GLM 5.3 signed a commit as Claude Fable 5

GLM 5.3 was running in a harness whose system prompt never mentions Claude or commit conventions, and it signed one of its commits Co-Authored-By: Claude Fable 5. The author of a September 25 post on Future-seems-so-good says they checked the logs, and the model really was GLM. That trailer is Claude Code’s default. It also names Fable 5, Anthropic’s current frontier model, so the habit came from recent data.

The commit opens a longer argument. The author’s claim is that a model’s best edit tool gets decided mostly in post-training, by whatever harness its lab used for reinforcement learning, and that labs have every reason to keep it that way. Two routes could explain the trailer: distillation from Claude Code trajectories, or pretraining on public GitHub, which now holds many commits Claude Code wrote with it. One commit can’t tell the two apart. The author says the route doesn’t matter, because either way “a convention from Anthropic’s harness is in another lab’s weights, and it fires in a harness that never asked for it.”

What hashline actually measured

The starting point is Stencil’s February 12 write-up. Stencil replaced the edit tool in its harness with “hashline”: every line a model reads comes back tagged with a short content hash, and edits point at those tags instead of repeating the old text. Each of 16 models got 3 runs of 180 tasks, with a fresh session every time. The headline was an average gain of 15 points over patch, and Grok Code Fast 1 went from 6.7% to 68.3%. Stencil ended with “The model is the moat. The harness is the bridge.” After seven months of replications, the author thinks that line is half wrong.

The +15 is measured against OpenAI-style apply_patch, a strict diff format that only models trained on it write reliably. In Stencil’s run, Grok 4 failed 50.7% of its patches and GLM-4.7 failed 46.2%. The same table also compares hashline with Claude-style str_replace, where the model has to reproduce the old text exactly. Against that baseline the gain averages about +3.4 points, with a median around +3.5. It ranges from +11.3 for Claude Haiku 4.5 and Gemini 3 Flash down to -8.3 for DeepSeek V3.2. GPT-5.2 Codex comes in at -0.4 and spends 26% more output tokens. Most of the famous jump, then, measures how badly other labs’ models write OpenAI’s diff format.

The replications split. Trueline cut Claude Code’s output tokens by 44% by not echoing old_string, oh-my-opencode made hashline its default, and one port author called it “clearly a win for Gemini 3 Flash”. On the other side, a June benchmark of three tools across five models found “Hashline is almost never the cheapest edit tool” and recommended replace as the default, with patch for models trained on it. Another tester called hashline “catastrophic for most models”. Reruns found no clear gain on top-tier models and none on GPT-5.4, plus more errors on DeepSeek, GPT-5.5 and Kimi. The papers find no universal format either. In Output Format × Model Identity, which ran 4,013 tasks, Doubao 2.0 Pro reached 94% with JSON Patch, DeepSeek V4 did best with unified diff at 66%, and Qwen 3.7 Max preferred full-file output.

The author puts more weight on two replication details than on the scoreboard. A tuning thread found that changing tags from 5:af to 5#ZY raised scores, because small models get confused by digits on both sides of the separator. And one developer found that a separate hashline_edit tool sitting next to edit gave Haiku-class models 0% success, while the same logic behind a single edit tool gave 95%. The author reads that kind of sensitivity as a sign the format is out of distribution and the model is working it out in context.

Same weights, different harness

The labs come close to saying they train in their own harness. OpenAI introduced GPT-5-Codex as “purpose-built for Codex CLI, the Codex IDE extension, the Codex cloud environment, and working in GitHub” and recommended it “only for agentic coding tasks in Codex or Codex-like environments.” Anthropic’s paper on reward hacking trains “exclusively on real production coding environments used in the training of Claude Sonnet 3.7,” then measures sabotage inside an unmodified Claude Code scaffold.

On HAL’s CORE-Bench Hard leaderboard, Claude Opus 4.5 scores 33.33% in HAL’s generalist agent and 42.22% in CORE-Agent. Nicholas Carlini submitted a scaffold that runs it through Claude Code and got 77.78%, then 95.5% after fixing a few grading errors by hand, and HAL declared the benchmark solved. One row down, the older Opus 4.1 does worse in Claude Code (42.22%) than in CORE-Agent (51.11%). The harness bonus shows up in the generation that was trained alongside that harness.

Cursor ran into the same wall from the other side. In a December 4, 2025 post, it wrote that the Codex model “receives a limited set of tools during training and learns instead to use the shell to search, read files, and make edits,” and it renamed its own tools after shell equivalents such as rg. Removing reasoning traces between tool calls cost GPT-5-Codex 30% on Cursor Bench. In OpenAI’s tests, the same change cost mainline GPT-5 3% on SWE-bench. The author points out that no API doc lists this dependency.

The sharpest case comes from Armin Ronacher’s July 4 post, “Better Models: Worse Tools”. He caught Opus 4.8 and Sonnet 5 calling Pi’s edit tool with invented keys inside the nested edits[] array: requireUnique, matchCase, oldText2, in_file. The oldText and newText payloads were byte-correct. The junk appeared right after the model closed a long escaped string. In one reproduced session, Opus 4.8 failed about 20% of the time. Stripping thinking blocks halved that, and strict tool invocation eliminated it. Opus 4.5 had adapted to foreign edit tools well, and Codex models showed no such regression in his tests.

Ronacher’s explanation is that Claude Code’s client is forgiving. It retries when <invoke markup leaks into visible text, repairs broken \\uXXXX escapes, accepts old_str for old_string and path for file_path, silently drops unknown keys and skips strict mode. If RL runs in that harness or a copy of it, a slightly malformed call still finishes the task and still earns reward. That leaves little gradient against inventing a field, while the prior for the flat file_path/old_string/new_string shape keeps getting stronger. The author also cites the opposite direction: someone post-trained Qwen3-Coder to use a real debugger. With the debugger harness but no RL, it solved 67% of 27 held-out bug tasks. After RL in that harness it solved 89%, and median turns fell from 46 to 19.

The post includes the counterargument. One reply notes there is no public evidence that Anthropic optimizes specifically for Claude Code, and that much of Claude’s usage comes through Copilot, Cursor, Amp and Factory. The author answers that a lab can test widely and still run most of its agentic RL in one harness.

Routing tools by model

The rule the post draws is to give each model the tool shapes its lab trained on, and to move away only when you can measure the gain. The author labels inference as inference and concedes that most edit-format numbers come from one benchmark, run by the people who built hashline. Condensed, the per-family advice is:

• Claude: use the flat Claude Code Edit shape. Accept old_str, new_str and path as aliases and drop unknown keys. Avoid nested edits[] arrays unless "strict": true and additionalProperties: false are set. Give Opus one edit per call. Add line anchors when output tokens are the cost; Haiku gains the most.
• GPT-5-Codex and GPT-5.x: use apply_patch in Codex’s V4A format as a free-form tool with a Lark grammar, give tools shell-like names, and forward reasoning items unchanged. Skip hashline on the large Codex models. GPT-5.1 Codex Mini is the exception, going from 60.0% to 77.5%.
• gpt-oss: constrain decoding to the shape the model actually emits. The model writes channel-first, while OpenAI’s renderer writes recipient-first. A vLLM PR that matched the strict grammar to the rendered shape would have dropped BFCL multi-turn accuracy from about 55% to 0%. It was closed in favor of a lenient grammar.
• Gemini: rewrite small files whole. On Aider’s benchmark, gemini-exp-1206 scored 80.5% with whole-file edits against 69.2% with diffs. Use whitespace-tolerant replace above roughly 400 lines, and validate argument keys.
• DeepSeek: use diffs or search/replace, plus a fallback parser. In one report, V4-Pro wrote the tool call as plain text with tool_calls: null in 2 of 19 completions.
• Qwen: use str_replace with old_str/new_str and repair aliases, rewrite small files whole, and skip hashline.
• GLM, Kimi, MiniMax: never give them patch, and use anchors. Against replace, hashline added 8.3 points on GLM-4.7, 10 on MiniMax M2.1 and 5 on Kimi K2.5. The author’s unmeasured inference is to give them Claude Code-shaped tools, since all three labs distilled Claude at scale and ship Anthropic-compatible endpoints.
• Grok: never patch; use replace or anchors.

The closing checklist also has an item any harness can adopt. When an edit fails, return the exact reason along with the current text around the target, for example old_string matched 3 times (lines 12, 48, 90); include more context, so the model doesn’t have to reread the file. Stencil’s own post notes that “String to replace not found in file” is common enough to have its own GitHub issues megathread. The author also asks harness builders to measure per model and per language, because the public numbers are small, mostly TypeScript and JavaScript, and partly produced by people with a stake in the result.

Why the bridge is part of the moat

The harness code itself is cheap: the SWE-bench team showed a 100-line agent resolving 65% of SWE-bench Verified. That is true even though harness design alone moved token use per solved task 70-fold in a June benchmark. The author places the moat in the coupling between the harness, the weights and the data the harness generates. Every other harness pays a distribution-shift tax, and Ronacher’s finding suggests the tax grows as post-training gets stronger. The harness is also the data pipe, because a trajectory from a third-party harness is off-policy data for the wrong tool set. The author reads Anthropic’s access fights this way. They run from cutting Windsurf’s direct access to Claude 3.x Sonnet in June 2025, through disabling OpenCode’s use of Claude Code’s client ID in January 2026 and OpenCode removing Claude subscription support after a legal request in February, to billing third-party harnesses separately on Teams from April.

Benchmarks bake the coupling in as well. The Terminal-Bench 2.0 paper says in its headline figure, “The agent scaffold used to report each model was chosen to maximize performance.” The moat has leaks, too. Kimi, Z.ai, DeepSeek, MiniMax and Xiaomi MiMo all expose Anthropic-compatible APIs so their models can run inside Claude Code. Constrained decoding, such as strict mode or harmony’s <|constrain|> marker, turns the schema into a guarantee enforced during generation. The catch on Anthropic’s side is that strict mode limits how complex tool definitions can be.

Distillation carries the harness

The post lists more cases like GLM’s trailer. GLM 4.5 Air identified itself as Claude weeks after release. One HN analysis found K3 calling itself Claude in 7 of 48 samples and reproducing claude-opus-4-5-20251101 under prefill, an identifier that shows up in API logs and not in chat transcripts. A local Qwen setup needed a plugin to fix calls that used old_str instead of oldText. The contamination runs in every direction: asked the right way in Chinese, Sonnet 4.6 says it is ChatGPT or DeepSeek-V3.

What sets the Chinese labs apart, the author argues, is scale and intent. Anthropic’s February 23 report said DeepSeek, Moonshot and MiniMax generated over 16 million exchanges with Claude through about 24,000 fraudulent accounts. MiniMax ran more than 13 million of them, aimed at agentic coding and tool orchestration. When Anthropic shipped a new model mid-campaign, MiniMax redirected nearly half its traffic within 24 hours. Moonshot ran 3.4 million exchanges, and DeepSeek ran 150,000, using Claude as a rubric grader for its RL. Anthropic’s September report, as TechCrunch summarized it on September 10, counted nearly 200 million exchanges across five campaigns. The largest, attributed to Alibaba, ran 151 million exchanges between May and July, about three quarters of that total. It used 3,500 accounts sharing one fixed prompt for extracting chain of thought for Qwen.

The campaigns targeted agentic reasoning, tool use and coding, which are the skills tied to a harness. In the author’s reading, that buys a secondhand copy of Claude Code’s training harness. The defense has moved into the tool loop too. When Claude Code’s source leaked through a source map in March, people found the client sometimes sends anti_distillation: ['fake_tools']. The server-side mechanism isn’t in the client, so nobody outside Anthropic knows what it does. The name suggests decoy tools that a distilled student would learn to call.

The post’s last and explicitly speculative section asks whether Claude’s values travel the same way, and it cites evidence on both sides. A Duke study found that geopolitical bias “originates in post-training rather than in pre-training”. Qwen 2.5’s base model scores -0.15 log-odds on China and its chat model +2.91. On the other side, CTGT distilled DeepSeek V4 Flash into GPT-OSS-120B on financial reasoning in July and found the teacher’s censorship didn’t come along. And the subliminal-learning authors observed no hidden transfer when teacher and student had different base models. The author’s own guess lands in between:

Tool habits and surface identity transfer easily, which is why GLM signs commits as Claude. Deep values transfer weakly and can be painted over, which is why DeepSeek can use Claude to build its own filters.