125 Words, No Account Cues: AI Identifies Writer From Style

ByPriscilla Li
Journalist typing on a laptop in a dimly lit workspace

Anthropic’s Claude Opus 4.7 reportedly identified journalist Kelsey Piper from 125 words of unpublished text, and the details of her test are why this has landed so hard. In Piper’s account, the model named her not from account history or a saved chat, but from prose she says had never been published.

That makes the interesting claim bigger than “Claude guessed a journalist.” If AI identifies writer from text alone, anonymity stops being just a browser, account, or IP problem. It becomes a stylometric fingerprinting problem, a writing-style problem, where the signal is in the prose itself.

How Claude Opus 4.7 Identified Kelsey Piper

Piper’s report in The Argument is the core evidence here. She says Claude Opus 4.7 took a 125-word excerpt from an unpublished political column and answered that the likeliest author was Kelsey Piper.

She then tried to remove obvious alternative explanations. She says she ran the prompt in Incognito Mode, with memory disabled, then repeated it on a friend’s computer, and then through the API. Each step is aimed at stripping away a different clue: account context, browser state, local machine history, and some ordinary web tracking routes.

She also says she changed the genre. According to Piper, Claude still named her from unpublished writing outside her normal public beat, including a school progress report about her child and a movie review. That matters because topic is the laziest route to writer identification. If you write a lot about policy, a model can cheat by inferring the pool of likely authors from subject matter alone.

ChatGPT and Gemini reportedly did not match Claude on her test. Piper says ChatGPT guessed Matt Yglesias and Gemini guessed Scott Alexander on the initial sample. That is still anecdotal, but it’s a useful comparison: the same text, different models, different result.

Anthropic has not documented “identify the author of this text” as a product feature. Its release post for Opus 4.7 and model page position the model around coding, agentic work, document analysis, and complex tasks, not authorship attribution. So this is not a vendor-announced capability. It is an externally reported behavior from a single prominent self-test.

Why the Test Matters for Anonymous Writing

The stakes are not mainly “an AI can name a famous columnist.” The real problem is cross-account deanonymization.

A pseudonymous writer often tries to separate identities by separating accounts, devices, and contexts. That is classic privacy hygiene. But if AI identifies writer from the text itself, those controls stop being the whole game. A model does not need your login if your sentence rhythm, punctuation habits, favorite transitions, and word choices are enough.

That creates concrete risks for three groups in particular:

  • Journalists sharing notes, drafts, or source material with AI systems
  • Whistleblowers trying to communicate anonymously across platforms
  • Pseudonymous writers who keep public and private identities separate

The mechanism is simple. An adversary does not need one perfect “this is definitely Jane Doe” answer. They need a tool that can reliably say these two anonymous accounts are probably the same person. Linking identities is often enough.

That is why this story sits next to broader privacy questions around AI tools. If you are already thinking about whether your prompts stay private in products like Claude Enterprise privacy or whether extensions leak extra data as in ChatGPT extension privacy, this adds another layer: even a well-contained prompt may still reveal the author through style.

What Stylometric Fingerprinting Can and Cannot Do

Stylometric fingerprinting is the practice of identifying authors from patterns in how they write. This is older than LLMs. Forensic linguistics has used it for years.

The underlying signals are usually mundane and unconscious:
– sentence length and pacing
– punctuation habits
– transition words
– preferred phrasing
– syntactic patterns
– how often someone uses abstraction versus concrete nouns

A frontier model changes the interface, not the idea. Instead of training a narrow classifier on a fixed corpus, you can now ask a general model to reason over style directly, compare it against learned examples in its training data, and produce a ranked guess. That makes writer identification far more accessible.

But there are limits.

First, Piper’s result is still not independently replicated at scale. One strong anecdote is not a benchmark. The Washington Post’s Megan McArdle reported similar self-tests on her own unpublished writing, which suggests Piper may not be a one-off, but that is still anecdotal evidence rather than a controlled study.

Second, famous writers are easier targets. A journalist with a large public corpus gives the model more to compare against than an ordinary private person. Claude identifying Kelsey Piper does not automatically mean it can identify any random office worker from 125 words.

Third, author attribution can be directionally useful without being forensically reliable. A model that over-guesses a known writer, or narrows the field to a handful of likely candidates, can still be dangerous. Security tools do not need courtroom certainty to create real risk.

That uncertainty is exactly why this belongs with other LLM failure modes. Models can be weirdly strong at one task, brittle at another, and overconfident throughout. “It guessed a name” is not enough by itself. The interesting part is the test design and the pattern across repeated attempts.

The Real Risk: Linking Anonymous Accounts Across Text

The deanonymization problem is bigger than naming celebrities. It is about linkage.

Imagine two newsletter accounts, a private Discord identity, and an anonymized tip sent to a reporter. They use different emails, different browsers, maybe even different devices. If their prose carries the same statistical signature, a strong model can treat them as one trail.

That changes what “anonymous text privacy” means in practice. The vulnerable unit is no longer just the account. It is the style.

A useful way to think about it is voice recognition for writing. Not perfect. Not universal. But often good enough. A model might fail to say “this is definitely Kelsey Piper” and still succeed at “these four texts were probably written by the same person.” For whistleblowers, that can be enough to collapse the wall between safe and unsafe identities.

There is also an asymmetry here. Anthropic’s public materials describe Opus 4.7 as strong at document work and analysis. Piper’s result, plus the model comparison she reported, hints that Claude Opus 4.7 may currently be better at reading prose than rival models in this specific sense, spotting latent structure in writing style. That is not a formal benchmark result, but it fits the observed behavior better than the simpler alternatives she tried to eliminate.

The next obvious step is independent testing: blinded samples, larger author pools, repeated trials, and same-text comparisons across models. Until then, Piper’s experiment is best treated as a strong anecdotal demonstration of something people in stylometry have long argued: your writing voice is not just expressive. It is identifying.

Key Takeaways

  • Kelsey Piper reported that Claude Opus 4.7 named her from 125 words of unpublished text.
  • Her test tried to remove account, browser, device, and topic cues by using incognito mode, a friend’s computer, the API, and off-genre samples.
  • Anthropic does not document writer identification as a product feature; the evidence so far is external and anecdotal.
  • The main risk is not celebrity recognition but cross-account deanonymization for journalists, whistleblowers, and pseudonymous writers.
  • Stylometric fingerprinting is an established idea, but Claude’s apparent performance here still needs independent replication.

Further Reading

The open question is how many words, from how many people, a frontier model really needs before anonymous writing stops being meaningfully anonymous.