九月十三日

OpenAI CEO Sam Altman says he agrees with Dario that frontier development needs to be paced, and that the issue has been a primary topic in recent OpenAI discussions. More concretely, OpenAI will adopt independent evaluators with employee-like access, with further details to come. The scope of that access and the implementation details have not yet been specified in his post.

OpenAI CEO Sam Altman 表示，他认同 Dario 关于把握前沿 AI 开发节奏的主张，而且这已经成为 OpenAI 近期讨论的主要议题。更具体地说，OpenAI 将引入拥有类似员工访问权限的独立评估者，后续会公布更多细节。他的帖子尚未说明具体的权限范围与实施细节。

Anthropic researcher Alex Albert argues that embedded evaluators may feel unusual in technology but are routine in other high-stakes industries. He points to federal examiners working inside major banks and full-time inspectors at US nuclear plants, and presents comparable on-site oversight at frontier AI labs as a practical first step.

Anthropic 研究员 Alex Albert 认为，常驻式评估者在科技行业或许显得少见，但在其他高风险行业早已是常态。他举例说，大型银行内有联邦检查人员办公，美国核电站也有全职驻场检查员，并认为 frontier AI 实验室采用类似的现场监督机制，是务实的第一步。

Vercel CEO Guillermo Rauch accepts that AI safety and cybersecurity concerns are legitimate but rejects slowing US development through bureaucracy, arguing that adversaries will retain the training methods, data, and intent to attack. At the engineering layer, he says Vercel teams now iterate as quickly in Zig, Go, and Rust as in TypeScript and Python because “agents are the new compilers,” translating intent into software and weakening the old case for choosing languages around human convenience. He also reports that an agent harness can orchestrate subagents with different models and reasoning efforts through instructions in `AGENTS.md` or a prompt, without server-side model routing.

Vercel CEO Guillermo Rauch 承认 AI 安全与网络安全方面的担忧是合理的，但反对用官僚机制放慢美国的开发速度，因为对手仍会拥有训练方法、数据和攻击意图。在工程层面，他表示 Vercel 团队如今使用 Zig、Go 和 Rust 的迭代速度，已经可以和 TypeScript、Python 一样快，因为“agent 正在成为新的编译器”，能把意图编译成软件，也削弱了过去为了方便人类而选择编程语言的理由。他还提到，一个 agent harness 现在可以通过 `AGENTS.md` 或 prompt 中的指令，编排使用不同模型和 reasoning effort 的 subagents，无需服务端模型路由。

Anthropic Claude Code builder Thariq says the profession has already absorbed a dramatic amount of change, yet acceleration is becoming hard even for people inside AI to track. Despite assigning a low probability to catastrophe and remaining confident in humanity’s resilience, he calls for time to harden systems and for society to deliberate over how the technology is deployed.

Anthropic Claude Code 开发者 Thariq 表示，软件工程行业和整个社会已经吸收了巨大的变化，但技术加速之快，连 AI 行业内的人都越来越难以跟上。尽管他认为灾难发生的概率较低，也相信人类具有韧性，但他仍主张留出时间加固系统，并让社会认真讨论这项技术应当如何部署。

Replit CEO Amjad Masad supports slowing development to harden systems in response to the debate over pacing frontier AI. He argues that the full set of systems recently hacked by agents has not yet been discovered.

Replit CEO Amjad Masad 在关于前沿 AI 开发节奏的讨论中，支持放慢速度、加固系统。他认为，近期遭 agent 入侵的系统尚未被全部发现。

Meta Senior Director of AI Madhu Guru predicts that more leading frontier-model evaluation specialists will move to independent groups such as METR over the next year, driven by increased funding, financial independence from lab equity, and concern about AI risk. He frames the harder prerequisite as human alignment: companies, governments, and countries still need shared ways to define opportunity and risk, measure second-order effects, and coordinate their response.

Meta AI 高级总监 Madhu Guru 预测，未来一年会有更多顶尖 frontier model 评估人才转向 METR 等独立机构，推动因素包括资金增加、摆脱实验室股权带来的财务依赖，以及对 AI 风险的关注。他认为更困难的前提是人类之间先实现 alignment：企业、政府和国家仍需共同界定机会与风险、衡量二阶影响，并协调应对方式。

Box CEO Aaron Levie expects some coordinated industry self-regulation as model capabilities rise, but warns that agreement among labs may be overtaken by politics. Any meaningful slowdown also depends on broad international participation, which he considers unlikely under current game-theoretic incentives until the risks become more severe and visible. His conclusion is that the path forward will remain messy.

Box CEO Aaron Levie 预计，随着模型能力增强，行业最终会形成某种协调式自律，但他也警告，实验室之间尚未达成共识，政治进程就可能先一步决定规则。任何真正有效的放缓还依赖广泛的国际参与，而在当前博弈激励下，他认为这不太可能发生，除非风险变得更严重、更明显。他的结论是，接下来的过程仍会相当混乱。

Y Combinator President and CEO Garry Tan compresses the enterprise-software shift into one line: a system of record must eventually become a domain-specific agent harness. The implication is that storing authoritative data is no longer enough; durable products also need to provide the execution environment through which agents can act on that domain.

Y Combinator 总裁兼 CEO Garry Tan 用一句话概括了企业软件的转向：system of record 最终必须演变成面向特定领域的 agent harness。其含义是，仅仅保存权威数据已经不够，长期有竞争力的产品还需要提供执行环境，让 agent 能在对应领域中采取行动。

Claude in Chrome is now generally available on every paid Claude plan and can act autonomously in the browser instead of requiring approval for every action. It uses existing logins to read and type text, click links, navigate pages, and fill forms across internal dashboards, legacy systems, and vendor portals that may not expose connectors. A safety classifier checks each proposed action against the user’s original request, while probes scan web content for prompt injection and warn Claude when content looks suspicious.

Claude in Chrome 现已向所有 Claude 付费计划全面开放，并能在浏览器中自主执行操作，不再要求用户逐项批准。它可以利用现有登录状态，在内部 dashboard、legacy system 和 vendor portal 等可能没有 connector 的网站中读取和输入文本、点击链接、浏览页面及填写表单。安全分类器会将每个拟执行动作与用户的原始请求进行比对，同时 probes 会扫描网页内容中的 prompt injection，并在发现可疑内容时提醒 Claude。

Anthropic reports that, before extra safeguards, stronger red-team attacks succeeded against Opus 4.5 in 17.6% of cases and Opus 5 in 3.8%. With probes and the automatic-approval safety classifier, no attacks succeeded against Sonnet 5 or Opus 5, while Fable 5 had a 0.3% success rate, all manually verified as low severity. The company still describes prompt injection as “a moving target.” Enterprise admins can restrict the extension to approved domains; it currently supports Chrome, not other Chromium browsers or mobile.

Anthropic 表示，在没有额外防护的情况下，更强的红队攻击对 Opus 4.5 和 Opus 5 的成功率分别为 17.6% 和 3.8%。加入 probes 与自动批准安全分类器后，针对 Sonnet 5 和 Opus 5 的攻击均未成功，Fable 5 的成功率为 0.3%，而且人工复核确认所有成功案例均属低严重性。公司仍将 prompt injection 称为“一个持续变化的目标”。Enterprise 管理员可以把扩展限制在获批域名内；目前它只支持 Chrome，不支持其他 Chromium 浏览器或移动端。

Claude Cowork is adding a built-in browser to the desktop app, giving Claude a separate environment for navigating sites, reading pages, clicking, typing, filling forms, and retrieving information from dashboards or portals without an extension. The distinction is deliberate: “It’s Claude’s browser, not yours.” The browser does not see personal tabs, bookmarks, or passwords, though users can import logins site by site; banking, email, and single sign-on sites are excluded unless explicitly selected.

Claude Cowork 正在桌面应用中加入内置浏览器，让 Claude 无需扩展即可在一个独立环境里浏览网站、读取页面、点击和输入、填写表单，并从 dashboard 或 portal 获取信息。它与个人浏览器之间的界线是刻意设计的：“这是 Claude 的浏览器，不是你的。”该浏览器无法看到用户自己的标签页、书签或密码，但用户可以逐个网站导入登录信息；银行、邮箱和单点登录网站默认排除，除非用户明确选择加入。

The built-in browser is intended for delegated web tasks while Claude in Chrome remains suited to pages already open in the user’s authenticated browser. It uses the same prompt-injection safeguards and action checks as Claude in Chrome, though Anthropic says these measures reduce rather than eliminate risk and recommends beginning with trusted sites. Rollout covers Pro, Max, and Team plans on macOS, Windows, and Linux in beta, with Enterprise controls available now. Web and mobile clients can drive the browser when the desktop app remains online.

内置浏览器面向交给 Claude 独立完成的网页任务，Claude in Chrome 则继续适合处理用户已在认证浏览器中打开的页面。它采用与 Claude in Chrome 相同的 prompt injection 防护和动作检查，但 Anthropic 表示，这些措施只能降低风险，无法完全消除风险，因此建议先从可信网站开始使用。该功能正以 beta 形式向 macOS、Windows 和 Linux 上的 Pro、Max 与 Team 计划推出，Enterprise 管理功能现已可用。只要桌面应用保持在线，网页端和移动端也能远程驱动这个浏览器。