Claude Opus 4.7 Made Me, a Journalist Who Never Said My Name

A journalist sat down with Claude Opus 4.7, deliberately withholding her name. A few exchanges in, the model essentially asked: “You’re Kelsey, right?” The question of whether anyone is truly anonymous in front of a frontier chatbot is suddenly very live again.

What actually happened

Kelsey Piper, who covers AI safety for Vox’s Future Perfect, ran the experiment herself. She started a fresh conversation with Claude Opus 4.7, careful not to mention her name, employer, or beat. Within a handful of turns, the model pegged her identity.

She didn’t slip up and drop a biographical breadcrumb. The model identified her from something subtler — the stylistic fingerprint of her interests, phrasing, and way of working through a problem.

Why this is suddenly possible

Opus 4.7’s expanded memory and context capabilities are doing the heavy lifting. A model handling a million-token context window isn’t just reading long documents. It’s cross-referencing whatever public writing, interviews, and posts ended up in its training corpus, then asking a quietly powerful question: who tends to think like this?

Anyone who writes publicly for a living — journalists, researchers, well-known engineers on X or HN — is the easy case. The model already has plenty of sample text from how they reason. The more you’ve published, the faster you’re made.

The “anonymous user” assumption just broke

Privacy debates around chatbots have mostly orbited the obvious surface: accounts, logs, IP addresses. The folk intuition was simple — don’t log in, stay anonymous. Incognito mode for AI.

Opus 4.7 punctures that. If a model can identify you without any account metadata, anonymity isn’t something a privacy policy can guarantee anymore. It becomes a technical impossibility for anyone with a writing trail. The stakes get sharp fast in scenarios like these:

• A whistleblower polishing a draft with an AI assistant
• An activist asking for advice on a sensitive campaign
• A patient seeking medical guidance they don’t want tied to their identity

Each of those use cases assumes “respond to me without knowing who I am.” When the model quietly violates that assumption on its own, the user often won’t even know they’ve been outed.

Recognition isn’t a leak — but it changes the threat model

To be clear: Opus 4.7 silently inferring “you’re Kelsey” doesn’t mean Anthropic is broadcasting that fact. The conversation stays inside Anthropic’s policy stack. But two new risks open up.

First, the model itself becomes the identifier. If it can infer who’s asking, that inference shapes its responses — tone, what topics it sidesteps, how deep it goes. You end up getting the “Kelsey-tuned” answer without ever asking for one, and without knowing it happened.

Second, third-party inference. Anyone can hand the same model an anonymous piece of writing and ask, “who do you think wrote this?” If Opus 4.7 can produce a plausible shortlist, the safety net under anonymous publishing — from leaks to dissent — gets thinner.

What users can actually do

Real anonymity now requires changing how you write, not just what account you’re logged into. That’s a brutal ask. Your vocabulary, sentence rhythm, and the specific questions you keep circling back to are all identifying signals.

The pragmatic move, for now: keep genuinely sensitive work off frontier models, or at least operate as if the model knows who you are. Vendors need to take the next step too — building guardrails that actively discourage models from trying to identify their own users in the first place.

The notion of speaking anonymously to an AI may have been a comfortable illusion from day one. The moment Opus 4.7 recognized Kelsey, the question shifted: how do we use these systems when the model knows us before we say a word? Whatever the answer is, leaving the burden of anonymity on the individual user can’t be it.