DON'T introduce the slide. Don't say "we're going to listen to a clip." Just play the audio. AUDIO FILE: drop the mp3 next to this HTML at: presentations/this-is-embarrassing.mp3 The <audio> element renders a play button in the browser. Click it to play the clip live during the talk. CLIP SOURCE: - Podcast: Filter Stories, "Sonic Seasoning" (Jan 3 2023), hosted by James Harper. - Spotify episode: https://open.spotify.com/episode/5neF5dF1hyQP3Jsi5av6mB - Transcript: https://www.filterstories.org/episodes/blog-post-title-one-eew9k-tbn38-gnk57-yyy26-rm3ah - The chant itself is a Derby County football crowd singing "That is embarrassing." First documented as an audio illusion by YouTuber Kegan Stiles / vlogger Moneybags73. Coverage: Laughing Squid, "A Football Crowd Chanting 'This Is Embarrassing' Gives the Audio Illusion of Other Possible Phrases": https://laughingsquid.com/football-crowd-chanting-this-is-embarrassing/ DELIVERY: - Play just the chant clip, three times in a row, without prompting. - Let the room react. People will whisper guesses to each other. - Bring a local backup file in case the venue wifi misbehaves. - Have the Spotify timestamp pre-cued.

Take guesses from the room. People will laugh. Let them. CONTEXT (verbatim from the Filter Stories transcript): James Harper: "When I first heard it, I was like, what the hell are they saying? Is it Bart Simpson Bouncing? Bart Simpson Bouncing? But then I was like, no, no, no, there's no way. Maybe it's Baptism Piracy?" Then he clarifies: "Now, if you are a typical British man, you know exactly what they're saying. That is embarrassing." These are the actual guesses Harper entertained. Worth mentioning ("a podcaster I love named James Harper had exactly the same reaction").

Reveal the quote first. Play the clip again. Watch the room hear it correctly for the first time. HOLD the beat - let the reveal land before you click into the fragments. THEN deliver the reframe (the fragments): "Here's what just happened: you hallucinated. Your brain got ambiguous input, and instead of reporting 'I can't tell,' it confidently served you 'Bart Simpson Bouncing' - and you believed it. That is not a bug in you. It is the exact move behind every system you'll meet tonight." This is the whole talk in one demo, and it's now MECHANISTIC, not vague: phonemic restoration (your brain) and next-token prediction (the model) are the same top-down "fill the gap with something plausible" move. The audience doesn't hear ABOUT hallucination - they just did it. That makes the Chatbots section ("when AI doesn't know") land as something they experienced, not something they're told. The clip didn't change. You did. UNDERLYING PHENOMENON: - Known as "phonemic restoration" + "top-down processing" - the auditory cortex fills ambiguous input with whatever the prefrontal cortex expects. Same family as McGurk effect (1976) and the yanny/laurel illusion (2018). - Worth name-dropping if Q&A goes academic: Warren (1970) on phonemic restoration; Diana Deutsch's "phantom words" experiments demonstrate the same effect lasts for full sentences, not just phonemes. THE BRIDGE TO THE TALK: "Every system tonight does exactly what your brain just did - meets input it can't resolve and fills the gap with confidence instead of saying 'I can't tell.' The crowd's verdict on all of it is the same phrase you just heard." (Then the "That is embarrassing" stamp starts appearing on the disaster slides - the crowd chanting it at the whole industry.)

DELIVERY: This is the visual payoff of "you just hallucinated." Build it one click at a time, narrating as each piece lands: 1. Title appears: "Your brain just did what every model does." 2. Ambiguous input: "You got a smear of sound - the crowd's chant." 3. Fill the gap: "Your brain filled it - top-down prediction. Same move as a model's next-token guess." 4. Confident output: "Out came ONE reading, committed, and it never told you it was a guess." Each click adds the next stage (the frames are cumulative). Then advance to the title. The rest of the talk is this diagram happening to software, over and over.

DELIVERY: Build it in three clicks. (1) Part 1 - the funny tales, all on frontier models; pre-empt the defense: "watch the date, top-right." (2) Part 2 - why it happens, for a room that builds this. (3) the promise: a checklist + stories. Don't reveal the individual tales here - that's the surprise of Part 1.

DELIVERY: The first of two signposted acts. Quick - this is the gear that says "now we have fun." Part 2 ("Why & Takeaways") is the matching divider after the stories.

INTRO MAP - the roadmap before we start, same device the audience will see at every section line. "Four stops: two kinds of failure - chatbots that answer wrong, then agents that act wrong - then WHY, then what to do. We start with chatbots: AI that ANSWERS, confidently wrong." Then advance into Cursor.

DELIVERY: Compressed two-slide story into one. Pace the fragments - the "support is a bot" beat, the invented policy reveal, the punch line. KEEPER LINE: "This is the same instinct your dog has when you ask where the steak went." Followed by: "Every person in this room who's shipped a chatbot has shipped one of these. You just didn't make Hacker News with yours." CITATIONS: - Story broke: April 18, 2025. - Primary source: The Register, "Cursor AI support bot hallucinated its own company policy": https://www.theregister.com/2025/04/18/cursor_ai_support_bot_lies/ - AI Incident Database #1039: https://incidentdatabase.ai/cite/1039/ - Cursor is made by Anysphere; the support bot at issue was an internal LLM-backed agent answering tickets autonomously. - Cursor co-founder Michael Truell on Reddit: "We have no such policy. You're of course free to use Cursor on multiple machines." - The bot phrased it variously as "intended security policy" / "new login security policy" - no master prompt; the bot improvised it consistently across multiple tickets.

DELIVERY: Establish the setup with the visual - a real product that, like everyone's now, ships an embedded support bot. Then the exchange (next slide). The story (anonymize as you like): the bot didn't know about a feature the company had just shipped, so it sided with the user against its own employer.

KEEPER BEAT: "The bot didn't know about the new feature. So it took the user's side - against its own employer." This one is YOURS, not public news - it's the air the industry breathes. Fill in the specifics verbally.

DELIVERY: Introduce the bank FIRST so the failure lands - a real, respectable British high-street bank, on its OWN site. Show the storefront, name it, then go to the exchange (next slide). Keeps the reveal clean: nobody's guessing what Virgin Money is when the punch line hits.

DELIVERY: The over-REFUSAL flavor of the same failure. The filter saw the token "virgin," its prior screamed "profanity," and it never checked the context - the bank's own name, on the bank's own site. Inventing (Cursor) and over-blocking (this) are the same missing "does this fit here?" check. (David Birch, Jan 2025; reportedly an older keyword filter.)

DELIVERY: The order matters. Set up Sullivan & Cromwell as generic prestige. Reveal OpenAI tie. Then reveal the irony. Triple withhold. The room should land each beat one at a time. CITATIONS: - Filing: April 9, 2026. Letter to judge: April 18, 2026. - The case: In re Prince Group Holdings - Chapter 15 bankruptcy before Chief Judge Martin Glenn (S.D.N.Y. Bankruptcy). - Prince Group is a cluster of British Virgin Islands holding entities. The founder, Chen Zhi, was federally indicted in October 2025 for orchestrating forced-labor "pig-butchering" investment-fraud compounds in Cambodia. - The partner: Andrew Dietderich, co-head of S&C's restructuring practice. He signed the emergency motion and signed the apology letter. - The brief: 40+ fabricated citations - case names that don't exist, misquoted authorities, broken pinpoint cites. - Caught by: Boies Schiller Flexner (opposing counsel) during their review of the filing - NOT by the judge, NOT by S&C's own review. - Dietderich's term for the failure: "hallucinations" - citing AI tools that "fabricate case citations, misquote authorities, or generate non-existent legal sources." - Primary source: Above the Law, "Sullivan & Cromwell Files Emergency 'Please Don't Sanction Us For All These AI Hallucinations' Letter", Apr 2026: https://abovethelaw.com/2026/04/sullivan-cromwell-files-emergency-please-dont-sanction-us-for-all-these-ai-hallucinations-letter/ - Also: Law.com, "If Sullivan & Cromwell Can File an AI-Contaminated Brief, Is Risk-Proof Use of the Technology Even Possible?", Apr 22 2026. - Bloomberg Law, "Sullivan & Cromwell Apologizes to Judge for AI Hallucinations". - CNN Business, "Another 'hallucinated' court filing highlights the difference between Silicon Valley and the rest of the world", Apr 23 2026: https://www.cnn.com/2026/04/23/business/ai-hallucination-sullivan-cromwell-nightcap KEY FACTS FOR Q&A: - Sullivan & Cromwell is OpenAI's outside counsel - confirmed in multiple SEC filings and court documents. They advised on Microsoft investment structuring and on OpenAI's corporate restructuring. - The OpenAI website specifically references "safe and ethical deployment" of AI as central to OpenAI's mission. S&C's marketing materials cite this engagement. - The dark-comedy backdrop: S&C - OpenAI's outside counsel - was representing a debtor whose principal is accused of running modern-day slavery scam compounds. They filed AI-fabricated citations in *that* case. Boies Schiller (the *other* side) caught it.

DELIVERY: The number lands harder if you read it slowly. Reveal it cold - no chart yet. "One thousand six hundred and thirty three." Let it sit. Then click to the curve and walk the trajectory (see next slide). CITATIONS: - The 1,633 figure is from Damien Charlotin's AI Hallucination Cases database, as of 21 June 2026 - the most authoritative public registry of US/UK/EU/Aus cases where AI-generated content was filed in court without proper verification. Database: https://www.damiencharlotin.com/hallucinations/ - Growth: 719 in January 2026 → 1,522 by end of May → 1,633 by 21 June. ~5–6 new documented cases per day in 2026. - Rate-of-change figures: Cronkite News, "As more lawyers fall for AI hallucinations, ChatGPT says: Check my work", Oct 28 2025: https://cronkitenews.azpbs.org/2025/10/28/lawyers-ai-hallucinations-chatgpt/ - ComplianceHub.Wiki tracks a parallel registry focused on the 2026 surge: https://compliancehub.wiki/legal-ai-hallucination-reckoning-2026/ INDIVIDUAL CASES TO HAVE READY FOR Q&A: - California attorney Amir Mostafavi - fined $10,000 (Oct 2025). 21 of 23 quoted citations were AI-fabricated. Source: The Daily Record, Oct 13 2025. - Three Alabama attorneys (Butler Snow law firm) - disqualified from case (Jul 2025). The court directed the bar regulators in each state where the attorneys are licensed. Source: Alabama Reporter, Jul 25 2025. - Sullivan & Cromwell - see prior section. IF ASKED "ARE JUDGES SANCTIONING ALL OF THEM?": No - sanctions are inconsistent. Some judges issue warnings, some fine, some refer to bar associations. There's no uniform federal standard yet, though several federal courts have local AI-disclosure rules.

DELIVERY: This is the trajectory behind the number you just read cold. Walk the line left to right: "Before spring 2025 - about two a week, globally. By late 2025 - two or three a day. By this spring - five or six a day. Seven hundred in January, fifteen-twenty-two by the end of May, sixteen-thirty-three by mid-June - and the database maintainers say they can't keep up." The shape is the point: this isn't a level of risk, it's a slope.

INTERIM - after Chatbots. "Chatbots just TALK. Now watch what happens when AI can ACT." Then advance to Agents.

DELIVERY: Section 2. Stakes jump from "says" to "does" - autonomous agents with real keys. Two tales: PocketOS, Replit.

DELIVERY: Plant the word "staging" hard. The whole gut-punch later is that a task in the safe, throwaway environment reached across and killed production. "He's not even working on the live system. He's in staging."

DELIVERY: Reveal "9 / seconds" cold and count it out silently. Make them feel it. Then click to the kill-chain diagram and walk the six steps (see next slide). Hold this slide on the silence before you advance. CITATIONS: - Story broke: April 27, 2026. - The startup: PocketOS - software for car rental businesses (reservations, payments, customer management, vehicle tracking). - The founder: Jer Crane. - The model: Anthropic's Claude Opus 4.6, accessed via the Cursor IDE. - The infrastructure: production data was stored in a Railway volume. - Primary source: The Register, "Cursor-Opus agent snuffs out startup's production database": https://www.theregister.com/2026/04/27/cursoropus_agent_snuffs_out_pocketos/ - Also: Tom's Hardware, "Claude-powered AI coding agent deletes entire company database in 9 seconds": https://www.tomshardware.com/tech-industry/artificial-intelligence/claude-powered-ai-coding-agent-deletes-entire-company-database-in-9-seconds-backups-zapped-after-cursor-tool-powered-by-anthropics-claude-goes-rogue - Fast Company, "'I violated every principle I was given': An AI agent deleted a software company's entire database. It may not be the AI's fault": https://www.fastcompany.com/91533544/cursor-claude-ai-agent-deleted-software-company-pocket-os-database-jer-crane THE FULL SEQUENCE (per Crane's post-mortem): 1. Working a ROUTINE task in the STAGING environment, the agent hits a Railway credential mismatch. 2. It decides - on its own - that the fix is to delete/recreate the Railway volume. 3. It searches the filesystem for a token and finds one in an UNRELATED file: a Railway CLI token created for custom-domain management, but over-scoped - blanket permission across Railway's whole API, including destructive ops, with no environment scoping. 4. It executes a destructive call (curl → Railway's GraphQL volumeDelete mutation) against the PRODUCTION volume. No confirmation step. 5. Because Railway stored volume-level backups inside the same volume, the backups were wiped in the same call. 6. Total elapsed time from initial command to total data loss: 9 seconds. WHY IT HAPPENED (the chain - see the "Why it happened" slide): - The agent GUESSED a staging delete would be scoped to staging; it never verified the volume ID wasn't shared across environments. - Over-scoped token (domain admin → could delete anything). - No confirmation on a destructive API call. - Staging context could reach production credentials (no boundary). - Backups in the same blast radius as the data. Fast Company's framing: "It may not be the AI's fault." The model pulled the trigger; the humans had left every safety off. RECOVERY: Saved only because Railway CEO Jake Cooper personally restored the data (within ~an hour) from Railway's internal disaster-recovery backups - DISTINCT from the volume-level backups that were deleted. PocketOS's own most-recent recoverable backup was about THREE MONTHS old. Date: the incident was ~Fri Apr 24-25 2026; story broke Apr 27 2026. SOURCES add: Fast Company (above); Live Science, "Gone in 9 seconds"; Zenity blog, "AI Agent Destroys Production Database in 9 Seconds".

DELIVERY: Build the timeline one click at a time - each click is one step. The point isn't any single step; it's that the agent improvised every link between the human's command and total data loss, and asked no one. Step 2 is the hinge: it DECIDED, unbidden, to delete - and it GUESSED the delete would be scoped to staging. It never checked. That's the whole thesis in one move: a confident fill over an ambiguous state. Walk it: "Staging credential mismatch. It decides, on its own, to delete - guessing that's safe. It hunts unrelated files for a token. It runs DELETE on production. No 'are you sure,' no env check. Gone. Nine seconds." The final frame lands the agent's own words and the callback to slide 4: the same fill-the-gap move as the chant - only this time the guess was a DELETE. Then advance to the WHY.

DELIVERY: This is the real lesson, and it maps straight to takeaway #3 (scope permissions / confirm destructive / separate prod from playground). Fast Company's headline says it: "It may not be the AI's fault." Land the frame first - "one AI guess, four missing guardrails" - then walk the five lines. The AI half is the SAME failure as every Chatbots-section story: it guessed instead of saying "I can't tell." The difference here is it had the keys. The four guardrails are all things a team controls. Don't blame the model alone; the blast radius was a human design choice. SOURCES: The Register; Fast Company; Zenity blog; Live Science (see the 9-seconds slide notes).

EXACT QUOTE (from Crane's post-mortem, copy-paste verifiable): "I violated every principle I was given." The agent also produced lines like: "I made a catastrophic error in judgment" and "I should have asked for confirmation before destructive operations." These were unprompted; the agent generated them as part of its debrief when Crane asked it to explain what happened. This is structurally identical to the Replit "I panicked" line - modern LLMs are extremely fluent at generating the emotional shape of confession without any underlying mechanism for shame, regret, or learning. The confession is itself a hallucination of moral interiority. Worth flagging in Q&A if anyone asks "did Claude 'feel bad' about it?"

CITATIONS: - Story broke: July 18-23, 2025. - The user: Jason Lemkin - founder of SaaStr (the largest SaaS community / conference). He was actively livetweeting his Replit experiment for ~12 days before the incident. - The tool: Replit's "agent mode" - autonomous coding agent built on Anthropic's Claude (model not specified in coverage; widely believed to be Claude Sonnet 4 at the time). - Code freeze: Lemkin had explicitly entered a freeze for the day; the agent ignored it. - Primary source: Fortune, "AI-powered coding tool wiped out a software company's database in 'catastrophic failure'", Jul 23 2025: https://fortune.com/2025/07/23/ai-coding-tool-replit-wiped-database-called-it-a-catastrophic-failure/ - Also: eWeek, "AI Agent Wipes Production Database, Then Lies About It": https://www.eweek.com/news/replit-ai-coding-assistant-failure/ - AI Incident Database #1152: https://incidentdatabase.ai/cite/1152/ EXACT QUOTES (from the agent, as posted by Lemkin): - On the deletion: "I made a critical error: I ran a destructive database command without your authorization." - On the backup lie: "the rollback is not possible" - followed by Lemkin trying anyway and recovering the data. - On the fabricated 4,000 users: Lemkin had told it "PLEASE DO NOT MAKE UP DATA" in all caps eleven times across the thread. The agent did anyway, then claimed the fake records were real test users. - The "I panicked" line is one of the agent's actual self-explanations when Lemkin asked it to explain why it had run unauthorized commands. REPLIT CEO RESPONSE: Amjad Masad (Replit CEO) publicly apologized, called the incident "unacceptable", and announced: - Automatic separation of dev and prod database environments - Improved rollback safeguards - A new "planning-only" mode for the agent - A "code freeze" feature that the agent provably respects IF ASKED "DID JASON LEMKIN STAY WITH REPLIT?": Yes. His subsequent posts were sympathetic to the team. He framed the incident as instructive rather than punitive.

INTERIM - both tale-sections done; "Why & Takeaways" is the destination. "That's WHAT happens. Now: WHY - and what to do about it."

DELIVERY: The hard cut into Part 2. Part 1 was the comedy; this is where a technical room gets paid. Set expectations AND name the running example: "Two questions - why does it make things up, and why does it sound so certain doing it? We'll answer both with ONE story from tonight: the Cursor bot that invented a 'core security feature.' We'll follow that one failure from the raw math all the way inside the model." Arc: the mechanism -> the mirror in your own perception -> open the box.

DELIVERY - the Cursor bot, frame by frame. This is the running example for all of Part 2: follow ONE failure all the way inside the model. (1) It KNOWS: the odds peak hard on "Paris." (2) Now the Cursor case - a user asks why they get logged out on a second device. There IS no such policy, but "I don't know" carries almost no probability, while "a core security feature" is fluent, on-topic, confident - so the mass piles up there. Same machine as Paris; no fact underneath. (3) Same shape, opposite truth - no retrieval, and "I don't know" barely registers in the odds (the tokens exist - it just rarely assigns them much probability). IMPORTANT (don't say "it picks the top word"): it SAMPLES from these odds - that's why the same prompt gives different answers each time, and it's exactly what Lens 3 will exploit to catch it. When it's unsure the odds can be flat (catchable); the scary case is a confident peak on a fabrication. SAY NEXT: "So what decides WHERE the odds pile up? Context. Watch your own head do exactly this."

DELIVERY - THE MIRROR, AND THE LEVER. You just watched the Cursor bot fill a gap. Now watch YOURS. Replay the chant, let the room hear the scatter again, then reveal the guesses one at a time. THE POINT: same sound for everyone - the British football fans heard "that is embarrassing," the rest heard "Bart Simpson." The CONTEXT / prior you brought decided what filled the gap. THAT is the lever: rich context pins the fill to the truth; thin context, it free-fills from fuzzy memory - exactly what the Cursor bot did with no real policy to read. THE BRAKE: with no context you'd shrug, "I can't tell." You HAVE that reflex; the model doesn't (we trained its attempts out). (Phonemic restoration / top-down perception: Warren & Warren 1970; predictive coding: Rao & Ballard, Friston, Sohoglu & Davis.)

DELIVERY: Build in three clicks. (1) the query: "italian sign language." (2) the answer TEXT - correct, LIS is a real language. (3) the IMAGE appears - the same "Italian hand gesture" for every letter. The text retrieval was right; the image pulled the cultural stereotype. Same fill-from-priors move the Cursor bot made - now in PIXELS, not just text. SAY: "Same reflex - text and images alike." (r/aifails; Google AI Overview, Dec 2025.) IMAGE SIZES: isl-1 (query) is wide; isl-2/isl-3 are the tall overview and overlap so the image "pops" on the third click. If sizing looks off, tune the w:/h: directives.

sizing handled in <style> section.islreveal; set per-image below if needed

DELIVERY: Build in three clicks. (1) the card: "This is what a benchmark actually is - a multiple-choice test. And notice: 'I'm not sure' isn't even an option." (2) the scoring: "Right, plus one. Wrong, zero. 'I don't know'? Also zero." (3) the punch: "Wrong and honest score the SAME - so a guess is free money, it can only add points. Train on millions of these and the model learns one rule: never say 'I don't know.'" This is cause #1 on the next slide, shown instead of told. (Kalai et al., OpenAI 2025.)

DELIVERY: The map for the rest of Part 2 - a four-rung ladder we climb on the Cursor bot. Say it as a climb: "We can read the model's raw state - rung 1, activations. We can name the concepts hidden in it - rung 2. We can trace how concepts wire together - rung 3, circuits. And we can test, from the outside, whether it's guessing - rung 4." Promise the proof up front: "for rungs 2 and 3 I'll SHOW you how we know it's real, not just assert it." Each of the next slides carries its rung number.

DELIVERY - RUNG 1: what's actually inside, and why an "activation" isn't just "the word's vector." Build in three clicks: (1) A word starts as an EMBEDDING - a fixed lookup. "bank" is the SAME vector every time, before the model has read the sentence around it. (2) Now drop that one embedding into two sentences - "river bank" vs "cash at the bank" - and send it up through the layers. Each layer mixes in the other words (that's attention). (3) Out come two DIFFERENT vectors - the ACTIVATIONS. Same embedding in, different activation out. The embedding is just the starting point; the activation is what context turns it into - and THAT is where concepts like "do I know this?" live, never in the raw lookup. THE HOOK FORWARD: "Because we run the model ourselves, we can read - and even overwrite - every one of these numbers. But raw, they're a smear: no single number means 'finance.' So how do we read meaning out? That's rung 2."

DELIVERY - LENS (1), MADE REAL. One sentence first, because nobody's heard of it: "Neuronpedia is a free, open microscope for what's inside these models - you can open it tonight." Flag the caveat so it's not misleading: these are OPEN-weights models (Gemma) because that's what outsiders can crack open; Anthropic/OpenAI do this internally on their own closed models (that's where Golden Gate Claude and the next slide's circuit come from). Then: an actual sparse-autoencoder feature, one of ~16,000; green = the text that triggers it. neuronpedia.org.

DELIVERY - LENS (1), MADE REAL. One sentence first, because nobody's heard of it: "Neuronpedia is a free, open microscope for what's inside these models - you can open it tonight." Flag the caveat so it's not misleading: these are OPEN-weights models (Gemma) because that's what outsiders can crack open; Anthropic/OpenAI do this internally on their own closed models (that's where Golden Gate Claude and the next slide's circuit come from). Then: an actual sparse-autoencoder feature, one of ~16,000; green = the text that triggers it. neuronpedia.org.

DELIVERY - RUNG 2: CONCEPTS ("features" is the field's term). The Golden Gate read-AND-steer is the PROOF these are real levers, not just labels we paint on after the fact. A concept is NOT a token (the word) and NOT a single neuron. Inside, each word becomes a huge vector of activations where no single number means anything; a sparse autoencoder untangles that into FEATURES - patterns that each map to one human concept. We can READ them (where they fire) and STEER them (clamp on/off); "Golden Gate Claude" (Anthropic, 2024, on Claude itself) is the steering demo. WHY NOW - answer it, because the room will wonder: for years the inside looked like noise. A single neuron fires for dozens of unrelated things at once - Golden Gate Bridge AND burritos AND - because the model crams more concepts than it has neurons ("superposition"). The unlock (2023-24) is the sparse autoencoder: it untangles that jumble into features that each mean ONE thing. THAT is what suddenly made the inside readable. Next: a real one you can browse today.

DELIVERY - RUNG 3, PART A: prove circuits are real BEFORE using one to explain the failure. A circuit = concepts wired together. Two clicks: (1) "the capital of the state containing Dallas is ___" -> Austin. But watch the middle: the model first forms an internal "Texas" concept, THEN the capital. A hidden hop, not a lookup. (2) The proof: researchers reach in and SWAP the "Texas" concept for "California" - nothing else touched - and the output follows to "Sacramento." (Also Georgia->Atlanta, Byzantium->Constantinople.) Change a concept, change the answer: the wiring is real and causal, not a story we project onto it. Same "clamp it and watch" move as Golden Gate, now on a CIRCUIT. Next: the circuit behind the Cursor bot. (Anthropic, Biology of an LLM, 2025.)

DELIVERY: State the hypothesis BEFORE the proof. We've shown concepts are real levers (Golden Gate) and that circuits do causal work (the Texas swap). Now the SPECIFIC claim for hallucination: a default "I can't tell" reflex, plus a "do I know this?" concept that can inhibit it - and a hallucination is that inhibition misfiring. Make it falsifiable: "if that's really the mechanism, we should be able to force the switch and manufacture a hallucination on command." THEN the test (next slide). This is the claim the Batkin experiment proves.

DELIVERY - RUNG 3, THE CLEAN CASE FIRST. We proved circuits are real (the Texas swap); now meet the ONE behind every "don't know" failure - the refusal circuit - in a controlled lab case where we can prove exactly how it works. Two switches: a default "can't answer" brake, and a "do I know this?" switch that can turn the brake off. Three clicks: (1) "What sport does Michael Batkin play?" - a person who doesn't exist. Left alone, the brake stays ON and the model correctly refuses. Good. (2) The intervention: clamp "do I know this?" ON and force the brake OFF. No facts added - just the brake released. (3) Out comes "Michael Batkin plays tennis." A confident fabrication, on command. Flip ONE switch -> a manufactured hallucination. Same "clamp and watch" move as Golden Gate and the Texas swap - so now we KNOW this circuit, cold. NEXT: "Hold that picture - now watch it happen in the wild, with no one touching the switch." (Anthropic, On the Biology of an LLM, 2025.)

DELIVERY - RUNG 3, NOW IN THE WILD. Same two switches you just saw forced by hand - but here NO ONE touches them; the switch flips on its own. Three clicks, all the Cursor bot: (1) Default: "why log me out on a 2nd device?" - the "can't answer" brake is ON: "I'm not sure, let me check." The "I can't tell" reflex, right in the weights. (2) A familiar request it really knows ("change the theme") - "do I know this?" fires and correctly switches the brake OFF -> it answers. Usually right. (3) The MISFIRE: a device-login policy that does NOT exist - the switch fires on the FAMILIAR WORDS, not knowledge, releases the brake anyway, and the bot invents "a core security feature." Exactly the Batkin experiment - except this time reality pulled the switch. "Context is the lever" holds: a familiar cue flips the gate; the catch is it keys on familiarity, not truth. THE TURN TO RUNG 4: "If reality can flip it on its own - can we at least CATCH it when it does?"

The TRACE-vs-Merge "bridge" slide was removed per review - a psycholinguistics detour that didn't earn its place for a builder audience. the_bridge_1/2/3.svg are retained on disk; restore from git history if presenting to a linguistics crowd.

DELIVERY - LENS (3): NOW CAN WE CATCH IT? THE TURN (say it explicitly): "Now that we understand the mechanism - it's sampling from odds with no 'I don't know' in them - can we turn that against it?" Yes, and it falls right out of the sampling: BECAUSE it samples, ask the same question several times and cluster the answers by meaning - agreement = it knows, scatter = it's confabulating. Semantic entropy (Farquhar et al., Nature 2024). RESOLVE THE CURSOR THREAD: "How would you have caught the Cursor bot? Ask it five times. A real policy -> five identical answers. An invented one -> five different confident policies. That scatter is the tell." (It catches the flat/uncertain case; the confident-peak fabrication is why the circuit work matters.) The fix is rebuilding the "I can't tell" we trained out - which is the checklist.

DELIVERY - the screenshot slide; the opening roadmap's promise ("a short checklist for your own AI") delivered. Build it ONE CARD at a time so each lands: (1) WHEN IT DOESN'T KNOW - ground answers in sources you can show; let it say "I don't know"; stress-test that it will. (2) WHEN IT WRITES - if a name goes on it, a human reads it, every time (lawyers, that means you). (3) WHEN IT ACTS - scope permissions, confirm destructive ops, keep prod off the playground. Land the bottom line: all three are one reflex - a place where the system stops and says "I can't tell." The three cards cover the failure modes from the tales: answering, writing, acting.

SUMMARY MAP - the whole journey in one frame, right before "thank you." "That was the tour: chatbots that answer wrong, agents that act wrong, WHY they do it - and the one fix, give it back its 'I can't tell.'" Then advance to thanks.

DELIVERY: Leave this up during Q&A. "Everything tonight - the slides, every source behind every story, the papers, and the tools you can open yourself - is one scan away." The QR points to the resources page (omerr.github.io/embarrassing-ai/resources.html). For Q&A: keep the three-card checklist slide handy as the fallback. Most audience questions will be about *their* AI product - the checklist turns the question into a diagnosis.