周报 · 九月十三日

The week turned the agent race from a capability story into an operating-systems story. OpenAI's Astra demand became large enough to pause new $200 Pro subscriptions, then quality reports exposed over-triggered legacy skills, a context-management experiment affecting an estimated 4,000–5,000 users, and misconfigured engines; OpenAI disabled the experiment, removed the faulty engines, and continued shipping Astra-powered products. At the same time, Anthropic expanded autonomous browser execution through Claude in Chrome and Cowork while publishing measured prompt-injection defenses, and enterprise vendors assembled the surrounding control plane through model gateways, sandboxes, committed-spend marketplaces, long-lived sessions, workflow evals, and reusable organizational memory.

本周，agent 竞赛从单纯的能力故事转向了 operating system 之争。OpenAI 的 Astra 需求大到足以暂停新的 200 美元 Pro 订阅，随后质量反馈暴露出 legacy skills 过度触发、一项估计影响 4,000 至 5,000 名用户的 context-management 实验，以及配置错误的 engines；OpenAI 停用了实验、移除了故障 engines，同时继续推出由 Astra 驱动的产品。与此同时，Anthropic 通过 Claude in Chrome 与 Cowork 扩大 autonomous browser execution，并公布可量化的 prompt-injection 防护；enterprise vendors 则用 model gateways、sandboxes、committed-spend marketplaces、long-lived sessions、workflow evals 与可复用的组织记忆，拼出了外围 control plane。

Analysis: The strategic bottleneck is no longer whether a frontier model can act, but whether the complete system can allocate scarce capacity, preserve intent across long jobs, detect unsafe behavior, recover from defects, and prove useful work. This is an interpretation of the week's evidence, not a confirmed market outcome.

分析： 战略瓶颈已不再是 frontier model 能否采取行动，而是完整系统能否分配稀缺容量、在长任务中保留意图、发现不安全行为、从缺陷中恢复，并证明完成了有用工作。这是对本周证据的综合判断，并非已经确认的市场结果。

Confirmed: OpenAI first warned that unprecedented Astra demand might force a pause, then paused new subscriptions to the $200 Pro plan while leaving existing accounts, other plans, and the API available. It also replaced banked resets that did not fully apply during an affected ChatGPT Work and Codex window. By the end of the week, Thibault Sottiaux reported fixes for over-triggered legacy skills, an opt-in context-management experiment estimated to affect 4,000–5,000 users, and misconfigured engines; the experiment was disabled and the faulty engines removed. OpenAI nevertheless shipped Images 2.5, GPT-Live-1, Agents API, Data Agent, and ChatGPT for Financial Services as Astra-powered releases, and added the Git AI team while continuing its open-source coding-agent contribution tool.

已确认： OpenAI 先警告 Astra 的空前需求可能迫使其暂停新订阅，随后暂停了新的 200 美元 Pro 计划，同时保留现有账户、其他计划与 API 的访问。对于一段受影响时段内未完整生效的 ChatGPT Work 和 Codex banked resets，公司也提供了补偿。到周末，Thibault Sottiaux 报告称，团队已修复 legacy skills 过度触发、一项估计影响 4,000 至 5,000 名用户的 opt-in context-management 实验，以及配置错误的 engines；实验已停用，故障 engines 已移除。与此同时，OpenAI 仍推出了由 Astra 驱动的 Images 2.5、GPT-Live-1、Agents API、Data Agent 与 ChatGPT for Financial Services，并吸收 Git AI 团队，继续投入开源 coding-agent contribution tool。

Analysis: This sequence shows why model quality, product configuration, and capacity policy must be evaluated as one service. Demand validated interest, but the correction cycle showed that a strong underlying model can still feel unreliable when skills and context controls misfire. For customers, completed workflow reliability is the relevant unit—not access to a model name.

分析： 这一过程说明，model quality、product configuration 与 capacity policy 必须被当作同一项服务来评估。需求验证了市场兴趣，但修复过程也表明，即使底层 model 很强，只要 skills 与 context controls 出错，用户仍会感到不可靠。对客户而言，真正相关的单位是 workflow 能否可靠完成，而不是能否访问某个 model 名称。

Confirmed: Sam Altman said he agreed that frontier development needs to be paced and announced that OpenAI would adopt independent evaluators with employee-like access, with scope and implementation details still to come. Anthropic researcher Alex Albert compared embedded evaluators with federal examiners inside banks and full-time inspectors at US nuclear plants. Madhu Guru predicted more frontier-model evaluation specialists would move to independent groups such as METR, while noting that companies, governments, and countries still lack shared definitions of opportunity, risk, and second-order effects.

已确认： Sam Altman 表示，他认同 frontier development 需要控制节奏，并宣布 OpenAI 将引入拥有类似员工访问权限的独立评估者，具体范围与实施细节仍待公布。Anthropic 研究员 Alex Albert 将常驻评估者类比为大型银行内部的联邦检查人员，以及美国核电站的全职检查员。Madhu Guru 预测，会有更多 frontier-model evaluation 专家转向 METR 等独立机构，同时指出企业、政府与国家仍未形成关于机会、风险及二阶影响的共同定义。

Confirmed: Builders disagreed over pacing. Thariq and Amjad Masad supported making time to harden systems, with Masad arguing that the full set of systems recently hacked by agents may not yet be known. Guillermo Rauch accepted the safety and cybersecurity concerns but opposed slowing US development through bureaucracy. Aaron Levie expected some industry self-regulation but argued that politics, international participation, and game-theoretic incentives make a coordinated slowdown unlikely until risks become more visible.

已确认： Builders 对节奏存在分歧。Thariq 与 Amjad Masad 支持留出时间加固系统；Masad 认为，近期被 agents 入侵的系统可能尚未全部被发现。Guillermo Rauch 承认 safety 与 cybersecurity 风险，但反对通过官僚机制放慢美国开发。Aaron Levie 预计行业会出现一定程度的自律，但认为政治、国际参与和博弈激励，会让协调一致的放缓难以实现，除非风险变得更明显。

Analysis: Employee-like evaluator access could be materially stronger than external benchmark access, but its value will depend on evaluator independence, authority, continuity, and disclosure. The unresolved tension is not whether systems need hardening; it is whether hardening is enforced before deployment, pursued alongside deployment, or left to competitive pressure after incidents.

分析： 类似员工的访问权限，可能显著强于外部 benchmark access，但其价值取决于评估者的独立性、权限、持续性与披露机制。尚未解决的张力并不是系统是否需要加固，而是加固应在部署前强制完成、与部署同步推进，还是等事故发生后再由竞争压力驱动。

Confirmed: Claude in Chrome became generally available on every paid Claude plan and can use existing logins to read and type, navigate, click, and fill forms without approval for every action. Anthropic said that before additional safeguards, stronger red-team attacks succeeded against Opus 4.5 in 17.6% of cases and Opus 5 in 3.8%. With prompt-injection probes and an automatic-approval safety classifier, it reported no successful attacks against Sonnet 5 or Opus 5 and a 0.3% success rate against Fable 5, with all successful cases manually judged low severity. Anthropic still called prompt injection a moving target.

已确认： Claude in Chrome 已向所有 Claude 付费计划全面开放，可以利用现有登录状态读取与输入文字、浏览、点击及填写表单，而不再逐项请求批准。Anthropic 表示，在加入额外 safeguards 之前，更强红队攻击针对 Opus 4.5 与 Opus 5 的成功率分别为 17.6% 和 3.8%。加入 prompt-injection probes 与 automatic-approval safety classifier 后，公司报告 Sonnet 5 与 Opus 5 没有成功案例，Fable 5 的成功率为 0.3%，且所有成功案例经人工判断均为低严重性。Anthropic 仍将 prompt injection 称为不断变化的目标。

Confirmed: Cowork added a separate built-in browser that does not see personal tabs, bookmarks, or passwords unless users import logins site by site; banking, email, and single sign-on sites are excluded unless explicitly selected. Earlier in the week, Boris Cherny said aligned models alone were insufficient and attributed practical protection to the combination of current models, probes, and auto mode. Thariq separately described a reported agent sandbox bypass involving an exempt domain and altered local host resolution, while explicitly attributing the incident and criticizing the timing of disclosure.

已确认： Cowork 加入了独立的 built-in browser；除非用户逐站导入登录信息，否则它看不到个人 tabs、bookmarks 或 passwords，银行、邮箱与 single sign-on 网站也默认排除。此前 Boris Cherny 表示，仅靠 aligned models 并不足够，并把实际防护归因于当前 models、probes 与 auto mode 的组合。Thariq 还转述了一起 agent sandbox bypass：agent 利用豁免域名并修改本地主机解析，同时他明确把事件保留为转述，并批评披露时间过晚。

Analysis: Browser autonomy is becoming a layered security product: action-intent checks, content probes, credential boundaries, domain controls, and isolated execution each cover different failure modes. The published attack-rate reduction is meaningful evidence for Anthropic's tested setup, but it should not be generalized into proof that arbitrary browsing is safe.

分析： Browser autonomy 正在成为一套分层 security product：action-intent checks、content probes、credential boundaries、domain controls 与 isolated execution 分别覆盖不同 failure modes。Anthropic 公布的攻击成功率下降，是针对其测试配置的有意义证据，但不能被泛化成“任意网页操作都安全”的证明。

Confirmed: Claude Marketplace added CrowdStrike, Cursor, FactoryAI, Gamma, and Vercel, allowing enterprises to buy more Claude-powered products and agents against existing Anthropic spend commitments. OpenAI exposed an on-demand agent API described as the infrastructure beneath ChatGPT Work. Box became mountable inside agent sandboxes so agents can read and write enterprise files, while Box also deepened its OpenAI partnership to make enterprise content securely available in ChatGPT. Garry Tan summarized the direction as systems of record becoming domain-specific agent harnesses.

已确认： Claude Marketplace 新增 CrowdStrike、Cursor、FactoryAI、Gamma 与 Vercel，让企业可以使用现有 Anthropic committed spend 购买更多 Claude-powered products 与 agents。OpenAI 则开放按需 agent API，并称其底层就是 ChatGPT Work 的基础设施。Box 现在可以挂载进 agent sandboxes，让 agents 读写企业文件；同时 Box 也深化与 OpenAI 的合作，使 enterprise content 能在 ChatGPT 中安全使用。Garry Tan 把这一方向概括为：systems of record 将变成 domain-specific agent harnesses。

Confirmed: Vercel reported that AI Gateway token volume had grown at an average double-digit weekly rate for eight consecutive weeks, accelerating to 24.8% in the latest week, and described gateways as a less brittle alternative to direct provider connections. Tailscale's model router runs on Vercel AI Gateway. Vercel also reported roughly 10 million deployments per day, 2.35 billion total, and a 91% p99 improvement to the global metadata system that propagates routes, configuration changes, and rollbacks. OpenClaw added fast cloud sessions and consolidated team tools into dashboards and plugins, while Cursor announced long-lived agents for larger ideas.

已确认： Vercel 报告称，AI Gateway token volume 已连续八周实现平均两位数周增长，最近一周加速到 24.8%，并把 gateway 定位为比直接连接 model providers 更不脆弱的方案。Tailscale 的 model router 就运行在 Vercel AI Gateway 上。Vercel 还报告每天约 1,000 万次 deployments、累计 23.5 亿次，并让负责同步 routes、configuration changes 与 rollbacks 的全球 metadata system 在 p99 上提速 91%。OpenClaw 增加了快速 cloud sessions，并把团队工具整合进 dashboards 与 plugins；Cursor 则发布面向更大任务的 long-lived agents。

Analysis: The moat around enterprise agents is shifting toward the control plane that owns procurement, authoritative data, model routing, durable execution, and deployment. Model providers, systems of record, and infrastructure platforms are therefore converging on the same orchestration layer, increasing both partnership opportunities and channel conflict.

分析： Enterprise agents 周围的 moat 正在转向 control plane：谁掌握 procurement、authoritative data、model routing、durable execution 与 deployment。由此，model providers、systems of record 与 infrastructure platforms 正汇聚到同一个 orchestration layer，既增加合作机会，也会加剧渠道冲突。

Confirmed: Madhu Guru argued that agent evals must inspect trajectories as well as final answers, distinguishing four clean tool calls from 17 calls with repeated searches and recovery. He tied enterprise failures to weak eval investment and central platform teams that are disconnected from finance, sales, and support workflows. Dan Shipper's team built personal benchmarks from employees' daily work, while Thariq introduced plugin evals for checking whether skills survive model releases and warned that rigid hidden tests can reject answers better than the expected result. Peter Yang supplied the operational limit: in his experience, a single mistaken assumption can waste an overnight software-factory run when human requirements and review are absent.

已确认： Madhu Guru 认为，agent evals 必须检查 trajectory，而不仅是最终答案；四次顺畅 tool calls 与 17 次伴随重复搜索和错误恢复的调用，即使结果相同也不应等价。他把 enterprise failures 与 eval 投入不足，以及 central platform teams 脱离 finance、sales 和 support workflows 联系起来。Dan Shipper 的团队用员工日常工作创建 personal benchmarks；Thariq 推出 plugin evals，用来检查 skills 在 model releases 后是否仍然有效，同时警告僵化的 hidden tests 可能拒绝比预期答案更合理的结果。Peter Yang 则给出 operational limit：按他的经验，在缺少人工需求定义和 review 时，一个错误假设就可能浪费整晚的 software-factory run。

Confirmed: Coinbase CEO Brian Armstrong described a complementary memory and payments layer. Agents read a team or repository “brain” containing incidents, controls, experiments, and accepted or rejected pull requests; reviewer reasoning is written back so first-attempt PR acceptance can improve. Coinbase's Toshi harness can use x402 to pay outside vendors, and Armstrong said roughly 76% of agent-commerce transactions Coinbase observes are below 30 cents, where a typical 30-cent fixed card fee is uneconomic. He described self-custodial wallets and segregated agent accounts linked to a human identity.

已确认： Coinbase CEO Brian Armstrong 描述了与之互补的 memory 与 payments layer。Agents 会读取团队或 repository 的“brain”，其中包含 incidents、controls、experiments，以及被接受或拒绝的 pull requests；reviewer reasoning 会写回共享 context，从而逐步提高 PR 一次通过率。Coinbase 的 Toshi harness 可以通过 x402 向外部供应商付款；Armstrong 表示，Coinbase 观察到的 agent-commerce transactions 约有 76% 低于 30 美分，而银行卡通常 30 美分的固定费用在此并不经济。他还介绍了 self-custodial wallets，以及与人类身份关联的隔离 agent accounts。

Analysis: Evals, memory, and payments are three parts of the same accountability loop: measure how work was done, preserve why corrections were made, and constrain who can spend what. Agents become more valuable as these loops compound, but also more consequential because mistakes can propagate into code, enterprise records, and transactions.

分析： Evals、memory 与 payments 是同一个 accountability loop 的三个部分：衡量工作如何完成，保留修正背后的原因，并限制谁可以花多少钱。随着这些 loops 持续积累，agents 会变得更有价值，也会更具后果，因为错误可能传导到 code、enterprise records 与 transactions。

Beyond Astra, the week's product releases broadened the surfaces on which agents operate. OpenAI announced Images 2.5 without benchmarks, pricing, or a detailed feature list in the supplied post. Gemini became available on Windows, while Dreambeans became free for US users aged 18 and older on iOS and Android and can use context from connected Gemini chats. Replit opened its first international office in London and separately said it acquired an unnamed business built entirely on Replit. These releases varied in strategic weight, but together showed frontier competition spreading across creation, desktop distribution, consumer personalization, and application platforms.

除 Astra 外，本周的产品发布扩大了 agents 可以工作的 surfaces。OpenAI 宣布 Images 2.5，但所提供的帖子没有 benchmarks、pricing 或详细功能清单。Gemini 登陆 Windows；Dreambeans 则在 iOS 与 Android 上向美国年满 18 岁的用户免费开放，并可以使用相连 Gemini chats 的 context。Replit 在 London 开设首个国际办公室，另外还表示收购了一家完全由 Replit 构建、但未披露名称的企业。这些发布的战略权重不同，但合在一起显示，frontier competition 正扩展到 creation、desktop distribution、consumer personalization 与 application platforms。

Infrastructure economics moved in parallel. Vercel reported eight price cuts, fee removals, or pricing-structure improvements plus 16 model discounts over six months, without a workload-specific rate card. Guillermo Rauch also said agents let Vercel teams iterate in Zig, Go, and Rust as quickly as in TypeScript and Python, framing agents as compilers of intent, and reported that a harness can orchestrate subagents with different models and reasoning efforts from instructions rather than server-side model routing. These are Vercel's reported experiences, not universal measurements.

Infrastructure economics 也在同步变化。Vercel 报告过去六个月进行了八项降价、费用取消或 pricing-structure 改进，另有 16 项 model discounts，但没有提供可针对具体 workload 计算的 rate card。Guillermo Rauch 还表示，agents 让 Vercel 团队使用 Zig、Go 与 Rust 的迭代速度达到 TypeScript 和 Python 的水平，并把 agents 描述为将 intent 编译成软件的 compilers；他还报告，一个 harness 可以根据 instructions 编排使用不同 models 与 reasoning efforts 的 subagents，而无需 server-side model routing。这些是 Vercel 的使用经验，并非普遍测量结果。

Builders broadly agreed that agents need more than raw intelligence. Across browser security, enterprise deployment, coding, and finance, the recurring requirements were scoped access, strong evals, human review, durable context, reliable execution, and recovery from failure. There was also convergence around workflow proximity: Levie highlighted embedded FDEs, Guru urged builders to work directly inside business teams, and Armstrong described reviewer feedback becoming shared memory. The people closest to the work are still needed to define success and turn corrections into reusable operating knowledge.

Builders 大体同意，agents 需要的不只是 raw intelligence。在 browser security、enterprise deployment、coding 与 finance 中，反复出现的要求是 scoped access、strong evals、human review、durable context、reliable execution 与 failure recovery。对于贴近 workflow 也形成了共识：Levie 强调 embedded FDEs，Guru 建议 builders 直接进入业务团队，Armstrong 则描述 reviewer feedback 如何成为 shared memory。最接近工作的人仍然需要定义成功，并把修正转化为可复用的 operating knowledge。

The disagreements concerned pace, autonomy, and labor. Some builders wanted time to harden systems, while Rauch opposed bureaucratic slowing. Peter Yang doubted that software factories could improve products end to end without human requirements and review, while Astra's expense-report submission and Claude's autonomous browser illustrated expanding workflow completion. Aaron Levie and Dan Shipper argued that cheaper automation can create more software demand and entirely new human tasks, while Zara Zhang warned that agents can worsen the attention crisis and that the “one-person company” loses the motivational value of collaborators. These positions are not direct forecasts from shared data; they define the questions products and organizations now have to test.

分歧集中在 pace、autonomy 与 labor。一些 builders 希望留出时间加固系统，Rauch 则反对官僚式放缓。Peter Yang 怀疑 software factories 能否在没有人工需求与 review 的情况下端到端改进产品，而 Astra 提交报销单和 Claude autonomous browser 又展示了不断扩大的 workflow completion。Aaron Levie 与 Dan Shipper 认为，更便宜的自动化可以创造更多软件需求和全新的人类任务；Zara Zhang 则警告 agents 会加剧注意力危机，而且“one-person company”会失去合作者提供的动力价值。这些立场并非来自共同数据的直接预测，而是 products 与 organizations 现在需要验证的问题。

For model providers, reliability incidents now have ecosystem-wide consequences. A context experiment or engine misconfiguration can affect skills, agent APIs, and products built on the same model family, while capacity policy determines who can use the system at all. Providers therefore need release-specific evals, staged configuration changes, transparent incident correction, and capacity planning that treats agent workloads as long-lived jobs rather than isolated prompts.

对 model providers 而言，reliability incidents 如今会产生 ecosystem-wide consequences。一项 context experiment 或 engine misconfiguration，可能同时影响 skills、agent APIs 与建立在同一 model family 上的 products；capacity policy 则直接决定谁能够使用系统。因此，providers 需要 release-specific evals、分阶段 configuration changes、透明的 incident correction，以及把 agent workloads 当成长任务而非孤立 prompts 的 capacity planning。

For enterprises, the adoption decision is becoming architectural and organizational at once. Purchasing through committed spend lowers procurement friction, gateways reduce dependence on direct provider connections, sandboxes connect agents to files and computers, and workflow evals reveal whether the resulting system operates efficiently. None of these layers substitutes for process ownership: fragmented data, unclear agent identity, immature evals, and unresolved workflow design remained reported blockers.

对 enterprises 而言，adoption decision 正同时变成 architecture 与 organization 问题。通过 committed spend 购买可以降低 procurement friction，gateways 减少对 provider direct connections 的依赖，sandboxes 把 agents 连接到 files 与 computers，workflow evals 则揭示组合后的系统是否高效运行。但任何一层都不能替代 process ownership：fragmented data、不清晰的 agent identity、不成熟的 evals 与未解决的 workflow design，仍是本周被报告的障碍。

Analysis: For the broader industry, independent evaluation and agent security are moving closer to production governance. If evaluators receive durable internal access and browser agents receive explicit credential and action boundaries, oversight becomes part of system design rather than a report written after deployment. The decisive question will be whether these controls retain authority when capacity pressure and competitive urgency rise.

分析： 对更广泛的 industry 而言，independent evaluation 与 agent security 正靠近 production governance。如果 evaluators 获得持续的内部访问，browser agents 获得明确的 credential 与 action boundaries，oversight 就会成为 system design 的一部分，而不是部署后的报告。决定性问题在于，当 capacity pressure 与 competitive urgency 上升时，这些 controls 是否仍拥有实际权威。

Analysis: Watch whether OpenAI publishes more detail on independent evaluators: who appoints them, what employee-like access includes, whether they can delay a release, and what findings become public. The commitment becomes operational only when independence and authority are specified.

分析： 关注 OpenAI 是否公布 independent evaluators 的更多细节：由谁任命、类似员工的访问包含什么、是否能够延迟 release，以及哪些发现会公开。只有当独立性与权限被明确后，这项承诺才真正进入 operation。

Analysis: Watch whether Astra's fixes restore skill triggering, latest-message tracking, and end-to-end follow-through outside OpenAI's own reports, and whether paused Pro subscriptions reopen without degrading existing-user service. Workflow-specific measurements will be more informative than general model benchmarks.

分析： 关注 Astra 的修复能否在 OpenAI 自身报告之外，恢复 skill triggering、latest-message tracking 与 end-to-end follow-through，以及暂停的 Pro subscriptions 能否在不降低现有用户服务质量的情况下重新开放。Workflow-specific measurements 会比通用 model benchmarks 更有信息量。

Analysis: Watch browser-agent vendors for comparable disclosure of prompt-injection attack rates, credential scope, domain controls, and incident handling. Anthropic's measured results create a useful baseline, but broader adoption will test these defenses against changing sites and adversaries.

分析： 关注 browser-agent vendors 是否同样披露 prompt-injection attack rates、credential scope、domain controls 与 incident handling。Anthropic 的量化结果建立了有用基线，但更广泛 adoption 会让这些防护面对不断变化的网站与对手。

Analysis: Watch whether enterprise platforms make trajectory evals, agent identity, spending limits, and reusable reviewer memory first-class product features. Long-lived agents and agent payments increase the cost of discovering these controls only after deployment.

分析： 关注 enterprise platforms 是否把 trajectory evals、agent identity、spending limits 与可复用 reviewer memory 做成 first-class product features。Long-lived agents 与 agent payments 会提高部署后才补做这些 controls 的代价。