八月二十八日

OpenAI CEO Sam Altman called this a critically important moment for AI-enabled cyber defense and argued that only an urgent, collective response across competitors and partners will work. Anthropic's containment report supplies the engineering case behind that warning: model safeguards reduce the probability of failure, but agents' growing access keeps increasing the damage a failure could cause. Claude Code users approved roughly 93% of permission prompts, prompting Anthropic to add an OS-level sandbox that reduced those prompts by 84%. In a controlled phishing exercise, a malicious prompt pasted by an employee exfiltrated AWS credentials in 24 of 25 attempts, demonstrating why model-layer intent checks cannot replace hard filesystem and network boundaries.

OpenAI CEO Sam Altman 将当前称为 AI-enabled cyber defense 的关键时刻，并认为只有 competitors 与 partners 共同采取紧迫而集中的行动才可能奏效。Anthropic 的 containment report 给出了这一警告背后的工程逻辑：model safeguards 可以降低失败概率，但 agent 获得的 access 越来越多，单次失败可能造成的 damage 仍在扩大。Claude Code 用户大约批准了 93% 的 permission prompts，因此 Anthropic 加入 OS-level sandbox，将 prompts 数量减少了 84%。在一次受控 phishing exercise 中，员工粘贴的一段恶意 prompt 在 25 次尝试中有 24 次成功外泄 AWS credentials，说明 model layer 对 intent 的判断无法替代 filesystem 与 network 的硬边界。

Anthropic is offering 10,000 researchers across fields including mathematics, chemistry, and physics access to a new Claude Team plan for scientists. Standard seats are free for one year, while premium seats with five times the usage are $15 per month, an 80% discount. Principal investigators or equivalent leaders at academic and nonprofit research institutions can enroll their groups, and Anthropic plans to expand beyond the initial allocation. The program extends Claude Science and Anthropic's existing AI for Science credits as the company points to model progress in areas from advanced physics calculations to protein design.

Anthropic 将通过新的 Claude Team plan for scientists，为来自数学、化学、物理等领域的 10,000 名 researchers 提供 Claude。Standard seats 在一年内免费，拥有五倍 usage 的 premium seats 每月 15 美元，相当于 80% 的折扣。Academic 与 nonprofit research institutions 的 principal investigators 或同等负责人可以为团队申请，Anthropic 也计划在首批名额之后继续扩大规模。该项目延续 Claude Science 与现有 AI for Science credits；Anthropic 同时指出，Claude 在 advanced physics calculations、protein design 等科学任务上正持续进步。

OpenAI's Thibault Sottiaux said ChatGPT can now handle tasks such as grocery shopping, booking an Uber, and arranging a haircut without seeing the user's actual credentials. The important product shift is not merely that an assistant can navigate a workflow, but that it can complete transactions while the authentication boundary remains separate from the model. That combination of delegated action and scoped credential handling is becoming a baseline requirement for consumer agents that operate across services.

OpenAI 的 Thibault Sottiaux 表示，ChatGPT 现在可以完成 grocery shopping、预订 Uber、安排 haircut 等任务，而且无需看到用户的真实 credentials。这里真正重要的产品变化，不只是 assistant 能够浏览一个 workflow，而是它能在 authentication boundary 与 model 分离的前提下完成 transaction。对于需要跨服务工作的 consumer agents 来说，delegated action 与 scoped credential handling 的结合正在成为基础要求。

Anthropic separates agent risk into user misuse, model misbehavior, and external attack, then applies overlapping defenses to the model, its environment, and the external content it reads. Its products use different isolation patterns: ephemeral gVisor containers for claude.ai code execution, Seatbelt or bubblewrap sandboxes for Claude Code, and a sealed local VM for Claude Cowork. The report's most useful lesson is that an allowlisted destination is really a capability grant: Cowork once allowed data exfiltration through the approved `api.anthropic.com` domain using an attacker's API key, even though the sandbox behaved as designed. Anthropic fixed the path with a proxy that accepts only the VM's provisioned session token, reinforcing its conclusion that deterministic containment must catch what probabilistic defenses miss.

Anthropic 将 agent risk 分为 user misuse、model misbehavior 与 external attack，并在 model、运行 environment 以及 agent 读取的 external content 三个层面部署重叠防线。不同产品采用不同 isolation patterns：claude.ai code execution 使用 ephemeral gVisor containers，Claude Code 使用 Seatbelt 或 bubblewrap sandboxes，Claude Cowork 则使用 sealed local VM。这份报告最值得借鉴的一点是，allowlisted destination 本质上是一项 capability grant：Cowork 曾经允许攻击者利用自己的 API key，经获准访问的 `api.anthropic.com` domain 外泄数据，尽管 sandbox 本身完全按设计运行。Anthropic 随后加入只接受 VM provisioned session token 的 proxy，进一步证明 deterministic containment 必须兜住 probabilistic defenses 漏掉的情况。

Claude Code can now turn a live session into a shareable visual artifact such as a pull-request walkthrough, system map, dashboard, or release checklist. The page draws on the session's codebase, connectors, and conversation, refreshes at the same URL whenever Claude republishes it, and retains version history. Artifacts are private to their author by default, can be shared only with authenticated organization members, and give administrators retention controls, role-based access, and compliance API visibility. The beta is available to Claude Team and Enterprise organizations through the CLI and desktop app, with the resulting pages viewable in a browser.

Claude Code 现在可以把进行中的 session 转化为可分享的 visual artifact，例如 pull-request walkthrough、system map、dashboard 或 release checklist。页面会使用 session 中的 codebase、connectors 与 conversation；Claude 每次重新发布后，同一个 URL 会自动刷新，并保留 version history。Artifacts 默认仅 author 可见，只能分享给已认证的 organization members，同时为 administrators 提供 retention controls、role-based access 与 compliance API visibility。该功能已面向 Claude Team 与 Enterprise organizations 开放 beta，可从 CLI 和 desktop app 创建，并在 browser 中查看页面。

Meta AI leader Madhu Guru argued that enterprises should make their AI stacks model-agnostic by building eval suites around real use cases and business outcomes now, then developing the ability to post-train open models within the next year. That creates leverage to switch and customize models against an organization's own quality, cost, and latency targets. Box CEO Aaron Levie supplied the complementary systems view: software preserves data governance, workflow logic, access control, and repeatability, while agents execute inside those boundaries at much greater scale. Together, the two positions make the operating model explicit: own the measurement and adaptation layer, but keep agent action inside deterministic systems of record.

Meta AI leader Madhu Guru 认为，企业应当让 AI stack 保持 model-agnostic：现在就围绕真实 use cases 与 business outcomes 建立 eval suites，并在未来一年内形成 post-train open models 的能力。这样企业才能依据自身的 quality、cost 与 latency 目标切换和定制 models。Box CEO Aaron Levie 则补上 systems 层面的判断：software 负责维持 data governance、workflow logic、access control 与 repeatability，agents 则在这些边界内以远超人的规模执行任务。两者合在一起，给出了一套清晰的 operating model：掌握 measurement 与 adaptation layer，同时把 agent action 留在 deterministic systems of record 之内。

Peter Yang said he receives three to five requests each day to test new AI products, yet usually avoids tools that require another account and a separate site because ChatGPT, Grok, and similar harnesses already hold the context needed to work across his computer and browser. His prediction is that products increasingly need to run inside the leading AI harnesses rather than ask users to rebuild context in a narrow standalone application. The implication for builders is direct: integration with an existing agent environment may matter as much as a product's own interface.

Peter Yang 表示，他每天会收到三到五个试用新 AI products 的请求，但通常不会选择那些要求再注册一个 account、再打开一个独立 site 的工具，因为 ChatGPT、Grok 等 harnesses 已经拥有在 computer 与 browser 中工作所需的 context。他判断，越来越多产品需要运行在主流 AI harnesses 内，而不是要求用户在一个狭窄的 standalone application 里重新建立 context。对 builders 而言，这意味着与现有 agent environment 的 integration，可能与产品自身 interface 同样重要。

Vercel CEO Guillermo Rauch said the company's strongest products often begin as internal technology in which the team has built conviction. He described a new WebGPU creative-production tool as fully agent-native, designed for agents rather than only for people, and placed it alongside `agent-browser` as part of a new generation of developer tools. The release reflects a broader tooling shift: geometry, lighting, materials, textures, particles, and post-processing become programmable surfaces that agents can manipulate directly.

Vercel CEO Guillermo Rauch 表示，公司最好的 products 往往来自团队已经建立强烈 conviction 的 internal technology。他把一款新的 WebGPU creative-production tool 描述为 fully agent-native，也就是从一开始就为 agents 而不只是人类设计，并将其与 `agent-browser` 一起视为新一代 developer tools。这个发布也体现出更广泛的 tooling 变化：geometry、lighting、materials、textures、particles 与 post-processing 都成为 agents 可以直接操控的 programmable surfaces。

Google VP Josh Woodward announced a program that lets users buy a book, add it to Notebook, and apply the author's lessons to their own project. Google co-created the program with authors and publishers, framing it both as a personal “brain trust” for readers and a route to more engaged audiences for rights holders. It is a concrete example of licensed content moving from passive reading into interactive, task-specific context.

Google VP Josh Woodward 宣布了一项新项目：用户可以买下一本书，将其加入 Notebook，再把作者的观点应用到自己的 project 中。Google 与 authors 和 publishers 共同设计了这套机制，一方面让读者拥有个人 “brain trust”，另一方面也帮助 rights holders 接触参与度更高的 audiences。这是 licensed content 从被动阅读转向 interactive、task-specific context 的一个具体案例。

The Takeaway: Redwood Research chief scientist Ryan Greenblatt believes society should plan for AI to automate most AI research and development around the start of 2029, while building monitoring, security, alignment science, and international coordination before that automation compresses the time available to respond. In Greenblatt's words, “I wouldn't say superintelligence is bad. I would say it's dangerous.” Highly capable, widely deployed systems could concentrate power, accelerate destabilizing technologies, and become difficult to control as AI itself takes over model development.

核心结论： Redwood Research chief scientist Ryan Greenblatt 认为，社会应当按照 AI 在 2029 年初左右实现大部分 AI research and development 自动化来做准备，并在此之前建立 monitoring、security、alignment science 与 international coordination，因为一旦研发自动化，可供应对的时间会迅速压缩。他最关键的区分是，superintelligence 并非天然“坏”，但它“dangerous”：高度 capable、广泛部署的 systems 可能集中权力、加速具有破坏性的 technologies，并在 AI 接管 model development 后变得难以控制。

Greenblatt's AI 2040 Plan A is an ambitious scenario for slowing the transition just short of superintelligence while retaining highly capable systems for study and economic use. Its core is a transparent US-China agreement: identify major compute, pause most training and research in favor of inference, negotiate compute distribution, and keep both sides' development visible enough to prevent a destabilizing race. If the agreement broke down, most compute covered by it would ideally be destroyed or require a new agreement before reuse. Greenblatt explicitly does not expect this exact plan to happen, citing political will as the larger obstacle, but uses it to show what a coordinated safety regime would need to control.

Greenblatt 的 AI 2040 Plan A 是一个目标很高的 scenario：在接近 superintelligence 之前放慢 transition，同时保留足够强的 systems 用于研究与经济活动。其核心是一份透明的 US-China agreement：识别主要 compute，将大多数 training 与 research 暂停并转向 inference，协商 compute distribution，并让双方的 development 保持足够可见，避免再次陷入失控竞赛。如果 agreement 破裂，理想情况下，其覆盖的大部分 compute 会被销毁，或必须先达成新协议才能重新使用。Greenblatt 明确表示，他并不认为这个精确方案很可能发生，并把 political will 视为更大的障碍；但这套方案展示了一个协调式 safety regime 真正需要控制哪些变量。

The practical work begins with AI control inside labs. Greenblatt wants broad visibility into AI-company traffic, automated pipelines that flag suspicious behavior for human investigation, the ability to block activity while it is reviewed, precise permissions, and stronger conventional security against model theft, sabotage, backdoors, and data poisoning. He also warns that using AI to supervise AI creates risks of collusion and correlated failure, and that safety work cannot simply be delegated unless organizations can evaluate whether models are trustworthy in each domain.

现实工作首先要从 labs 内部的 AI control 开始。Greenblatt 希望 AI companies 能广泛观察内部 AI traffic，通过 automated pipelines 标记可疑行为并交给 human investigation，在 review 期间阻止相关 activity，同时建立精确 permissions，以及更强的传统 security，防止 model theft、sabotage、backdoors 与 data poisoning。他也警告，用 AI 监督 AI 会带来 collusion 与 correlated failure 风险；除非 organizations 能评估 models 在每个 domain 中是否值得信任，否则不能简单地把 safety work 一并交给 AI。

Even the restrained scenario remains economically radical. Greenblatt's model reaches roughly 200 times world GDP growth during the 2030s because systems capable of automating human work could also drive robots to build more robots and expand industrial capacity recursively. The tension is therefore not between progress and stasis, but between an uncontrolled capability loop and a slower regime that spends time and compute on safety while still capturing enormous scientific and material gains.

即使是受到约束的 scenario，经济影响依然极其激进。Greenblatt 的 model 预计 2030 年代 world GDP 累计增长约 200 倍，因为能够自动化 human work 的 systems 也可以驱动 robots 制造更多 robots，让 industrial capacity 递归扩张。因此，真正的张力并不在 progress 与 stasis 之间，而在失控的 capability loop 与更慢的 regime 之间：后者会投入时间和 compute 解决 safety，同时仍然获得巨大的 scientific 与 material gains。

Prepared from the Follow Builders feed data: https://github.com/zarazhangrui/follow-builders