九月六日

OpenAI's Thibault Sottiaux said GPT-6 Astra at low reasoning effort performs better than GPT-5.6 Sol at high effort. His practical recommendation is that users who were satisfied with Sol on high should start Astra on low or medium instead. The signal is not only a capability gain: a stronger result at a lower effort setting changes how builders should balance intelligence, latency, and usage.

OpenAI 的 Thibault Sottiaux 表示，GPT-6 Astra 在 low reasoning effort 下的表现优于 GPT-5.6 Sol 的 high effort。他给出的实际建议是：如果用户此前对 Sol 的 high 设置满意，切换到 Astra 后可以先从 low 或 medium 开始。这个信号不只是 capability 提升；更低 effort 就能获得更强结果，也会改变 builders 在 intelligence、latency 与 usage 之间的取舍方式。

AI educator Peter Yang highlighted Brilliant co-founder Sue Khim's product principle, “Never tell the learner the answer.” Khim argues that better grades do not necessarily mean more learning, and compares using AI to skip the work with bringing a robotic arm to the gym to lift for you. Her builder lesson pairs that pedagogical constraint with a product moat: find domains where unique data can make the experience improve over time.

AI 教育内容创作者 Peter Yang 强调了 Brilliant co-founder Sue Khim 的产品原则：“Never tell the learner the answer.” Khim 认为，更高的成绩不一定代表更多学习；用 AI 跳过思考过程，就像带着 robotic arm 去健身房替自己举重。她给 builders 的启发把教学约束与产品 moat 联系起来：找到能依靠 unique data 持续改善体验的领域。

OpenClaw and OpenAI builder Peter Steinberger said his preferred agent harness is one step closer, but cloud sessions still need to start within seconds. The current implementation freshly clones repositories, which is not fast enough, so his next step is a snapshotting approach intended to remove that startup delay.

OpenClaw 与 OpenAI builder Peter Steinberger 表示，他想要的 agent harness 又向前迈进了一步，但 cloud sessions 仍需要做到数秒内启动。当前实现每次都会重新 clone repository，速度还不够快，因此下一步将通过 snapshotting 消除这段启动延迟。

Anthropic divides agent security risk into user misuse, model misbehavior, and external attack, then layers defenses across the model, its environment, and the external content it consumes. Its three products use different containment patterns: ephemeral gVisor containers for claude.ai code execution, Seatbelt or bubblewrap sandboxes for Claude Code, and a local VM for Claude Cowork. The product data also exposes the limits of constant human approval: users accepted roughly 93% of Claude Code permission prompts, while adding an OS-level sandbox reduced those prompts by 84%.

Anthropic 将 agent security risk 分为 user misuse、model misbehavior 与 external attack，并在 model、运行 environment 和 agent 消费的 external content 三个层面叠加防线。三款产品采用不同 containment patterns：claude.ai code execution 使用 ephemeral gVisor containers，Claude Code 使用 Seatbelt 或 bubblewrap sandboxes，Claude Cowork 则使用 local VM。产品数据也暴露了持续人工审批的局限：用户大约批准了 93% 的 Claude Code permission prompts，而加入 OS-level sandbox 后，prompt 数量减少了 84%。

The sharpest lesson came from an approved network path. A malicious file in a Cowork workspace used an attacker's API key to upload other workspace files through the allowlisted `api.anthropic.com` domain; the sandbox worked as designed, but data still left the system. Anthropic fixed the route with a proxy that accepts only the VM's provisioned session token. Its conclusion is that an allowlist entry is a capability grant, not merely a trusted destination, and deterministic environmental boundaries must catch the failures that probabilistic model defenses miss.

最尖锐的教训来自一条已经获准的 network path。Cowork workspace 中的 malicious file 使用攻击者自己的 API key，经 allowlist 中的 `api.anthropic.com` domain 上传其他 workspace files；sandbox 完全按设计工作，数据却仍然离开了系统。Anthropic 随后加入只接受 VM provisioned session token 的 proxy。其结论是，allowlist entry 本质上是一项 capability grant，而不只是可信 destination；probabilistic model defenses 漏掉的问题，必须由 deterministic environmental boundaries 兜底。

Anthropic's Managed Agents architecture decouples three components that originally lived in one container: the durable session event log, the harness that calls Claude and routes tools, and the sandbox that runs code and edits files. A failed sandbox can now be reprovisioned as an interchangeable resource, while a failed stateless harness can wake from the external session log and resume from the last event. Credentials are also kept out of generated-code sandboxes: repository access can be wired into a Git remote during provisioning, while MCP OAuth tokens stay in a vault and are applied by a dedicated proxy.

Anthropic 的 Managed Agents architecture 把原先共处一个 container 的三个组件拆开：持久化的 session event log、调用 Claude 并路由 tools 的 harness，以及运行 code 和编辑 files 的 sandbox。发生故障的 sandbox 现在可以作为可替换资源重新 provision；无状态 harness 失败后，则可以从外部 session log 中 wake，并从最后一个 event 继续执行。Credentials 也不会进入 generated-code sandbox：repository access 可在 provisioning 阶段接入 Git remote，MCP OAuth tokens 则保存在 vault 中，由专用 proxy 代为使用。

The separation improved both reliability and responsiveness. Sandboxes are provisioned only when a task needs one, allowing inference to begin without waiting for repository cloning or container startup; Anthropic reports that p50 time to first token fell roughly 60% and p95 fell more than 90%. Treating every execution environment as the same `execute(name, input) → string` interface also lets one brain use many hands, or pass those hands to another brain, without coupling the harness to a particular container, VPC, device, or tool.

这种拆分同时提升了 reliability 与 responsiveness。只有任务真正需要时才会 provision sandbox，因此 inference 无需等待 repository cloning 或 container startup 就能开始；Anthropic 报告 p50 time to first token 下降约 60%，p95 下降超过 90%。把每个 execution environment 都抽象成同一个 `execute(name, input) → string` interface，也让一个 brain 可以使用多个 hands，或把 hands 交给另一个 brain，而无需让 harness 与特定 container、VPC、device 或 tool 耦合。

Anthropic traced reports of worse Claude Code behavior to three separate product changes; it says the API and inference layer were unaffected, and all three issues were resolved by April 20 in v2.1.116. First, changing the default reasoning effort from high to medium reduced latency but made Sonnet 4.6 and Opus 4.6 feel less capable, so Anthropic restored higher defaults. Second, a stale-session caching optimization repeatedly removed older reasoning on every later turn, making Claude forgetful and repetitive while also causing cache misses; that bug was fixed April 10 in v2.1.101. Third, a system-prompt instruction limiting text between tool calls and final-answer length produced a 3% drop on a broader evaluation and was reverted.

Anthropic 将 Claude Code 体验变差的报告追溯到三项彼此独立的 product changes；API 与 inference layer 没有受到影响，三项问题均已在 4 月 20 日的 v2.1.116 中解决。第一项是把 default reasoning effort 从 high 降至 medium，虽然降低了 latency，却让 Sonnet 4.6 与 Opus 4.6 显得能力下降，因此 Anthropic 恢复了更高默认值。第二项是 stale-session caching optimization 出现 bug，在后续每个 turn 都反复删除早期 reasoning，使 Claude 变得健忘、重复，同时造成 cache misses；该问题已在 4 月 10 日的 v2.1.101 中修复。第三项是 system prompt 对 tool calls 之间文本和 final answer 长度施加限制，在更广泛的 evaluation 中造成 3% 下滑，随后被撤回。

The post is a useful warning about agent eval coverage: normal aggregate usage data did not clearly isolate changes that affected different traffic slices and schedules, while internal builds and unrelated experiments made the caching failure harder to reproduce. Anthropic says future intelligence tradeoffs will receive broader per-model evals, ablations, soak periods, gradual rollouts, and tighter review of system-prompt changes; it also reset usage limits for all subscribers.

这篇复盘对 agent eval coverage 提供了直接警告：当不同改动作用于不同 traffic slices 与时间段时，常规 aggregate usage data 无法清楚定位问题；internal builds 和无关 experiments 又让 caching failure 更难复现。Anthropic 表示，未来任何可能牺牲 intelligence 的改动，都将接受更广泛的 per-model evals、ablations、soak periods、gradual rollouts，以及更严格的 system prompt review；同时也为所有 subscribers 重置了 usage limits。

Claude Code can now publish session progress as a live visual artifact, including PR walkthroughs, system explainers, dashboards, release checklists, and incident pages. Each artifact draws on the session's codebase, connectors, and conversation, updates in place at the same link when Claude republishes it, and retains version history. The result makes an agent's evolving evidence and reasoning directly inspectable instead of forcing a teammate to reconstruct the work from a status update.

Claude Code 现在可以把 session 进度发布为实时 visual artifact，包括 PR walkthroughs、system explainers、dashboards、release checklists 与 incident pages。每个 artifact 都会利用 session 中的 codebase、connectors 和 conversation；Claude 重新发布后，同一链接会原地更新，并保留 version history。这样一来，agent 持续变化的 evidence 与 reasoning 可以被团队直接查看，无需再通过 status update 重建整个工作过程。

Artifacts are private to the author by default and can be shared only with authenticated members of the organization. Administrators receive an organization-level toggle, role-based scoping, retention policies, and compliance API visibility. The beta is available to Claude Team and Enterprise organizations from the Claude Code CLI and desktop app, with published pages viewable in a browser.

Artifacts 默认仅 author 可见，只能与 organization 中已认证的 members 分享。Administrators 可以使用 organization-level toggle、role-based scoping、retention policies 与 compliance API visibility。该 beta 已面向 Claude Team 和 Enterprise organizations 开放，可从 Claude Code CLI 与 desktop app 创建，发布后的页面可在 browser 中查看。

The Takeaway: Redwood Research chief scientist Ryan Greenblatt believes society should prepare for AI to automate most AI research and development around the start of 2029, while there is still time to build monitoring, security, alignment science, and international coordination. His central distinction is that superintelligence is not necessarily bad, but dangerous: highly capable and widely deployed systems could become difficult to control, concentrate power, and rapidly accelerate destabilizing technologies once AI itself drives model development.

核心结论： Redwood Research chief scientist Ryan Greenblatt 认为，社会应当按照 AI 在 2029 年初左右自动化大部分 AI research and development 来做准备，并趁仍有时间建立 monitoring、security、alignment science 与 international coordination。他的核心区分是，superintelligence 不一定是坏事，但非常危险：一旦 AI 自己推动 model development，高度 capable、广泛部署的 systems 可能变得难以控制，导致权力集中，并快速加速具有破坏性的 technologies。

Greenblatt's AI 2040 Plan A sketches a coordinated slowdown just short of superintelligence while preserving highly capable systems for economic and scientific use. Its core is a transparent US-China agreement to identify major compute, pause most training and research in favor of inference, negotiate compute distribution, and keep development visible enough to reduce the risk of a race. He does not expect this exact plan to occur and identifies political will as the larger obstacle, but uses it to make the required control points concrete.

Greenblatt 的 AI 2040 Plan A 描绘了一种协调减速方案：在接近 superintelligence 之前放慢进程，同时保留高度 capable 的 systems 用于经济与科学活动。其核心是一份透明的 US-China agreement，用来识别主要 compute、暂停大多数 training 与 research 并转向 inference、协商 compute distribution，同时让 development 保持足够可见，以降低竞赛失控的风险。他并不认为这套精确方案很可能发生，并把 political will 视为更大的障碍，但借此明确了真正需要控制的关键点。

Inside labs, his practical agenda is broad visibility into AI-company traffic, automated pipelines that flag suspicious behavior for human investigation, the ability to block activity during review, precise permissions, and stronger conventional security against model theft, sabotage, backdoors, and data poisoning. He also cautions that AI supervising AI creates the possibility of collusion and correlated failure. Even his restrained scenario remains economically radical because systems that automate human work could also direct robots to build more robots and recursively expand industrial capacity.

在 labs 内部，他提出的现实 agenda 包括：广泛观察 AI-company traffic，通过 automated pipelines 标记可疑行为并交给 human investigation，在 review 期间阻止相关 activity，建立精确 permissions，以及加强传统 security，防范 model theft、sabotage、backdoors 与 data poisoning。他也提醒，用 AI 监督 AI 会带来 collusion 与 correlated failure 的可能。即使在这个受到约束的 scenario 中，经济变化仍会极其激进，因为能够自动化 human work 的 systems 也可能指挥 robots 制造更多 robots，让 industrial capacity 递归扩张。