<- all tokdocs
2026.10.26@vulnerable_matt

The video says the leak followed Thariq Shihipar's goodbye post; the tweet IDs put the leak 4 hours 10 minutes before it

AI
Watch on TikTok

View on TikTok ->

A 79.475011 s vertical clip at 1080x1920, SDR, in an MP4 container (mov,mp4,m4a,3gp,3g2,mj2) carrying an HEVC video stream at 343,098 bps nominal, 30/1 declared frame rate with a 35745/1192 average (about 29.99 fps) across 2,383 frames, plus a stereo AAC stream at 44,100 Hz and 47,989 bps, for a total of 3,952,010 bytes at 397,811 bps overall; format id bytevc1_1080p_397806-1. Posted at epoch 1793042199, which is 2026-10-26T19:16:39 UTC, by vulnerable_matt, channel name "mattjay | Cybersecurity Guy", audio credited as "original sound" by the same account. The description is 44 characters and identical to the title: "Did you know about this OSINT attack method?" At capture time (metadata.json mtime 2026-10-26T18:09:51-0500, which is 23:09:51 UTC, roughly four hours after posting) the counters read 19,000 views, 680 likes, 17 comments, 39 reposts and 132 saves. I read 12 of the 40 extracted frames: 001, 004, 006, 008, 011, 013, 017, 021, 026, 031, 036 and 040, which at the fps=0.5 extraction rate sit at roughly 0 s, 6 s, 10 s, 14 s, 20 s, 24 s, 32 s, 40 s, 50 s, 60 s, 70 s and 78 s. The transcript holds 246 words across 15 segments. The whole clip is one screen recording of X with the speaker's face composited over it as a small rotating card. Frames 001 and 004 show an X profile page reading "Thariq", "@trq212", bio "playing WoW forever, formerly Claude Code @anthropicai", "SF via Toronto", "thariq.io", "Joined August 2011", "1.9K Following", "393.4K Followers", and a pinned post whose counters read 332 replies, 1K reposts, 9K likes and 2.3M views. Frames 006 and 008 scroll to the full farewell post, verbatim: "I've left Anthropic after more than a year of working on Claude Code and seeing it scale larger than I ever imagined. / I have really loved working at Ant and believe deeply in the mission, and most of all, the idea of a race to the top. / The idea that if we work hard and responsibly, we can raise the bar and inspire others to great outcomes. And if we all push each other to be better, things can be radically good. I will carry the spirit of this with me forever. / My colleagues at Anthropic are the most talented, thoughtful, competent, and earnest people I have ever met. I am [glad th]ey are at the wheel and trust them deeply. / To the community, thank you for everything. You've made [this the mos]t fun (and sometimes stressful) job [I have ever] had. / For me, it is time for a bit of a break before diving into something new. / If you want more excellent Claude Code content, you should follow @addyosmani , @lydiahallie, @_catwu, @ClaudeDevs and of course @bcherny who started it all." Its counters read 2.1K replies, 1.9K reposts, 31K likes, 5.4M views. Frames 011, 013, 031, 036 and 040 show the reply directly beneath it, verbatim: "also can someone at gmail make it so you can't scan for deactivated email addresses 🥺? I was hoping for a relaxing Friday night", at 50 replies, 46 reposts, 3.4K likes and 692K views, followed by two older posts dated 10/19/26 ("I think most people multi-tasking with agents could benefit from slowing down / most of the stuff you're doing wont really matter- what's your P0? what would it look like if you gave it your full attention?", 573 replies, 596 reposts, 7.2K likes, 555K views) and 10/18/26 ("I've realized I often would prefer to vibe code little parts of games than actually play games these days. / Especially cerebral ones that require some thinking like League. / I'm not quite sure what this really means for games but I think it's important?", 301 replies, 73 reposts, 2.1K likes, 233K views). Frames 017, 021 and 026 cut to a stacked screenshot card whose top tile reads "Arfur Grok", "@ArfurGrok · Follow", "👀 Thariq Shihipar (@trq212) has left Anthropic.", dated "1:54 AM · Oct 24, 2026", with 1.7K likes and a "Read 261 replies" button, and whose lower tile is the farewell post with the gmail reply timestamped "6:06 AM" at 2.6K likes. Spoken, the argument is that a tracker account inferred a departure by watching for a corporate email address to be deactivated, that this ruined the engineer's Friday night, and that the same trick scales to inferences that "might move stock markets". No terminal, scanner, script, API response or any demonstration of the technique appears in any frame I read; the video asserts the mechanism and never shows it. Transcript check: the last segment ends at 79.24 s against an audio stream duration of 79.475011 s, so every segment closes inside the audio and nothing is hallucinated past the end.

The subject is Thariq Shihipar, and Whisper dropped the "h"

The transcript opens at 0.12 s with "This is Tariq." Every on-screen instance spells it differently. The profile card in frames 001 and 004 reads "Thariq" with the handle "@trq212", and the screenshot card in frames 017, 021 and 026 gives the full name as "Thariq Shihipar". His own site uses the same spelling and currently still reads "Currently working on Claude Code at Anthropic", describing him as an "Engineer & serial entrepreneur" who ran One More Multiverse, "A YC backed gaming company that I ran for 5 years. We scaled to over a million users, went viral on tiktok." That site had not been updated at the time I fetched it, two days after he announced the departure, which is its own small demonstration of the video's point: the inference beat his own homepage.

This is the Whisper failure mode the TokDoc spec warns about. "Tariq" is a real name, so nothing about the transcript looks broken, and a doc written from the audio alone would have carried the wrong spelling into the headline. The burned-in text is the authority here, and it agrees with the primary source.

Reversed chronology: the leak came first by 4 hours 10 minutes

At 15.28 s the video says "he's a high-profile enough employee that has to write one of these long announcements that he's leaving. And right under that announcement, he's basically begging someone at Gmail." Then at 32.10 s it introduces the leak as a follow-on: "But yeah, here's this faceless Twitter account that was like, he's left anthropic." That ordering is backwards, and the correct order is the entire reason the story is interesting.

X status IDs are Snowflake IDs and carry their own creation time: shifting the ID right by 22 bits and adding the Twitter epoch of 1288834974657 ms recovers the UTC timestamp. The @ArfurGrok post announcing the departure is status 2113781170253308276, which decodes to 2026-10-23T23:54:37.800Z. The independent report of the farewell post puts it at 04:04:29 UTC on Saturday, October 24, 2026. The leak therefore preceded the subject's own announcement by 4 hours 9 minutes and 51 seconds.

The card in the video is not lying, it is just rendered in the screenshotter's locale. It shows the @ArfurGrok post at "1:54 AM · Oct 24, 2026" and the gmail reply at "6:06 AM", which is UTC+2 throughout. Converted to Thariq's own listed location of SF, 23:54:37 UTC on October 23 is 4:54 PM Pacific on a Friday afternoon, and the 04:04 UTC announcement is 9:04 PM Pacific the same Friday evening. "I was hoping for a relaxing Friday night" is literal, not figurative.

The same decoding exposes a second detail the video never mentions. @ArfurGrok's post about a second Claude Code engineer, "👀 Anthony Morris (@amorriscode) has left Anthropic", is status 2113792338195542039, which decodes to 2026-10-24T00:39:00.445Z. That is 44 minutes and 23 seconds after the Thariq post, matching contemporaneous reporting that the two exits surfaced "about 45 minutes apart". Two accounts flipped inside one sweep. That is the signature of an automated scan on a list, not of a tipster.

The quoted tweet is paraphrased, and the paraphrase adds words that are not there

At 25.98 s the video reads the reply aloud as "I was hoping to have a quiet Friday night after quitting my job." The actual text, legible in frames 011, 013, 031, 036 and 040 and confirmed by first-party reporting, is "also can someone at gmail make it so you can't scan for deactivated email addresses 🥺? I was hoping for a relaxing Friday night."

Three differences. "Relaxing" became "quiet". The clause "after quitting my job" is not in the tweet at all. And the delivery drops the sad-face emoji that sets the register of the original. None of this changes the substance, but the video presents the line with the cadence of a quotation while the screenshot of the real text is on screen behind the speaker's head.

The farewell post itself gets a similar treatment. At 5.76 s the video says Thariq "just retired to go play WoW forever." The bio in frames 001 and 004 does read "playing WoW forever, formerly Claude Code @anthropicai", but the announcement in frames 006 and 008 says something narrower: "For me, it is time for a bit of a break before diving into something new." He announced a break and an unnamed next thing. The retirement is the bio joke, repeated by the video as a fact, and the video itself concedes the joke framing seconds later with the line about "pure jealousy that he gets to quit and play WoW."

"Gmail deactivates the email address" is Thariq's own word, and nobody has published the actual scan

At 48.80 s the video describes the mechanism: "that their email addresses are just known, that when Gmail deactivates the email address, this person realized that that happened. And what's the conclusion? That person left."

The shape of the claim is sound and uncontested. A corporate mail account is switched off at offboarding, so an automated check that can distinguish a live address from a dead one turns any list of known corporate addresses into a departure feed. First-party coverage of this incident puts it the same way: a deactivated address is the classic sign that someone has left, and if a check can tell deactivated from active, the list becomes a register of departures before the person has chosen how and when to talk about it.

Two caveats the video does not raise. First, "Gmail" is the word Thariq used in a 1 a.m. complaint, and the video inherits it. Anthropic staff addresses sit on a managed Google Workspace domain, which is a different product surface from consumer Gmail, and the reporting I could reach states plainly that "the flaw cannot be pinned on Gmail rather than another mail platform." Second, and more important: no one has published how the account actually gets the signal. The same reporting says directly that "nobody has published how the account actually got the information." The video presents a specific mechanism as established. It is a plausible and widely repeated inference, not a documented one. Treat the detection as confirmed by its results and the method as unverified.

The "faceless Twitter account" description at 32.10 s is also only half right. @ArfurGrok is pseudonymous, but it is not an anonymous throwaway. It carries a verification badge in the video's own screenshot, has a standing format for these posts, and has run the same line against other Anthropic staff over a long period, including "👀 Nelson Elhage has left Anthropic." (status 2058375590605172850) and "👀 Cami Clark has left Anthropic." (status 2105681065453236440). This is a running tracker with a backlog, not a one-off observation.

The "move stock markets" line was two days early, and Anthropic filed its S-1 the day this video posted

At 68.82 s the video reaches for the general case: monitoring deactivated email addresses "might glean information that might move stock markets, stuff like that."

As applied to this specific incident the claim does not hold, because Anthropic was private when the departures happened on October 23 and 24, 2026. There was no listed security to move. But the timing is better than the video knew. Anthropic filed its S-1 registration statement with the SEC on Monday, October 26, 2026, the same calendar day this TikTok was posted at 19:16:39 UTC, seeking a Nasdaq listing under the ticker "ANT" with a mid-November debut expected. The filing disclosed a net loss of $80.7 billion for the first six months of 2026 against a $42 billion net loss for full-year 2025, and revenue growth of "1,368% year over year for the three months ended June 30, 2026."

So the hypothetical becomes concrete within weeks of the video. Once ANT trades, a feed that reliably detects senior departures from an infrastructure signal, hours before the company or the employee says anything, is a material-information channel pointed at a public issuer. That is the version of the argument the video gestures at without the supporting facts, and it is stronger than the version it made.

Key Takeaways

  • Correction: The transcript at 0.12 s says "Tariq". The subject is Thariq Shihipar, handle @trq212, spelled that way on his X profile in frames 001 and 004, in the screenshot card in frames 017, 021 and 026, and on his own site thariq.io.
  • Correction: At 32.10 s the video presents the @ArfurGrok leak as following the farewell post. The Snowflake ID of that post, 2113781170253308276, decodes to 2026-10-23T23:54:37.800Z, and the farewell post is reported at 04:04:29 UTC on 2026-10-24. The leak led by 4 hours 9 minutes and 51 seconds.
  • Correction: At 25.98 s the video quotes "I was hoping to have a quiet Friday night after quitting my job." The tweet reads "also can someone at gmail make it so you can't scan for deactivated email addresses 🥺? I was hoping for a relaxing Friday night." The words "after quitting my job" do not appear in it.
  • Partial correction: At 5.76 s the video says Thariq "just retired to go play WoW forever." The bio does say "playing WoW forever", but the announcement in frames 006 and 008 says "For me, it is time for a bit of a break before diving into something new." A break and an unnamed next role, not a retirement.
  • Partial correction: At 32.10 s the video calls @ArfurGrok "this faceless Twitter account." It is pseudonymous, but it shows a verification badge in the video's own screenshot and has a standing run of identical posts about Anthropic staff, including Nelson Elhage (status 2058375590605172850) and Cami Clark (status 2105681065453236440).
  • Unverified: The mechanism described at 48.80 s. First-party coverage states that "nobody has published how the account actually got the information" and that "the flaw cannot be pinned on Gmail rather than another mail platform." Anthropic staff mail runs on managed Google Workspace, which is a different surface from consumer Gmail.
  • Verified: The farewell post text quoted in frames 006 and 008 matches the text reported by third parties, including the line "I've left Anthropic after more than a year of working on Claude Code and seeing it scale larger than I ever imagined."
  • Context: A second Claude Code engineer was flagged by the same account 44 minutes and 23 seconds later. "👀 Anthony Morris (@amorriscode) has left Anthropic." is status 2113792338195542039, decoding to 2026-10-24T00:39:00.445Z. Two hits inside one sweep points at an automated list check rather than a tip.
  • Context: The "move stock markets" line at 68.82 s did not apply at the time, because Anthropic was private. Anthropic filed its S-1 with the SEC on 2026-10-26, the same day this video was posted, targeting Nasdaq under "ANT" with a mid-November debut.
  • Clarification: The "1:54 AM · Oct 24, 2026" and "6:06 AM" timestamps in frames 017, 021 and 026 are rendered in the screenshotter's locale, which resolves to UTC+2 against the decoded IDs. In Pacific time the leak lands at 4:54 PM Friday and the announcement at 9:04 PM Friday, which is why "relaxing Friday night" is literal.
  • Clarification: No terminal, scanner output, HTTP response or live demonstration appears in any of the 12 frames I read. The video describes the attack and never runs it.
  • Context: thariq.io still read "Currently working on Claude Code at Anthropic" when I fetched it on 2026-10-26, two days after the announcement. The inference beat the subject's own website by more than two days.

Resources

I could not reach x.com directly. Every fetch of https://x.com/... returned HTTP 402, so no post text, timestamp or counter in this document is cited to x.com. The X timestamps I state are either read off the burned-in frames, decoded from Snowflake IDs that appear in the status URLs themselves, or taken from the third-party pages listed above. One further source, FourWeekMBA's "Claude Code's Thariq Leaves Anthropic Weeks Before Its IPO", returned HTTP 403 and is not cited.

Published October 26, 2026. Writeup generated from a favorited TikTok.