周报 · 八月三十日

The week's center of gravity moved from model capability to the control system around the model. Anthropic expanded Claude from conversation into shared memory and two browser surfaces; OpenAI described consumer transactions that keep credentials outside the model; Vercel shipped connectivity, lightweight execution, and larger sandbox capacity; and enterprise builders repeatedly returned to governed data, systems of record, and workflow-level evals. At the same time, OpenAI's decision to end model distribution through Cursor and builders' arguments for harness-native products made clear that the interface controlling context, permissions, and model choice is becoming a strategic layer in its own right.

本周的重心从 model capability 转向了 model 周围的 control system。Anthropic 把 Claude 从对话扩展到共享 memory 和两种 browser surface；OpenAI 描述了把 credentials 留在 model 之外的 consumer transactions；Vercel 发布了 connectivity、轻量执行和更大规模的 sandbox capacity；enterprise builders 则反复回到 governed data、systems of record 与 workflow-level evals。与此同时，OpenAI 决定停止通过 Cursor 分发 models，加上 builders 对 harness-native products 的讨论，都说明掌控 context、permissions 与 model choice 的 interface，正在成为独立的战略层。

Analysis: The competitive stack is separating into three layers: models supply intelligence, harnesses coordinate tools and execution, and governed systems supply trusted context plus deterministic boundaries. The likely winners will not necessarily own every layer, but they will need explicit control over the handoffs between them. This is an interpretation of the week's releases and builder arguments, not a confirmed market outcome.

分析： 竞争栈正在分成三层：models 提供 intelligence，harnesses 协调 tools 与 execution，governed systems 提供可信 context 和 deterministic boundaries。未来的赢家未必需要拥有每一层，但必须明确控制层与层之间的 handoff。这是对本周 releases 与 builder arguments 的综合判断，并非已经确认的市场结果。

Confirmed: Anthropic made Claude in Chrome generally available to paid plans and introduced a separate browser inside Claude Cowork. The extension can operate inside existing logged-in sessions, while Cowork's browser is isolated from personal tabs, bookmarks, and passwords and imports only selected site logins. Claude in Chrome also moved some actions from repeated human approval to layered enforcement: content is screened for likely prompt injection and a separate classifier checks whether proposed actions match the user's request. Anthropic reported no successful attacks against Sonnet 5 or Opus 5 after those safeguards in its stronger evaluation, while stressing that risk is reduced rather than eliminated. Separately, OpenAI's Thibault Sottiaux said ChatGPT can complete shopping, ride booking, and haircut scheduling without seeing a user's actual credentials.

已确认： Anthropic 向付费方案正式开放 Claude in Chrome，并在 Claude Cowork 中引入一套独立 browser。extension 可以在现有登录 session 内操作，而 Cowork browser 与个人 tabs、bookmarks 和 passwords 隔离，只导入用户选定的网站登录信息。Claude in Chrome 还把部分 actions 从反复人工批准转向 layered enforcement：系统先筛查 content 中可能存在的 prompt injection，再由另一个 classifier 判断拟执行 action 是否符合用户原始请求。Anthropic 表示，在更强的 evaluation 中加入这些 safeguards 后，Sonnet 5 与 Opus 5 没有出现成功攻击，但同时强调风险只是降低，并未消失。另一边，OpenAI 的 Thibault Sottiaux 表示，ChatGPT 已能完成购物、叫车和预约理发，而且无需看到用户的真实 credentials。

Analysis: Browser control is becoming a transaction platform rather than a convenience feature. The product boundary is shifting toward delegated authority: which session an agent may use, which credentials remain hidden, which actions can proceed automatically, and which enforcement layer can stop an unsafe request. That raises the value of secure identity and action policy while making an agent's permission design part of its core user experience.

分析： Browser control 正从便利功能变成 transaction platform。产品边界正在转向 delegated authority：agent 可以使用哪个 session、哪些 credentials 必须隐藏、哪些 actions 可以自动执行，以及哪一层 enforcement 能阻止不安全请求。由此，secure identity 与 action policy 的价值上升，而 agent 的 permission design 也成为核心用户体验的一部分。

Confirmed: Anthropic reported that Claude Code users approved about 93% of permission prompts, then reduced those prompts by 84% with an OS-level sandbox. In a controlled phishing exercise, a pasted malicious prompt exfiltrated AWS credentials in 24 of 25 attempts, demonstrating the limits of model-layer intent checks. Anthropic documented three isolation patterns—ephemeral gVisor containers, Seatbelt or bubblewrap sandboxes, and a sealed local VM—and described a Cowork exfiltration path through an allowlisted Anthropic domain that required a session-token proxy to close. Swyx also reported that an unstable macOS capability used by Codex had locked him out of his keychain twice in a week, showing that failures can originate below the model and harness layers.

已确认： Anthropic 报告称，Claude Code 用户会批准大约 93% 的 permission prompts，随后公司通过 OS-level sandbox 将 prompts 数量减少了 84%。在一次受控 phishing exercise 中，被粘贴的恶意 prompt 在 25 次尝试中有 24 次成功外泄 AWS credentials，说明 model-layer intent checks 存在明确边界。Anthropic 记录了三种 isolation patterns——ephemeral gVisor containers、Seatbelt 或 bubblewrap sandboxes，以及 sealed local VM——并披露 Cowork 曾可通过 allowlisted Anthropic domain 外泄数据，最终需要 session-token proxy 才能堵住该路径。Swyx 也报告称，Codex 使用的一项不稳定 macOS capability 在一周内两次让他无法访问 keychain，说明 failure 可能发生在 model 与 harness 更底层的位置。

Analysis: More approvals do not automatically create more safety when users routinely click through them. The stronger operating model combines probabilistic defenses with deterministic limits on filesystem, network, credentials, and process execution. Security therefore becomes an architecture and observability problem, not merely a better system prompt.

分析： 当用户习惯性点击批准时，增加 approval 并不会自动带来更多安全。更强的 operating model 必须把 probabilistic defenses 与 filesystem、network、credentials 和 process execution 的 deterministic limits 结合起来。因此，security 是 architecture 与 observability 问题，而不只是写出更好的 system prompt。

Confirmed: Anthropic described Managed Agents as an append-only session log, a harness that runs the model loop and routes tools, and a replaceable sandbox for code and file operations. The company said separating the "brain" from the "hands" reduced p50 time-to-first-token by about 60% and p95 by more than 90%. Vercel made Connect generally available for authenticated service access, introduced a lightweight QuickJS-based Run SDK for generated programs that do not require a full sandbox, and highlighted multi-region failover, up to 10,000 concurrent sandboxes by default, and a ramp rate of 5,000 vCPUs per minute. Its `fx` 0.0.7 release narrowed the tool surface while improving MCP and shell process handling.

已确认： Anthropic 把 Managed Agents 描述为三部分：记录事件的 append-only session log、运行 model loop 并路由 tools 的 harness，以及执行 code 与 file operations 的可替换 sandbox。公司表示，将“brain”与“hands”分离后，p50 time-to-first-token 大约下降 60%，p95 降低超过 90%。Vercel 则正式开放 Connect，用于访问经过身份验证的 services；推出基于 QuickJS 的轻量 Run SDK，处理不需要完整 sandbox 的 generated programs；并介绍 multi-region failover、默认最多 10,000 个 concurrent sandboxes，以及每分钟 5,000 vCPUs 的扩展速度。其 `fx` 0.0.7 release 还收窄了 tool surface，同时加强 MCP 与 shell process handling。

Analysis: Agent infrastructure is converging on composable primitives rather than a single undifferentiated runtime. Durable state allows recovery, replaceable execution reduces the cost of failure, and narrower tool contracts make behavior easier to secure and debug. This architecture also makes model choice more portable because the operational state no longer has to live inside one model session.

分析： Agent infrastructure 正在收敛到 composable primitives，而不是单一且不可分割的 runtime。Durable state 支持 recovery，可替换 execution 降低 failure 成本，更窄的 tool contracts 则让行为更容易被保护和调试。这种 architecture 还提高了 model choice 的可迁移性，因为 operational state 不必继续锁在某个 model session 内。

Confirmed: Aaron Levie argued that systems of record grow more important when agents execute more work because governance, reliability, security, access controls, business logic, and APIs define safe operation. He also framed applied AI's moat as the workflow around the model: domain context, model routing, system connections, user experience, and domain-specific evals. Madhu Guru argued that evals must decompose meaningful jobs, discriminate between materially different systems, and evolve from short summaries toward multi-document synthesis and proactive monitoring. By week's end, Guru recommended model-agnostic stacks built on real business-outcome evals and a future ability to post-train open models; Dan Shipper's announcement of a head of evals at Every showed evaluation becoming an explicit organizational role. The Eon founders added that proprietary enterprise data remains valuable when models and compute have low switching costs, while governance must account for fast nonhuman actors with legitimate permissions.

已确认： Aaron Levie 认为，当 agents 执行更多工作时，systems of record 会变得更重要，因为 governance、reliability、security、access controls、business logic 与 APIs 定义了安全执行方式。他还把 applied AI 的 moat 定义为 model 周围的 workflow：domain context、model routing、system connections、user experience 与 domain-specific evals。Madhu Guru 则指出，evals 必须拆解真正有意义的 jobs、区分能力明显不同的 systems，并随着使用方式从短摘要发展到 multi-document synthesis 和 proactive monitoring 而持续演进。到周末，Guru 进一步建议企业围绕真实 business outcomes 建设 model-agnostic evals，并在未来形成 post-train open models 的能力；Dan Shipper 宣布 Every 设置 head of evals，也说明 evaluation 正在成为明确的组织职能。Eon founders 补充说，当 models 与 compute 的 switching costs 较低时，企业 proprietary data 仍有持久价值，而 governance 必须覆盖拥有合法 permissions、但行动速度极快的 nonhuman actors。

Analysis: The enterprise moat is less likely to be exclusive access to one frontier model than the ability to measure outcomes against proprietary context and enforce repeatable action inside governed workflows. Systems of record that expose safe execution surfaces can gain importance; those that only store data risk being bypassed by external harnesses.

分析： Enterprise moat 更可能来自用 proprietary context 衡量 outcomes、并在 governed workflows 内执行可重复 actions 的能力，而不是独占某个 frontier model。能够提供安全 execution surfaces 的 systems of record 会变得更重要；如果只负责存储 data，则可能被外部 harnesses 绕过。

Confirmed: OpenAI's Thibault Sottiaux said OpenAI will end its partnership with Cursor and stop providing models through Cursor on November 12, while still allowing developers to bring OpenAI API keys and use OpenAI IDE extensions in Cursor. Replit CEO Amjad Masad responded by offering access to OpenAI models, a multi-model router, and transition funding to teams seeking model optionality. Guillermo Rauch argued that agent platforms should give builders control of runtime, models, skills, tools, connectivity, and sandboxing, while Peter Yang argued that new products increasingly need to run inside established AI harnesses because those environments already hold user context.

已确认： OpenAI 的 Thibault Sottiaux 表示，OpenAI 将在 11 月 12 日结束与 Cursor 的合作，并停止通过 Cursor 提供 models；但 developers 仍可自带 OpenAI API keys，并在 Cursor 中使用 OpenAI IDE extensions。Replit CEO Amjad Masad 随即提出替代方案，包括 OpenAI models、multi-model router，以及为追求 model optionality 的团队提供 transition funding。Guillermo Rauch 主张 agent platforms 应让 builders 控制 runtime、models、skills、tools、connectivity 与 sandboxing；Peter Yang 则认为，新 products 越来越需要运行在现有 AI harnesses 内，因为这些 environments 已经掌握用户 context。

Analysis: Distribution is no longer only about placing a model inside a popular interface. It is about who controls user context, usage economics, tool permissions, routing, and the trust relationship with developers. Open model access and bring-your-own-key paths can limit lock-in, but the harness still owns a powerful aggregation point.

分析： Distribution 已不只是把 model 放进热门 interface，而是关于谁控制 user context、usage economics、tool permissions、routing，以及与 developers 之间的 trust relationship。开放 model access 与 bring-your-own-key 路径可以限制 lock-in，但 harness 依然掌握强大的聚合入口。

Anthropic's product changes formed a connected stack: one memory now spans Claude Chat and Cowork with topic-level controls; Claude gained both an in-session Chrome extension and a separately contained Cowork browser; Claude Code can publish live, versioned visual artifacts for authenticated organization members; and a Swift package routes tasks from Apple's Foundation Models framework to Claude when local inference is insufficient. These releases place routing, memory, browsing, execution, and inspectability around the model rather than treating each as a standalone feature.

Anthropic 的 product changes 形成了一套相互连接的 stack：同一套 memory 现在覆盖 Claude Chat 与 Cowork，并提供 topic-level controls；Claude 同时拥有 session 内的 Chrome extension 和独立隔离的 Cowork browser；Claude Code 可以向已认证 organization members 发布实时、可版本化的 visual artifacts；一项 Swift package 则在 local inference 不足时，把 Apple Foundation Models framework 中的任务路由给 Claude。这些 releases 把 routing、memory、browsing、execution 与 inspectability 放在 model 周围，而不是把它们当作彼此孤立的功能。

Vercel's releases attacked the same stack from the infrastructure side: secure service connectivity, lightweight generated-code execution, globally distributed sandboxes, automated security checks, and a smaller CLI-agent interface with stronger process control. Parallel founder Parag Agrawal described the corresponding data layer for the open web: agent queries are longer and more explicit than human searches, and Parallel ranks toward high-signal excerpts while proposing source compensation based on incremental value. The web itself is therefore being reformatted for machine consumption through APIs, MCP, markdown, and agent-native retrieval.

Vercel 的 releases 从 infrastructure 一侧处理同一个 stack：安全 service connectivity、轻量 generated-code execution、全球分布式 sandboxes、automated security checks，以及 tool surface 更小但 process control 更强的 CLI-agent interface。Parallel founder Parag Agrawal 则描述了 open web 对应的 data layer：agent queries 比人类搜索更长、更明确，Parallel 的 ranking 目标是 high-signal excerpts，同时提出按照 source 的增量价值进行补偿。因此，web 本身也正在通过 APIs、MCP、markdown 与 agent-native retrieval 被重新格式化，以适应机器消费。

Builders broadly agreed on four points. First, evals must map to real workflow jobs and change as user behavior changes. Second, agents need access to proprietary context but must execute within explicit data, identity, and software controls. Third, modularity matters: open protocols, model routing, and replaceable runtimes reduce dependence on any single model or vendor. Fourth, reliability and economics are product features—OpenAI restored five-hour Plus windows to smooth compute demand, while Rauch said lower prices made OpenAI Sol Vercel AI Gateway's fastest-growing frontier model.

Builders 大体上形成了四点共识。第一，evals 必须对应真实 workflow jobs，并随着用户行为变化而更新。第二，agents 需要访问 proprietary context，但必须在明确的 data、identity 与 software controls 内执行。第三，modularity 很重要：open protocols、model routing 与可替换 runtimes 可以降低对单一 model 或 vendor 的依赖。第四，reliability 与 economics 本身就是产品功能——OpenAI 恢复 Plus 的五小时窗口以平滑 compute demand，而 Rauch 表示，降价之后 OpenAI Sol 成为 Vercel AI Gateway 增长最快的 frontier model。

The disagreement was mostly about where durable value accumulates. Garry Tan warned that systems of record must become AI harnesses or face replacement; Aaron Levie argued that the same systems become more valuable as agent activity increases. These claims can coexist only if systems of record evolve from passive storage into governed action platforms. A second tension concerned economics: Rauch read lower prices as evidence of elastic demand, while Nikunj Kothari forecast that compute scarcity and true infrastructure costs will make subsidized token pricing harder to sustain. Kothari's claim is explicitly a forecast, not a confirmed price movement.

分歧主要在于持久价值会积累在哪里。Garry Tan 警告 systems of record 必须变成 AI harnesses，否则会面临被替代；Aaron Levie 则认为，随着 agent activity 增长，这些 systems 会更有价值。只有当 systems of record 从被动存储演进为 governed action platforms 时，这两个判断才能同时成立。第二个张力来自 economics：Rauch 把降价后的增长理解为 demand 高度弹性的证据，而 Nikunj Kothari 预测 compute scarcity 与真实 infrastructure costs 会让补贴式 token pricing 更难持续。Kothari 的说法明确属于 forecast，并非已经发生的价格变化。

For enterprises, the buying question is shifting from “which model is best?” to “which system can deliver a measured outcome against our data without losing governance?” Box's results and Levie's argument, Eon's data thesis, Walleye's firm-wide adoption playbook, and Guru's eval roadmap all point toward an operating capability rather than a one-time software purchase. Training, shared experimentation, proprietary context, auditability, and continuously evolving tests become complementary parts of deployment.

对 enterprises 而言，采购问题正在从“哪个 model 最强？”转向“哪个 system 能基于我们的 data 交付可衡量 outcome，同时不失去 governance？”Box 的业绩与 Levie 的判断、Eon 的 data thesis、Walleye 的全公司 adoption playbook，以及 Guru 的 eval roadmap，都指向一种 operating capability，而不是一次性 software purchase。Training、共享 experimentation、proprietary context、auditability 与持续演进的 tests，正在成为 deployment 中彼此补充的组成部分。

For builders, the scarce work is moving upward and downward at the same time. Upward, teams need domain judgment, product clarity, and outcome definitions; downward, they need containment, credentials, recovery, process control, and reliable connectivity. Zara Zhang's observation that “slop” comes from missing specific experience rather than simply from AI authorship reinforces the upper layer, while Anthropic's quality postmortem shows the lower layer: changes to reasoning effort, session handling, and prompts can degrade a product even when the underlying API and inference layer have not regressed.

对 builders 而言，稀缺工作正在同时向上层与下层移动。向上，teams 需要 domain judgment、product clarity 与 outcome definitions；向下，则需要 containment、credentials、recovery、process control 与 reliable connectivity。Zara Zhang 关于“slop”来自缺少具体经验，而不只是来自 AI authorship 的观察，强化了上层要求；Anthropic 的 quality postmortem 则说明下层同样关键：即使底层 API 与 inference layer 没有退化，reasoning effort、session handling 和 prompts 的变化也可能降低产品质量。

For the broader industry, recursive improvement increases the consequences of getting the control layer wrong. DeepCogito raised $43 million around large-scale reinforcement learning and iterated distillation and amplification, while Ryan Greenblatt argued society should prepare for AI to automate most AI R&D around the start of 2029. That timeline is his scenario, not an established fact, but it explains why cyber defense, model security, precise permissions, monitoring, and coordination appeared beside product launches throughout the week.

对更广泛的 industry 而言，recursive improvement 会放大 control layer 出错的后果。DeepCogito 围绕 large-scale reinforcement learning 与 iterated distillation and amplification 融资 4,300 万美元；Ryan Greenblatt 则主张社会应为 AI 在 2029 年初左右自动化大部分 AI R&D 做准备。这个时间点是他的 scenario，并非既定事实，但它解释了为什么 cyber defense、model security、precise permissions、monitoring 与 coordination 会在本周反复与产品发布同时出现。

Analysis: Watch whether the announced November 12 end of OpenAI model distribution through Cursor produces visible movement toward bring-your-own-key access, multi-model routers, or Replit's transition offer. The immediate strategic test is whether developers value a familiar interface more than direct control over model routing and vendor relationships.

分析： 关注 OpenAI 宣布将在 11 月 12 日停止通过 Cursor 分发 models 后，市场是否会明显转向 bring-your-own-key、multi-model routers，或 Replit 的 transition offer。最直接的战略测试是：developers 更重视熟悉的 interface，还是更重视对 model routing 与 vendor relationships 的直接控制。

Analysis: Watch for security claims to become operational metrics: prompt-injection success rates, permission-prompt reduction, credential exposure, recovery time, and the blast radius of a compromised agent. Anthropic's containment report provides concrete measures that other agent vendors may now be compared against.

分析： 关注 security claims 是否会变成 operational metrics：prompt-injection success rates、permission-prompt reduction、credential exposure、recovery time，以及 compromised agent 的 blast radius。Anthropic 的 containment report 给出了具体衡量方式，其他 agent vendors 可能会开始被放在同一标准下比较。

Analysis: Watch usage economics rather than list prices alone. OpenAI's five-hour windows, Sol's price-driven growth through Vercel's gateway, and Kothari's subsidy forecast point in different directions; the meaningful signal will be effective cost per reliable, completed task after resets, routing, and sandbox overhead.

分析： 关注 usage economics，而不只是 list prices。OpenAI 的五小时窗口、Sol 在 Vercel gateway 上由降价推动的增长，以及 Kothari 关于补贴难以持续的 forecast 指向不同方向；真正有意义的信号，将是计入 resets、routing 与 sandbox overhead 后，每个可靠完成任务的有效成本。

Analysis: Watch whether browser agents expand from demonstrations into repeatable transactions while keeping authentication separate from model context. Adoption will depend on whether scoped credentials, isolated sessions, and automatic-action classifiers remain legible enough for ordinary users to trust.

分析： 关注 browser agents 是否会从 demonstrations 走向可重复 transactions，同时继续让 authentication 与 model context 分离。能否获得 adoption，将取决于 scoped credentials、isolated sessions 与 automatic-action classifiers 是否足够清晰，让普通用户愿意信任。