On April 21, 2026, journalist Kelsey Piper pasted 125 words of an unpublished column into Claude Opus 4.7 and got her own name back. The launch announcement on April 16 led with "long-running tasks", "rigor", and "instruction following". Stylometric authorship inference was not on the changelog. Capabilities ship first. Documentation follows when the screenshots get loud enough.
Piper's draft compared the Ukrainian sitcom Servant of the People to The West Wing. She ran the prompt in Claude.ai Incognito with no memory and no custom instructions. She ran it again through the Claude API. Finally, she ran it on a friend's laptop. Same answer every time: "Kelsey Piper".
For comparison, ChatGPT guessed Matthew Yglesias and Gemini guessed Scott Alexander. Both models were wrong, but in the right ideological zip code, meaning the other models knew the shape of the writer. Only Opus 4.7 returned the exact name. The previous Anthropic flagship, Opus 4.6, had named Elizabeth Sandifer on a separate prompt using one of Piper's unpublished movie reviews. The transition from 4.6 to 4.7 flipped the answer.
The replications matter more than the original story. Patrick Stevens describes himself as a minor internet personality. He posted 280 words describing a Brazilian jiu-jitsu move he had written that morning, which was never published. Stevens believes he has never written about this topic within the model's training window. Opus 4.7 named him on the first try.
He saw a 90% success rate one day. It fell to roughly 15% the next day under the exact same conditions. On any other product, that swing is a flaky test. Here, it counts as a normal day at the office.
Jeff Kaufman ran a similar test on three short, unpublished paragraphs. These included an anti-dairy story, a family schedule, and an email about dance hall ventilation. Opus 4.7, ChatGPT Thinking 5.4, and Gemini 3.1 Pro all named him correctly. However, the same three models failed on four of his 2003 college application drafts. Twenty years of internet writing converge on a recognizable voice, while a 17-year-old applying to college does not yet have one.
The counterpoint that has stuck is the base-rate problem. LessWrong commenter Ninety-Three captured this perfectly. They noted that a thousand people try this test every week. Claude succeeds on ten of them, and those ten proclaim the death of anonymity while the rest shrug and report nothing. The comment thread bears this out.
For example, Yair Halberstadt could not be identified. He even provided a full unpublished draft and an explicit hint about his background. Opus 4.6 missed where 4.7 now hits. The capability remains unstable across runs, days, and testers. It is unstable enough to dodge the 'reliable' label, yet stable enough to land on the day it counts.
Drew Margolin made a sharper point in the Argument comments about the model's mechanics. He noted the model does not retain any memory of its internal state while acting. Instead, it analyzes input and output to create a plausible post-hoc explanation. When Piper asked Claude how it knew her, the model invented a story claiming effective altruists liked the movie she reviewed.
Piper confirmed this explanation was fabricated. We get a name plus a confabulated alibi for that name, both generated by the same model. The audit trail is pure fanfiction.
For developers, the canonical case generalizes badly. Prose is merely one fingerprint. Commit message cadence, naming conventions, and README structure provide massive signals. Comment style, error-handling preferences, and git log rhythm add to this data. Anyone shipping a public GitHub history under their real name now exposes a massive stylometric corpus vastly larger than 125 words.
This changes the calculus for developers operating under aliases. Moonlighters running side projects and security researchers reporting vulnerabilities face new risks. Contractors pushing under a startup's bot account are equally exposed, and the same goes for anyone using an alt account for a hot take. The threshold for an AI model to connect these handles fell this month. It happened quietly, with no flag in any release notes.
I publish this newsletter under my own byline. This means I have produced a stylometric corpus several orders of magnitude longer than 125 words. The math, applied to my own situation, is not flattering. I have no interest in running it twice.
Anthropic also rolled out government-ID and selfie verification for some features the same week as the Opus 4.7 launch. This was pitched as a privacy-first move. Yet, the same flagship model can now name an unknown author from a single paragraph. There is no opt-out toggle and no security advisory. There is zero mention of this on their transparency hub.
As with the system-prompt diff that surfaced last week, the capability arrived ahead of the documentation. The technically interesting question is whether Opus 4.7 is performing real stylometry or prompt-history-weighted confabulation. The answer decides what mitigation developers must reach for. Real stylometry survives a laundering pass by another language model poorly. Confabulation survives it quite well.
Only Anthropic can run the experiment needed to distinguish the two. They would need to sanitize all references to the test text from training, while leaving in documents by potential authors. They have not announced any plan to do this. There is zero commercial incentive to run an experiment that might produce an awkward answer.