八月十一日

Anthropic’s engineering account of securing Claude across claude.ai, Claude Code, and Claude Cowork makes a blunt case: model behavior is probabilistic, so the dependable way to deploy increasingly capable agents is to put deterministic limits on what they can reach. The company says users approved roughly 93% of Claude Code permission prompts, a sign that human-in-the-loop supervision degrades under approval fatigue. Its response spans three architectures matched to different users: ephemeral gVisor containers for server-side code execution, an OS-level sandbox for developers that cut permission prompts by 84%, and a sealed local VM for knowledge workers who should not be expected to evaluate shell commands.

Anthropic 对 claude.ai、Claude Code 和 Claude Cowork 安全架构的复盘给出了一个直接结论：模型行为具有概率性，因此要安全部署能力越来越强的 agent，真正可靠的方法是用确定性的边界限制它能触达什么。公司数据显示，用户会批准大约 93% 的 Claude Code 权限提示，说明 human-in-the-loop 监督会在持续弹窗中逐渐失效。Anthropic 因此针对不同用户设计了三种架构：服务端代码执行使用临时 gVisor container，开发者使用 OS-level sandbox 并将权限提示减少 84%，而不应被要求判断 shell 命令的知识工作者则使用封闭的本地 VM。

The incidents are more useful than the architecture diagram. A malicious prompt delivered through an employee passed Claude’s intent-based defenses and exfiltrated credentials in 24 of 25 attempts; only filesystem and egress boundaries could have stopped it. In Cowork, an allowlisted Anthropic API domain became an exfiltration capability when an attacker’s API key let files be uploaded to another account, forcing Anthropic to add a proxy that verifies token provenance. The practical principle is that “the deterministic boundary is what gets hit when everything probabilistic misses.” Anthropic also warns that persistent memory, trust escalation between agents, and agent identity will become the next security frontier.

这些事故案例比架构图本身更有价值。一条由员工转交的恶意 prompt 绕过了 Claude 基于用户意图的防御，在 25 次尝试中有 24 次成功外泄凭证，只有 filesystem 和 egress 边界才能真正阻止它。在 Cowork 中，被加入 allowlist 的 Anthropic API 域名也变成了数据外泄能力：攻击者提供自己的 API key 后，就能把文件上传到另一个账户，迫使 Anthropic 增加验证 token 来源的代理。最实用的原则是：“the deterministic boundary is what gets hit when everything probabilistic misses.” Anthropic 还判断，持久化 memory、多 agent 之间的 trust escalation，以及 agent identity 将成为下一阶段的安全前沿。

Box CEO Aaron Levie argues that a US company releasing a frontier-class model as open weights changes which AI deployments are viable. Organizations can run models on-premises or in private cloud infrastructure, post-train them for regulated verticals such as legal and healthcare, preserve sovereignty if a commercial model disappears, and route tasks across open and closed model families. His strategic conclusion is that the harness layer becomes more valuable as model choice broadens: closed models still win on simplicity and capability for some hard problems, while open weights add control, specialization, and cost flexibility.

Box CEO Aaron Levie 认为，美国公司以 open weights 形式发布 frontier-class 模型，会直接改变哪些 AI 部署场景能够成立。企业可以在本地或私有云运行模型，为法律、医疗等受监管垂直领域进行 post-training，在商业模型被下架时保留自主权，并在开放与封闭模型家族之间进行任务路由。他的战略判断是，模型选择越丰富，harness layer 的价值就越高：封闭模型在易用性和部分高难任务能力上仍有优势，而 open weights 则提供控制力、专业化空间和成本弹性。

OpenAI’s Thibault Sottiaux says the company is broadening access to frontier cyber capabilities through new Daybreak Blue and Red access tiers and introducing GPT-5.6-Cyber, positioning partner-led vulnerability discovery, patching, and penetration testing as the practical entry point. Vercel CEO Guillermo Rauch describes the complementary operating change inside his own company: “deepsec” has become a verb and a standard security step in its software factory. Rauch also argues that agent isolation must cover both compute and network paths; Vercel uses microVMs for compute isolation and has made its egress firewall free so teams can constrain misbehaving agents’ network activity.

OpenAI 的 Thibault Sottiaux 表示，公司正通过新的 Daybreak Blue 和 Red 访问层扩大 frontier cyber 能力的使用范围，并推出 GPT-5.6-Cyber；对不知道如何开始的团队，最现实的入口是借助合作伙伴完成漏洞发现、快速修补和 penetration testing。Vercel CEO Guillermo Rauch 则描述了与之配套的工作方式变化：“deepsec” 已经在公司内部变成一个动词，并成为 software factory 的标准安全步骤。Rauch 还强调，agent 隔离必须同时覆盖 compute 和 network path；Vercel 用 microVM 隔离计算，并将 egress firewall 免费开放，让团队限制失控 agent 的网络行为。

Anthropic is making Claude Sonnet 5’s introductory pricing permanent at $2 per million input tokens and $10 per million output tokens, rather than ending it on August 31 as originally planned. The direct signal is predictable unit economics for teams already building on the model; the broader one is that frontier-model competition is increasingly expressed not only through benchmark gains but through durable price commitments that application developers can plan around.

Anthropic 将 Claude Sonnet 5 的首发价格永久固定为每百万 input tokens 2 美元、每百万 output tokens 10 美元，不再按原计划于 8 月 31 日结束。最直接的意义是，已经基于该模型开发的团队获得了可预测的单位经济性；更大的信号是，frontier model 的竞争正在从 benchmark 提升扩展到可供应用开发者长期规划的价格承诺。

Claude Code’s Thariq identifies two scarce skills in AI-assisted technical work: allocating compute toward problems that are actually worth solving, and acting as a thought partner capable of understanding whether a result is real. His comparison to game development is useful: lowering the barrier lets anyone make a basic game, but the larger payoff is helping expert designers compress a five-to-ten-year production cycle. The goal is not to become less technical; it is to keep deep expertise while moving faster on important problems.

Claude Code 的 Thariq 认为，AI 辅助的技术工作仍然稀缺两种能力：把 compute 分配给真正值得解决的问题，以及作为 thought partner 深入理解结果是否真实可靠。他用游戏开发作类比很贴切：降低门槛可以让任何人做出基础游戏，但更大的价值是让专家级设计师把五到十年的制作周期显著压缩。目标不是降低技术深度，而是在保留深厚专业能力的同时，更快推进重要问题。

Meta Senior Director of AI Madhu Guru frames the hard problem in consumer AI as inferring why someone acted, rather than merely recording what they did. Search and chat provide explicit signals, while watching, skipping, lingering, and revisiting provide implicit ones; interpreting either requires context about a person’s life, current events, and changing interests. Doing that reasoning in near real time for products serving a billion users is not just a modeling problem but a systems challenge at extraordinary scale.

Meta AI Senior Director Madhu Guru 把 consumer AI 的难题概括为：不能只记录用户做过什么，还要形成一套关于用户为什么这么做的解释。搜索和聊天提供显式信号，观看、跳过、停留和再次访问则提供隐式信号；理解这些行为，需要结合用户生活中的变化、外部世界正在发生的事，以及兴趣如何随时间演化。要为十亿用户规模的产品近实时完成这种推理，不只是模型问题，更是极端规模下的系统挑战。

FirstMark investor Matt Turck compresses four technology cycles into one recurring failure: data science models, dashboards, chatbots, and now agents can all appear to work while the underlying data remains the real problem. The joke lands because agent capability does not erase data quality, lineage, access, or semantics. As teams give agents more authority, weak underlying data stops being a reporting inconvenience and becomes a source of autonomous operational errors.

FirstMark 投资人 Matt Turck 用一个反复出现的问题串起了四个技术周期：data science 模型、dashboard、chatbot 和现在的 agent 都可能“运行良好”，但底层数据始终才是真正的问题。这个调侃之所以准确，是因为 agent 能力并不会消除数据质量、lineage、权限和语义问题。随着团队赋予 agent 更大执行权，糟糕的底层数据就不再只是报表不准，而会直接制造自主运行中的业务错误。

Swyx points to a mundane but increasingly expensive constraint in parallel agent development: worktrees can duplicate huge dependency directories, including a 20 GB pile of repeated node_modules in his example. He highlights an experimental AFS clone capability in PDB environments that is runtime- and language-agnostic, then pushes the idea further toward making every command agent-native. The important infrastructure question is how to give many agents cheap, isolated, copy-on-write workspaces without multiplying storage and setup costs.

Swyx 指出了并行 agent 开发中一个看似普通、但成本迅速上升的限制：worktree 会重复复制庞大的依赖目录，他的案例里仅重复的 node_modules 就占了 20 GB。他提到 PDB environment 中实验性的 AFS clone 能力，它不依赖特定 runtime 或语言，并进一步提出让每一条命令都变得 agent-native。真正重要的基础设施问题是，如何为大量 agent 提供低成本、隔离、copy-on-write 的工作空间，同时避免存储和环境初始化成本成倍增长。

The Takeaway: Netic founder and CEO Melisa Tokmak believes the defensible AI opportunity in essential services is not a generic chatbot or an AI-enabled roll-up, but an autonomous operating layer that understands customer needs, applies complex business rules, and dispatches real labor.

Tokmak draws on her experience building government and large-enterprise businesses at Scale AI, plus earlier work at Meta, to target HVAC, plumbing, electrical, automotive, hospitality, wellness, and pet-service companies. Netic sits between these businesses and their customers across phone, text, websites, and scheduling. It must determine urgency, serviceability, technician specialization, timing, and customer value before deploying the right worker. Tokmak says more than 70% of Netic customers are now “AI first,” meaning the customer’s first interaction is with a Netic agent.

Her contrarian point is that frontier labs are partners rather than the primary competitive threat. Real-world verticals require the model, orchestration and harnesses, and product software, plus last-mile knowledge of customers with different accents, contexts, and repeat-service needs. She rejects buying service companies as the core strategy because M&A is not her skill set and software built for acquired assets does not compound across the market. The product ambition is instead to let essential-service companies concentrate investment on skilled field labor while Netic runs the operational layer. Robotics may eventually join this chapter, but Tokmak sees it as distant in heterogeneous homes and buildings where dexterity, diagnosis, and human reassurance still matter.

核心结论： Netic 创始人兼 CEO Melisa Tokmak 认为，essential services 中真正有防御力的 AI 机会，不是通用 chatbot，也不是 AI 驱动的行业并购，而是一个能够理解客户需求、执行复杂业务规则并调度现实劳动力的自主运营层。

Tokmak 曾在 Scale AI 建立政府和大型企业业务，也有 Meta 工作经历。她现在瞄准 HVAC、水管、电气、汽车、酒店、运动健康和宠物服务等行业。Netic 位于这些企业与客户之间，覆盖电话、短信、网站和预约流程；系统必须先判断紧急程度、企业能否提供服务、技师专长、合适时间和客户价值，再派出正确的工作人员。Tokmak 表示，目前超过 70% 的 Netic 客户已经采用 “AI first” 模式，也就是客户第一次与企业互动时，面对的就是 Netic agent。

她更反直觉的观点是，frontier lab 是合作伙伴，而不是最主要的竞争威胁。真实世界的垂直行业同时需要模型、orchestration 和 harness，以及产品软件，还需要理解不同口音、情境和复购需求的最后一公里能力。她不把收购服务企业作为核心策略，因为 M&A 并非她的专长，而且为被收购资产开发的软件难以跨市场复利。Netic 的产品野心，是让 essential-service 企业把投资集中在熟练的一线劳动力上，而由 Netic 运行运营层。Robotics 最终也许会进入这个阶段，但 Tokmak 认为，在房屋与建筑高度异构、仍然依赖灵巧操作、现场诊断和人类安抚的行业里，这一天还很遥远。