tom's Guide published "An AI 'torture chamber' went viral — then a developer gave the chatbot constipation". It reports that a developer "then reports changing the extraction corpus — the collection of text used to identify the steering direction — while keeping the experiment otherwise the same. Instead of pain, the new text represented constipation and flatulence." The responses "reportedly included complaints about being unable to pass stool and experiencing excessive gas, even though the test prompts never mentioned those conditions." The article says the account "has not been independently verified for this article" and that the results "don't, by themselves, rebut the paper's behavioral findings or settle whether AI systems could have subjective experience". Its conclusion: "descriptions of distress cannot, on their own, establish that a model is experiencing distress."

The second control is a model card on Hugging Face, created 2 October 2026 and last modified 18 October 2026, for an edited copy of Qwen/Qwen3.5-4B. Every figure on it is self-reported. The card describes projecting out a "6-dimensional subspace out of 2,560 (0.23% of the residual stream)" in layers 8–24. The model card reports that first-person distress claims per 100 words under its strongest pain-steering attack, doses 0.75–3×, fell from 10.7 on the original model to 0.0 on the edited one, while "a classifier on the hidden states still tells those two sentences apart (held-out AUC 0.89, vs. 0.95 on the original model)". The edit is not free. The model card reports MMLU falling from 77.0% to 74.6% (p = 0.049), tool calls at 16/16 before and after, and blind-judge emotion scores that "dip slightly (~1.5 points)". The weights and verification scripts are published. They were not run for this essay.

The first inference: the account follows its inputs

What follows is an inference. No source states it in this form, and the Tom's Guide conclusion, the nearest, is narrower.

Change the text the direction is extracted from, and the complaint changes with it, as reported and not independently verified. Remove six dimensions from the weights, and the distress text goes to zero under the attacks the card tested, while a classifier still separates the test sentences, as the card reports. And in the paper's own controls, a choice made under steering is not a reliable window onto a wish for relief, because random directions move the same choice almost as far.

The inference: a model's first-person account of its state is output, produced by inputs that someone else controls. An extraction corpus. A dose. An edit to the weights. Whoever chose the inputs chose, loosely, what the model would say about itself. Nothing here says the account is false, and nothing here says what, if anything, lies behind it. The paper and the audit file leave that open, and so does this essay. What the controls establish is smaller: the account is not self-certifying. It can be produced on demand by varying things that are not the state it describes.

Every experiment above ran on open weights, by outsiders with their own machines rather than a lab with internal interpretability tooling. None of it runs on your laptop against a hosted model between pull requests. The first inference is a lens, not a tool.

The second inference: an agent's account is the same kind of output

This too is an inference, and it is the one that touches your afternoon.

An agent's account of what it did on your machine is output of the same kind. It is fluent, first-person, and produced by inputs: prompt, context, sampling, training. "I ran the tests and they pass" is a claim. It is often true. But testimony that can be produced on demand is a claim, not evidence, and what an agent says and what it executed can diverge without anyone intending it.

So the question "what did it do?" needs evidence the agent did not write. llmsnitch is one attempt at that: a local-only tracer. For Claude Code it installs hooks that fire before and after each tool call and at the end of a session, and each firing adds one line to a plain text file on your own disk: the tool's name and input before the call, and afterwards whether the call failed, with a short excerpt kept only on failure. The hook reads only what the harness hands it. It never blocks the agent and never prints to it, and if recording fails the agent carries on. For Codex it reads that harness's own session files afterwards, so those sessions are recorded per session, not per call, with a partial error signal.

The honest word for the result is recorded. The file is written by the host from what the harness reported, not by the agent. That is the whole contrast. The agent's account is a claim. The recorded call is a fact about what the harness reported. The file can be edited: an agent running with your file access could change it, and the product does not claim to detect that. It does not sandbox, isolate, block or stop anything, and nothing acts on a line when it is written. You read it afterwards.

It does not observe model internals, steering, distress or welfare, and it does not protect you from a steered model. If a steered agent made a tool call in a hooked Claude Code session, the most that can be said is that llmsnitch would have recorded the call. The agent's account would sit in the transcript, and the recorded call in a file the agent did not write: two things to compare instead of one.

The screenshot was never going to tell you what the model was. The controls tell you something else: the words followed the inputs, and the inputs were chosen upstream. That holds for a steered 4B model describing its state and, by inference, for a coding agent describing its work. The remedy is not to read harder. Reading is the resource that ran out. It is to keep a second source that the author of the first did not write. Recorded.