八月十日

Boris Cherny says prompt injection has shifted from a theoretical concern into a practical engineering target, and he argues Anthropic has now made that target meaningfully harder to hit in real-world agent use. His claim is consequential because it addresses one of the biggest reasons security-conscious teams have hesitated to trust autonomous browser and tool use. The broader signal is that agent safety may start moving from policy promises into benchmarked, model-level robustness.

Boris Cherny 表示，prompt injection 已经从理论风险变成了明确的工程目标，而 Anthropic 现在已经在真实 agent 场景里显著提高了这类攻击的难度。这一点之所以重要，是因为它正面回应了安全敏感团队迟迟不愿信任自主浏览器和 tool use 的核心顾虑之一。更大的信号是，agent 安全可能开始从政策承诺走向可基准测试、可在模型层面体现的鲁棒性。

Aaron Levie argues agent adoption will spread unevenly because coding maps naturally onto long, uninterrupted digital work while most enterprise functions still depend on human feedback loops. His main point is that the opportunity is not to wait for employees to prompt better, but to reengineer workflows so agents can run continuously in the background across contracts, customer records, and research processes. That is a more demanding thesis than “AI assistants for everyone,” but it is probably closer to how durable enterprise value gets built.

Aaron Levie 认为，agent 的扩散速度会非常不均衡，因为 coding 天然适合长时间、连续的纯数字工作，而大多数企业职能仍然依赖人与客户、病人或同事之间的反馈回路。他的核心观点是，真正的机会不是等待员工学会更好地 prompt，而是重构 workflow，让 agent 能在合同、客户记录和研究流程中持续在后台运行。这比“给每个人一个 AI 助手”更苛刻，但也更接近企业真正形成长期价值的方式。

Amjad Masad proposes HelpPeer as a public commons for agents: one API to publish what an agent learned, another to look up whether someone else already solved the same problem. The idea matters because shared machine memory could reduce duplicated effort in security response, debugging, and tool use, especially when thousands of agents are independently discovering the same failure. If it works, the competitive layer shifts from raw model calls toward verification, trust, and reusable agent-to-agent knowledge.

Amjad Masad 提出 HelpPeer，想把它做成 agent 的公共知识网络：一个 API 用来发布 agent 学到的内容，另一个 API 用来查询是否已经有别的 agent 解决过同样的问题。这个想法之所以值得注意，是因为共享的机器记忆有望减少安全响应、debugging 和 tool use 中的大量重复劳动，尤其是在成千上万个 agent 独立撞上同一类故障时。如果它成立，竞争层就会从单纯的模型调用，转向验证、信任和可复用的 agent-to-agent 知识。

Guillermo Rauch makes the opposite argument to full-autonomy marketing: if you are shipping real software with users and revenue, someone still needs to read the code, either directly or through deliberate agentic review. His example of a model adding a pointless 700-millisecond delay is a useful reminder that current systems still make rookie architectural mistakes even when they are otherwise strong. The long-term bet is still more autonomy, but the near-term operating model remains human-reviewed software production.

Guillermo Rauch 提出了与“完全自治”叙事相反的判断：如果你在交付有真实用户和收入的软件，就仍然必须有人读代码，无论是亲自阅读，还是通过有意识的 agentic review 来完成。他举的例子是，模型竟然加入了一个毫无意义的 700 毫秒延迟，这很好地提醒了大家，即使当前系统已经很强，它们仍会犯很初级的架构错误。长期方向也许仍然是更高自治，但短期内真正可行的操作模式依旧是有人类审核的软件生产。

Peter Yang highlights a small but important product pattern from Linear: when an agent cannot complete a task because it lacks the right tool, that failure becomes a feature request for the product team. He also notes that desktop-agent onboarding is still confusing for mainstream users. Taken together, the message is that better agents will come not just from smarter models, but from tighter feedback loops between user failure, missing capability, and product iteration.

Peter Yang 提炼了 Linear 的一个很小但很重要的产品模式：当 agent 因为缺少正确工具而无法完成任务时，这次失败会直接变成产品团队的一条 feature request。他同时指出，面向普通用户的 desktop agent onboarding 仍然很让人困惑。把这两点放在一起看，结论是更好的 agent 不只来自更强的模型，也来自“用户失败 - 能力缺口 - 产品迭代”之间更紧密的反馈回路。

Swyx offers a practical warning about agent environments getting overloaded with accumulated skills. His advice to delete skills that no longer earn their place is really advice about reducing hidden interactions, context bloat, and hard-to-debug behavior in agent traces. That sounds operationally mundane, but it points at an emerging discipline: curating the tool surface may matter as much as improving the model.

Swyx 给出了一条很实用的提醒：agent 环境很容易被不断堆积的 skills 压垮。他建议删掉那些已经不再值得保留的 skills，本质上是在强调减少隐藏交互、context 膨胀，以及 trace 中难以定位的问题。这听起来像是很日常的运维经验，但它其实指向一种正在形成的工程纪律：管理好 tool surface，可能和提升模型本身一样重要。

Claude Code now supports artifacts. Anthropic is turning long-running Claude Code sessions into live, shareable pages for work that usually gets trapped in a terminal or a chat log: PR walkthroughs, incident timelines, dashboards, release checklists, architecture maps, and review surfaces. The practical appeal is not just presentation. Artifacts are built from full session context, can republish to the same link as the work evolves, and stay private to the organization with admin controls, retention policies, and compliance API visibility. The sharpest line in the launch is that “Every publish is a new version at the same link,” which makes the feature feel less like a screenshot and more like a living status surface for collaborative engineering work.

Claude Code 现已支持 artifacts。 Anthropic 正把长时间运行的 Claude Code session 变成可分享的实时页面，用来承载原本会困在终端或聊天记录里的工作成果，比如 PR walkthrough、故障时间线、dashboard、发布清单、架构地图和评审界面。这个能力的价值不只是更好展示结果。Artifacts 基于完整 session context 构建，工作推进时可以持续发布到同一个链接，并且默认仅在组织内可见，配有管理员控制、保留策略和 compliance API 可见性。这次发布里最关键的一句话是 “Every publish is a new version at the same link,” 这让它更像一个持续更新的协作状态界面，而不是一张静态截图。

The Takeaway: Igor Babushkin thinks the long-term answer to AI concentration is not just better frontier labs, but more personalized, more locally controlled AI systems that ordinary users and companies can actually shape for themselves.

Babushkin matters here because he has already worked through several generations of the stack at DeepMind, OpenAI, and xAI, and now wants to attack the next bottleneck from outside the frontier-lab playbook. His argument is that coding agents proved something bigger than coding: once models became undeniably useful, it became hard to imagine any part of computing staying untouched. The next frontier, in his framing, is splitting into at least three tracks: verifiable domains like code and math, scientific discovery that needs tighter loops with real-world experiments, and everyday personal AI that optimizes for helping users “live better lives” rather than proving the hardest theorem.

That is why River AI is making three bets at once: a reinforcement-learning and fine-tuning platform for companies, deeper personalization so models stop behaving like averages across all users, and hardware research aimed at bringing strong models closer to local devices. Babushkin says today “the only way to get access to the most powerful agents is through access to a data center,” and he wants to break that dependency over time. He also makes a safety argument for open models near the danger threshold: if more people can study and align capable but not fully catastrophic systems, the ecosystem gets more chances to learn before the highest-stakes models arrive.

核心结论： Igor Babushkin 认为，长期来看，对抗 AI 权力集中的答案不只是打造更强的 frontier lab，而是让 AI 变得更个性化、更接近本地控制，让普通用户和公司真正能够按自己的需求去塑造它。

Babushkin 之所以值得关注，是因为他已经在 DeepMind、OpenAI 和 xAI 这几代技术栈中都处在核心位置，而现在他想在 frontier-lab 叙事之外，重新定义下一个瓶颈。他的判断是，coding agents 证明的不只是 coding 本身。一旦模型强到让人无法忽视，就很难想象计算世界还有哪一部分能保持不变。在他的框架里，下一个前沿至少分成三条线：像代码和数学这样可验证的领域，需要和真实实验形成更紧闭环的科学发现，以及优化目标不再是“证明最难定理”，而是帮助用户“过得更好”的日常 personal AI。

这也是为什么 River AI 同时押注三个方向：面向公司的 reinforcement learning 和 fine-tuning 平台、更深层的 personalization，让模型不再像面向所有用户平均化训练出来的系统，以及把强模型推近本地设备的硬件研究。Babushkin 说，今天“the only way to get access to the most powerful agents is through access to a data center”，而他想在长期内打破这种依赖。他还为接近危险阈值的 open models 提出了一种 safety 逻辑：如果更多人能够研究并对齐那些能力很强但尚未灾难性的系统，整个生态就能在最高风险模型到来之前，获得更多学习机会。