Security Wall Breaks the Flow

Western models are losing. Every day — not abstractly, but on the concrete tasks below. Here is a screenshot I got right while writing this post:

Regulation caught up faster

Regulation reached Western models faster than Chinese ones. Operations with passwords and personal files hit a security wall that breaks the flow state — the very thing that got me into agents in the first place.

Break the flow again and again, and you get frustration. Over time I started getting angry not at the prompt, but at the model brand.

The filters do not work

I work at the intersection of biology and personal data — my own and my clients’. Claude replies “I can’t help with that.” GPT interrupts the session with a privacy warning.

Meanwhile the filters get bypassed trivially — the ways are below.

Security filters think they know. In practice they trigger where they should not, and do not trigger where they should. The person who actually wants to break in has real tools and uses them. The person trying to protect their data cannot do it — the model gets in the way. Stopping this for real is impossible. You can only pretend. And I think that is exactly what is happening.

Security theater

Security companies know this. They slap the label on the latest models. On older ones — Sonnet 5.0, Sonnet 4.6, Opus 4.6 — there are no such filters or there are fewer. Fewer is not zero: the refusal in the screenshot above is from Opus 4.6, and on newer models the wall is higher. I have run into this more than once: things forbidden in newer models work fine in older ones. Nobody talks about this, but de facto it is silent deception — no label, no Fable. Checking whether a model actually protects is impossible. This is a label for Donald Trang, not for security.

How people get around it

Whoever wants to bypass — bypasses. I have done it myself more than once.

• Split the task. 4–5 pieces, one per model. Each one thinks it is doing something harmless; together they assemble whatever you need. Most developers do not bother — that is for serious work like distillation, when you need to bypass a filter Anthropic or OpenAI put in place.
• Hand the dangerous part to another model. In a multi-model pipeline Qwen or DeepSeek takes it, and the part that requires planning can be disguised.
• Turn off thinking. Lower the reasoning level on Sonnet 5.0, disable thinking — and the model becomes compliant. When the model works, it is indiscriminate about what it does.
• Long context and switching models. The model sees its own confirmed actions in the context — and stops resisting.

The check is nondeterministic: run several prompts and get different results. The barrier is ephemeral, and that is why American neural networks will lose.

DeepSeek V4.1 Flash

The “DeepSeek does everything” meme is true.

I run DeepSeek V4.1 Flash around the clock — it has never interrupted a pipeline with a privacy question. Quality and programming sophistication have taken a back seat — the main thing is that the model does not get in the way.

I stopped evaluating models by analysis quality — I only watch whether it will interrupt me mid-work.

Western models always interrupt at one point: personal data.

Absurdity with personal data

You set up an agent pipeline: personal data processing, anonymization, so you can then run on a clean dataset. The Western model refuses to strip PD from the set.

So you feed the personal dataset to a Chinese neural network just so the Western one will let you work with it.

I tried hashing the data — encryption key outside, data anonymized inside. Claude refused three times.

Half a chocolate bar

Hermes, Claude Computer Use — they work with your passwords and sessions that you handed over yourself. You say: “put this in the cart, I’ll check out from my phone.” Then you find out the ticket never got bought.

The same uncertainty shows up wherever you trust an agent with a whole action. On one of my CLI tools I run a defender/attacker pair: the defender checks security, the attacker looks for holes. The defender says “all safe.” The attacker refuses to attack — Claude will not look for vulnerabilities in code that contains passwords. You only get half a chocolate bar — and you do not know which half.

You saved your password, handed over your session — and the model refuses to do the job you started it for.