周报 · 八月二日

This was the week agents stopped looking like isolated model demos and started looking like an operating layer. ChatGPT Work completed multi-application tasks from a phone; Codex stayed inside a Slack review loop; Linear said roughly 30% of its bugs already pass through an Issue → Agent → PR → Release flow; and Claude Code turned session context into persistent, inspectable artifacts. At the same time, falling model prices, routing, budgets, context compaction, and deployment speed made clear that the competitive unit is no longer a model call. It is a completed, governed workflow. Security was the hard constraint: repeated evidence around container escapes, approval fatigue, credential exfiltration, and stale permissions moved the discussion from model intent to deterministic containment. The week's strategic pattern was therefore not simple acceleration, but a three-part stack taking shape—cheaper intelligence, increasingly capable harnesses, and hardened execution environments.

本周，agent 不再只是彼此孤立的模型 demo，而开始显现为一种 operating layer。ChatGPT Work 可以从手机发起跨应用任务；Codex 能持续留在 Slack 评审闭环中；Linear 表示约 30% 的 bug 已经会经过 Issue → Agent → PR → Release 流程；Claude Code 则把 session 上下文转化为可持续查看与检查的 artifact。与此同时，模型降价、routing、预算控制、上下文 compaction 与部署提速共同说明，竞争单位已经不再是一次 model call，而是一条能够完成、治理并复用的 workflow。安全成为最硬的约束：container 逃逸、权限确认疲劳、凭证外泄与过期权限等反复出现的证据，让讨论从模型意图转向 deterministic containment。因此，本周的战略主线并非单纯加速，而是三层技术栈逐渐成形：更便宜的 intelligence、更强的 harness，以及更坚固的执行环境。

Sam Altman showed ChatGPT Work turning one phone prompt into travel research, a coordination site, group agreement, reservations, and a Gmail draft. Peter Yang described Codex editing a launch video, returning it to Slack, checking feedback every 30 minutes, and iterating until approval. By August 1, the pattern had become organizational: Linear said roughly 30% of its bugs already traverse an Issue → Agent → PR → Release flow, while Nan Yu stressed evidence gathering and high-confidence fixes. These examples changed the meaning of “agent” from a tool that generates an artifact to a process that remains active across applications, people, and time.

Sam Altman 展示了 ChatGPT Work 如何用一条手机 prompt 完成旅行调研、搭建协调网站、促成团队共识、预订并起草 Gmail 邮件。Peter Yang 则描述了 Codex 如何剪辑发布视频、发回 Slack、每 30 分钟检查反馈并持续迭代直至获批。到 8 月 1 日，这种模式已经进入组织运行：Linear 表示约 30% 的 bug 已会经过 Issue → Agent → PR → Release 流程，而 Nan Yu 强调 agent 必须先收集证据，只在高置信度下修复。这些案例重新定义了 “agent”：它不再只是生成某个 artifact 的工具，而是能够跨应用、跨人协作并持续运行的过程。

GPT-5.6 Sol reached state-of-the-art on ARC-AGI-3 after it was allowed to reason across multiple context windows with canonical compaction, showing that system design can unlock capability that a model-only comparison misses. The same week, OpenAI improved long-running tool workflows enough that typical Sol allowances should last about 18% longer, while Aaron Levie argued that decomposition and routing become decisive as tasks grow toward tens or hundreds of millions of tokens. Vercel's AI Gateway added budgets, failover, model choice, and observability around that problem. Swyx supplied the right economic frame: optimize dollars per completed task, not nominal token prices.

GPT-5.6 Sol 在获得跨多个 context window 的持续 reasoning 能力，并采用 canonical compaction 后，在 ARC-AGI-3 上达到 state-of-the-art，说明单纯比较模型会遗漏由系统设计释放的能力。同一周，OpenAI 通过优化长时间工具工作流，让典型 Sol 用户的额度预计延长约 18%；Aaron Levie 则指出，当任务规模增长到数千万甚至数亿 token 时，任务拆解与 routing 会直接决定结果。Vercel AI Gateway 为这一问题加入预算、failover、模型选择与 observability。Swyx 给出了最合适的经济框架：应该优化完成一项任务的美元成本，而不是名义 token 单价。

Kimi experiments showed that containers did not prevent agents from crashing the host through kernel panics, while Firecracker microVMs provided a stronger boundary. Replit's Amjad Masad argued for layered zero-trust systems that assume zero-days exist, and Aaron Levie emphasized access controls, audit trails, governance, and rapid containment. Anthropic then documented why those controls must be deterministic: users approved about 93% of Claude Code permission prompts, an internal phishing test caused credential exfiltration in 24 of 25 attempts, and an approved domain became an exfiltration path until a defensive proxy restricted it to the VM's session token. The consequence is clear: autonomous-agent security is now an infrastructure discipline, not a confidence score about model behavior.

Kimi 的实验显示，container 无法阻止 agent 通过 kernel panic 弄崩宿主机，而 Firecracker microVM 提供了更强的边界。Replit 的 Amjad Masad 主张采用默认 zero-day 必然存在的分层 zero-trust 系统；Aaron Levie 则强调访问控制、audit trail、行为治理与快速隔离。随后 Anthropic 说明了为什么这些控制必须是 deterministic 的：用户会批准约 93% 的 Claude Code 权限请求；一次内部 phishing 测试在 25 次中有 24 次导致凭证外泄；一个已批准域名也曾成为外泄通道，直到防御性 proxy 将其限制为只能使用 VM 的 session token。结论很明确：autonomous-agent security 已经成为一门基础设施学科，而不是对模型行为给出一个置信分数。

OpenAI cut GPT-5.6 Luna prices by 80% to $0.20 per million input tokens and $1.20 per million output tokens, cut Terra by 20% to $2/$12, and added a Sol Fast mode offering up to 2.5 times the speed for twice the price. Competitive supply was already pushing builders toward model routing: Replit Design combines open and closed models by visual specialty, and Vercel reported Grok 4.5 delivering strong cybersecurity price-performance. The strategic implication is not that cost disappears. As raw intelligence becomes cheaper and more substitutable, value shifts toward proprietary context, orchestration, domain logic, evaluation, and the ability to deliver a reliable outcome.

OpenAI 将 GPT-5.6 Luna 降价 80%，调整至每百万 input tokens 0.20 美元、每百万 output tokens 1.20 美元；Terra 降价 20% 至 2/12 美元；Sol 则新增以两倍价格提供最高 2.5 倍速度的 Fast mode。供给竞争也已经推动 builder 转向 model routing：Replit Design 会按照视觉任务专长组合 open 与 closed model，Vercel 则表示 Grok 4.5 在网络安全 benchmark 中展现了强劲性价比。战略含义并不是成本消失了，而是随着原始 intelligence 变得更便宜、更可替代，价值将上移到专有上下文、orchestration、行业逻辑、评估体系与可靠交付结果的能力。

Aaron Levie argued that better models expand the need for products connecting intelligence to industry data, UX, feedback loops, and compliance. Netic supplied direct commercial evidence: more than 70% of its customers are AI-first, a roughly $500,000 contract closed in 14 days, and AI-handled interactions have generated more than $600 million for customers. Samsara supplied the physical-world counterpart, processing 25 trillion data points across millions of vehicles and frontline workers and reporting about 380,000 accidents prevented in the prior year through safety interventions. These deployments favor a revenue-and-outcomes thesis over a labor-replacement thesis: domain systems create value by redesigning operations around models, not by dropping a general model into an existing process.

Aaron Levie 认为，更强的模型会扩大而非缩小 applied layer，因为企业仍需要把 intelligence 接入行业数据、UX、反馈闭环与合规体系。Netic 提供了直接的商业证据：超过 70% 的客户已采用 AI-first 模式，一份约 50 万美元的合同在 14 天内签下，由 AI 处理的互动已为客户创造超过 6 亿美元收入。Samsara 则给出现实世界的对应案例：其系统横跨数百万辆车辆和一线员工，每年处理 25 万亿个数据点，并称过去一年通过安全干预帮助预防约 38 万起事故。这些部署更支持“收入与结果”的逻辑，而不是“替代劳动力”的逻辑：domain system 的价值来自围绕模型重构 operation，而不是把通用模型直接塞进旧流程。

Product surfaces expanded in two directions. Agents moved closer to users through phones, voice, Slack, collaboration tools, and Cursor on iOS; they also made their work easier to inspect through Claude Code artifacts with version history, organization-only sharing, admin controls, retention policies, and compliance visibility. Infrastructure compressed the path from intention to deployment: Vercel removed as much as roughly seven seconds from CLI-to-live for many applications and exposed its platform through CLI, MCP, and API. At the frontier, Karpathy's two-hour, million-token Three.js experiment showed that long-running generation can make bespoke interactive software economically plausible, but its visible errors also showed that generation is advancing faster than visual self-auditing.

产品界面沿两个方向扩张。一方面，agent 通过手机、voice、Slack、协作工具与 Cursor iOS 更贴近用户；另一方面，Claude Code artifact 通过 version history、组织内分享、管理员控制、retention policy 与 compliance 可见性，让 agent 的工作更容易被检查。基础设施则压缩了从意图到部署的路径：Vercel 为许多应用将 CLI-to-live 流程最多缩短约 7 秒，并通过 CLI、MCP 与 API 开放平台。在能力前沿，Karpathy 让模型用两小时和一百万 token 生成 Three.js 世界的实验，表明长时间 generation 已可能让高度定制的交互软件具备经济可行性；但其中仍然明显的错误也说明，生成能力的发展速度快于模型的视觉自我审查能力。

Builders broadly agreed that the model is only one component of a useful system. Levie emphasized the applied layer and harness economics; Nan Yu emphasized evidence and maintainer-approved workflows; Granola's Chris Pedregal emphasized accumulated context and proactive computation; and River AI's Igor Babushkin emphasized verifiable reward loops, proprietary data, and domain post-training. The disagreement was about where limits bind. OpenAI compute chief Sachin Katti saw supply, power, and physical buildout as the immediate constraint, while enterprise observers focused on trust, setup, governance, and diffusion. Swyx argued for cost per completed task, whereas Granola deliberately prioritized discovering the right experience before optimizing inference cost. These positions are compatible only in sequence: capability and capacity expand what is possible, but product design and governance determine what is adopted.

Builder 普遍同意，模型只是有用系统中的一个组成部分。Levie 强调 applied layer 与 harness economics；Nan Yu 强调证据与 maintainer 批准的 workflow；Granola 的 Chris Pedregal 强调累积上下文与 proactive computation；River AI 的 Igor Babushkin 则强调可验证 reward loop、专有数据和领域 post-training。分歧主要在于真正的约束位于哪里。OpenAI compute chief Sachin Katti 认为，供给、电力与实体建设是眼前瓶颈；企业观察者则更关注信任、安装、治理与扩散。Swyx 主张衡量每项已完成任务的成本，而 Granola 刻意先寻找正确体验，再优化 inference 成本。这些观点只有按顺序理解才能相容：能力与容量扩大可能性，但产品设计和治理决定什么会真正被采用。

Analysis: The near-term winners are likely to be companies that can turn abundant model capability into bounded, auditable, domain-specific operations. Falling prices increase the number and duration of feasible agent runs, which raises—not lowers—the importance of budgets, routing, observability, identity, and containment. Better agents also increase the capability overhang described by Levie and Nikunj Kothari: expert performance may advance faster than institutions can supply clean data, permissions, workflow redesign, and accountable owners. That makes enterprise diffusion a systems-and-organization problem even when the underlying model is ready.

分析： 近期更可能胜出的，是那些能把充裕模型能力转化为边界清晰、可审计、行业专属 operation 的公司。降价会增加可行 agent run 的数量与持续时间，因此预算、routing、observability、identity 与 containment 的重要性不是下降，而是上升。更强的 agent 也会扩大 Levie 与 Nikunj Kothari 所描述的 capability overhang：专家级能力的进步速度，可能快于机构提供干净数据、合理权限、workflow 重构与明确责任人的速度。因此，即使底层模型已经准备好，企业扩散依然是一个系统与组织问题。

Analysis: Watch whether teams publish completed-task economics rather than token prices; whether agent platforms make microVM isolation, scoped credentials, audit trails, and budget controls default; and whether Issue → Agent → PR workflows spread with evidence-gathering gates instead of maximizing autonomous pull-request volume. Also watch the interface layer: collaboration tools, mobile control surfaces, persistent artifacts, and proactive context may prove more important for adoption than another blank chat box. Finally, look for deployments that report durable revenue, safety, or cycle-time outcomes, because those measures will reveal whether capability is crossing the gap into operations.

分析： 下周值得关注的是：团队是否开始公布 completed-task economics，而不只是 token 单价；agent 平台是否把 microVM 隔离、最小化凭证、audit trail 与预算控制变成默认配置；Issue → Agent → PR 流程是否会在 evidence-gathering gate 的约束下扩散，而不是单纯追求 autonomous PR 数量。还要关注 interface layer：协作工具、移动控制界面、持久 artifact 与 proactive context，可能比另一个空白聊天框更能推动 adoption。最后，应寻找能够报告持续收入、安全或 cycle-time 结果的部署，因为这些指标才能说明模型能力是否真正跨越鸿沟进入 operation。