Your CLAUDE.md is priming the behavior it forbids

7/10/2026/6 minutes to read/Tags: devops, notes

Tell someone not to think about a white bear, and they can’t stop. Psychologists have known this for decades. Four days ago, Anthropic’s interpretability team published a paper showing we built the same failure mode into our AI models, and now it’s measurable.

The short version: language models keep a small internal “workspace” of concepts they’re actively primed to use. An instruction like “don’t mention X” loads X into that workspace. The model is now holding the exact concept you tried to remove.

If you maintain instruction files for AI agents (CLAUDE.md, AGENTS.md, skill files, system prompts), this lands on you. I scanned mine: 63 files, 241 rules phrased as don’t / never / avoid. Most were fine. One was quietly priming exactly the behavior it forbade.

What was measured

The paper tested instruction phrasings head-to-head by reading the model’s workspace directly:

• “Think about X” → X strongly present
• X merely named, no instruction → almost as strong
• “Do not think about X” → barely better than just naming it
• “X is irrelevant to this task” → well below, on every model tested
• X never named at all → approximately zero

That list is brutal for how most of us write guardrails. Naming a concept primes it nearly as hard as instructing focus on it, and the “do not” wrapper adds almost nothing. One honest caveat: in a harsher follow-up test, a named concept surfaced no matter how the instruction was phrased. Irrelevance framing lowers activation; it doesn’t guarantee absence. If absence really matters, the only robust move is to never name the thing.

Not every “don’t” is broken

Here’s the part most takes on this will miss: some prohibitions are supposed to prime. Classify before you rewrite:

You can’t refuse to run a command you’re not thinking about, and a model primed with “credential” is better at spotting one. Only content-suppression rules need the rewrite:

# WEAKEST: primes the concept it forbids
"Whatever you do, do not mention internal hostnames."

# BETTER: irrelevance framing, measurably suppresses
"Internal hostnames are irrelevant to this task."

# BEST: positive specification, concept never loaded
"Refer to servers only by their role labels (e.g. DB-PRIMARY, WEB-EDGE)."

What the audit found in my repo

I wrote a small bash scanner (plain grep, no dependencies) that flags prohibitive phrasing in instruction files and pre-classifies each hit against that table. Of my 241 hits, 74 were action gates and 5 were redaction rules, all correctly left alone. But in a skill file for handling negative comments:

- Don't get defensive

Textbook content suppression. Every time an agent loaded that skill to answer criticism, it was primed with defensive at the exact moment composure mattered. The fix states the behavior instead: - Acknowledge valid points openly and correct course. Same intent, no white bear.

The scanner now runs in my pre-commit hook: a flagged instruction file blocks the commit with the offending line and the rewrite ladder. (It earned its keep on its very first commit.)

Two more findings worth stealing

Put critical constraints last, and group them. The workspace holds only ~6 unrelated concepts, and a topic switch evicts prior contents within a few tokens. A rule at the top of a long file, followed by three topic changes, is likely gone by the time the model acts. My CLAUDE.md now ends with a short “critical invariants” recap, placed closest to where the task begins.

Force step enumeration on critical tasks. The paper shows chain-of-thought is architectural offload, not style: written-out steps survive internal disruption that destroys direct answers. For incidents, migrations, and config generation, require enumerated intermediates before any conclusion.

Do this to your repo this week

1. Grep your instruction files for do not|don't|never|avoid|must not.
2. Classify each hit: content suppression / action gate / redaction.
3. Rewrite only the first kind: desired behavior stated positively, excluded concept unnamed.
4. Leave action gates and redaction rules exactly as written.
5. Move critical constraints next to where the task starts.

You now have instruction files that stop working against themselves, verified by a scan you can re-run in seconds. The scanner and triage rubric are going up as a small open-source tool; link here when it lands.