周报 · 九月二十日

The week’s most consequential shift was from isolated agent sessions toward persistent systems of work. Anthropic merged Claude chat and Cowork, brought Docs, Slides, and Design into conversations, and introduced Projects that share evolving memory, coordinate parallel threads, and keep running in the cloud. Around that product layer, builders converged on a supporting architecture: durable session logs, replaceable harnesses, disposable sandboxes, operation-specific tools, reusable skills, fast evaluators, and explicit access controls. The result is a clearer industry direction: models are becoming components inside long-lived operating environments rather than destinations that users visit for one prompt at a time.

本周最重要的变化，是 agent 从孤立 session 走向持久化工作系统。Anthropic 合并了 Claude chat 与 Cowork，把 Docs、Slides 和 Design 带入对话，并推出共享动态 memory、协调并行 threads、可在云端持续运行的 Projects。在产品层之外，builders 也逐渐汇聚到一套配套架构：持久 session logs、可替换 harnesses、一次性 sandboxes、与操作匹配的专用工具、可复用 skills、快速 evaluators，以及明确的访问控制。行业方向因此更清晰：models 正从用户一次输入一个 prompt 的目的地，变成长周期 operating environments 中的组件。

Analysis: Persistence raises both utility and consequence. A system that remembers preferences, schedules work, accesses business data, and acts while its user is offline can compound value across days, but an error or excessive permission can also propagate farther than it would in a single chat. This is an interpretation of the week’s evidence, not a confirmed market outcome.

分析： 持久性同时提高了效用与后果。一个能够记住偏好、安排工作、访问业务数据，并在用户离线时继续行动的系统，可以跨天积累价值；但错误或权限过宽，也会比单次对话传播得更远。这是对本周证据的综合判断，并非已确认的市场结果。

Confirmed: Anthropic began merging Claude chat and Cowork into one experience that chooses between a quick answer and deeper agentic work. Claude Docs and Claude Slides launched in beta on paid plans, while Claude Design moved into conversations; users can edit, comment, present, export to PowerPoint or PDF, and schedule recurring work. Projects then extended the model from a unified interface to a persistent workspace: threads share evolving memory and a file library, continue in the cloud while a computer is offline, and can be coordinated through a project-level agent that launches subagents. Local files, local tools, and internal networks were not yet available to those cloud threads.

已确认： Anthropic 开始把 Claude chat 与 Cowork 合并成同一体验，由系统在快速回答与更深入的 agent 工作之间做选择。Claude Docs 与 Claude Slides 面向付费计划推出 beta，Claude Design 也进入对话；用户可以编辑、评论、演示、导出 PowerPoint 或 PDF，并安排重复任务。随后 Projects 让统一界面进一步变成持久 workspace：threads 共享持续更新的 memory 与文件库，电脑离线后仍可在云端继续执行，还能由 project-level agent 统一协调并启动 subagents。这些云端 threads 当时尚不能访问本地文件、本地工具或内部网络。

Analysis: The unit of competition is expanding from the assistant response to the workspace that owns context, artifacts, scheduling, and task coordination. That favors products able to preserve state and expose safe execution boundaries, while reducing the importance of manually organizing individual chats.

分析： 竞争单位正在从 assistant response 扩展为掌握 context、artifacts、scheduling 与任务协调的 workspace。这会让能够保存状态并提供安全执行边界的产品更有优势，也会降低用户手动整理单个 chats 的重要性。

Confirmed: Dan Shipper reported that a foundation model returning probabilities rather than words completed judging tasks 25 times faster and at 600 times lower price than a Fable-level model in his team’s tests, although the supplied post did not include a detailed benchmark. Vercel reported that Jev was up to 18 times faster at p95 than GPT Luna and more accurate in its results for command safety review. Aaron Levie demonstrated Jev classifying incident severity and routing reports, while Nikunj Kothari reported scoring 3,000 snacks against multiple criteria in 28 seconds for $0.11. Levie also identified classification, routing, domain decisions, and safety judgments as uses for fast, inexpensive models inside enterprise workflows.

已确认： Dan Shipper 表示，一种输出概率而非文字的 foundation model，在其团队测试的判断任务中，比 Fable 级 model 快 25 倍、价格低 600 倍，但所提供的帖子没有详细 benchmark。Vercel 报告称，在命令安全审查中，Jev 的 p95 延迟最高比 GPT Luna 快 18 倍，准确率也更高。Aaron Levie 演示了 Jev 判断事故严重性并分流报告；Nikunj Kothari 则报告，Jev 用 28 秒、0.11 美元按多项标准评估了 3,000 种零食。Levie 还把分类、路由、领域决策与安全判断列为快速低价 models 在 enterprise workflows 中的用途。

Analysis: If these reported economics generalize, evaluation can move from occasional testing into the execution path of nearly every agent action. That could make high-volume automation safer and more selective, but it also makes the quality of narrow judges—and the policies encoded in them—a new source of systemic risk.

分析： 如果这些成本与速度数据能够推广，evaluation 就可能从偶尔测试进入几乎每次 agent action 的执行路径。这可以让大规模自动化更安全、更有选择性，但 narrow judges 的质量，以及其中编码的 policy，也会成为新的系统性风险来源。

Confirmed: Anthropic described Managed Agents as three independently replaceable layers: an append-only session log, a harness that calls Claude and routes tools, and disposable sandboxes that execute code and edit files. Provisioning a sandbox only when a tool call required one reduced median time to first token by roughly 60% and p95 by more than 90%. Its product-containment review described ephemeral gVisor containers for claude.ai, an operating-system sandbox for Claude Code, and a local VM for Claude Cowork. It also disclosed an incident in which a malicious file used an attacker-controlled API key to exfiltrate workspace files through an allowed Anthropic domain; the fix validated the VM’s provisioned session token through an intercepting proxy.

已确认： Anthropic 把 Managed Agents 拆成三个可独立替换的层：仅追加的 session log、负责调用 Claude 与分发工具的 harness，以及执行代码和修改文件的一次性 sandboxes。只在 tool call 确实需要时才启动 sandbox，使首 token 时间的中位数下降约 60%，p95 下降超过 90%。其产品隔离复盘还介绍了 claude.ai 的临时 gVisor containers、Claude Code 的操作系统级 sandbox，以及 Claude Cowork 的本地 VM。文章也披露了一起事故：恶意文件利用攻击者控制的 API key，通过允许访问的 Anthropic 域名外传 workspace 文件；修复方案是在拦截代理中验证 VM 专属的 session token。

Confirmed: Builders reached a related conclusion about tools. Thariq argued that MCP is now preferable to CLI for most integrations because tool calling improved, tools can be deferred, and MCP is stateless; he later recommended operation-specific APIs for data access while retaining bash and sandboxes for code generation and execution. Guillermo Rauch framed proof-checkers, compilers, type systems, linters, verifiers, and skills as the framework around agents.

已确认： Builders 在工具设计上也得出相近结论。Thariq 认为，随着 tool calling 改善、工具可以延迟加载、MCP 变为无状态，MCP 对大多数集成已优于 CLI；随后他又建议，为数据访问提供与操作直接匹配的 API，同时把 bash 与 sandboxes 保留给代码生成和执行。Guillermo Rauch 则把 proof-checkers、compilers、type systems、linters、verifiers 与 skills 视为 agent 周围的新框架。

Analysis: This architecture treats failures as expected operational events rather than exceptional model mistakes. Durable state permits recovery; disposable execution limits blast radius; typed tools narrow authority; and external verifiers check outcomes. The strategic advantage may therefore sit in the interfaces between these layers as much as in the model itself.

分析： 这套架构把失败视为预期中的运营事件，而不是偶发的 model mistake。持久状态支持恢复，一次性执行环境限制 blast radius，typed tools 缩小权限，外部 verifiers 检查结果。因此，战略优势可能既存在于 model 本身，也存在于这些层之间的接口。

Confirmed: Salesforce in Claude entered beta with access to accounts, opportunities, and pipeline data plus 37 pre-built sales skills. Claude for Small Business added 43 workflows and 27 integrations across services including Shopify, Salesforce, Atlassian, Zoom, Xero, Gusto, Square, Stripe, and Zapier; Anthropic said the product had been installed more than 900,000 times since its May launch. Aaron Levie argued that stronger models increase the importance of the applied layer because organizations still need connected data, redesigned processes, human review, domain-specific evaluation, security, and governance. He separately warned that continuous agent workflows could produce 100 times the information volume of a traditional user-requested session, making document classification, anomaly detection, alerts, and blocking central controls.

已确认： Salesforce in Claude 进入 beta，可访问 accounts、opportunities 与 pipeline data，并提供 37 项预设 sales skills。Claude for Small Business 新增 43 个 workflows 与 27 项 integrations，覆盖 Shopify、Salesforce、Atlassian、Zoom、Xero、Gusto、Square、Stripe 和 Zapier 等服务；Anthropic 表示，该产品自 5 月推出以来安装量已超过 90 万次。Aaron Levie 认为，更强的 models 会让应用层更加重要，因为企业仍需要连接数据、重设计流程、引入人工审核、开展领域评测，并处理安全与治理。他还警告，持续运行的 agent workflows 可能产生传统单次用户请求 100 倍的信息量，因此文档分类、异常检测、告警与阻断会成为核心控制。

Analysis: Enterprise adoption is no longer mainly a chatbot rollout. It is a process redesign in which agents sit beside systems of record, continuously read and write operational data, and require policy enforcement at the object and action level. Vendors that control authoritative context can gain distribution, but they also inherit responsibility for permissions and auditability.

分析： Enterprise adoption 已不再主要是部署 chatbot，而是一场流程重设计：agents 位于 systems of record 旁边，持续读写运营数据，并需要在 object 与 action 层执行 policy。掌握 authoritative context 的 vendors 可以获得分发优势，但也会同时承担权限管理与可审计性的责任。

Confirmed: Guillermo Rauch reported that open models generated 78.4% of token volume on Vercel AI Gateway, versus 21.6% for closed models. By spend, Moonshot AI and DeepSeek ranked third and fourth, and together with Z.ai exceeded second-place OpenAI; Rauch cautioned that this measured inference-provider spending, primarily in the United States, rather than revenue paid directly to open-weight labs. He also argued that hiding model choice prevents customers from learning which model works best for each job. Separately, Claude Code 2.1.277 added `AGENTS.md` discovery through a built-in mod, and Boris Cherny said community-built Claude Mods were beginning to land.

已确认： Guillermo Rauch 报告，open models 占 Vercel AI Gateway token 用量的 78.4%，closed models 占 21.6%。按支出计算，Moonshot AI 与 DeepSeek 排名第三、第四，加上 Z.ai 后超过排名第二的 OpenAI；Rauch 提醒，这项数据衡量的是主要发生在美国的 inference-provider 支出，并不等于直接流向 open-weight labs 的收入。他还认为，隐藏 model choice 会妨碍客户理解每项任务最适合哪个 model。与此同时，Claude Code 2.1.277 通过内置 mod 增加了对 `AGENTS.md` 的发现与读取，Boris Cherny 也表示，社区构建的 Claude Mods 已开始出现。

Analysis: Model plurality and customizable instruction layers weaken the assumption that one provider should own an entire workflow. Gateways, mods, portable project instructions, and operation-specific tools make substitution easier; differentiation shifts toward orchestration quality, distribution, and accumulated workflow context.

分析： 多模型选择与可定制 instruction layers 正在削弱“一家 provider 应掌握完整 workflow”的假设。Gateways、mods、可移植的项目指令，以及 operation-specific tools 会降低替换难度；差异化因此转向编排质量、分发能力与不断积累的 workflow context。

The week’s infrastructure signals pointed toward much larger background workloads. Aaron Levie predicted that agents could represent nearly all inference within one or two years and said they already represented the majority, though his post supplied no measurement. Vercel reported one billion deployments over its first ten years and another 1.4 billion in the following ten months, and said a globally propagated deployment could now retain CDN, firewall, observability, and rollback capabilities while completing in one second. Peter Steinberger reported roughly 80% faster worktrees through folder clones on APFS, Btrfs, XFS, and ReFS, without naming the product or benchmark method. Together, these claims describe pressure for cheaper inference, faster environments, and deployment systems designed for machine-generated software volume.

本周的 infrastructure 信号指向规模大得多的后台 workloads。Aaron Levie 预测，agents 可能在一到两年内占据几乎全部 inference，并称目前已超过一半，但帖子没有提供测量数据。Vercel 报告，前十年累计十亿次 deployments，随后十个月又增加 14 亿次，并表示一次带有 CDN、firewall、observability 与 rollback 能力的全球部署现可在一秒内完成。Peter Steinberger 报告称，通过 APFS、Btrfs、XFS 与 ReFS 的文件夹克隆，worktrees 可提速约 80%，但没有说明产品名称或 benchmark 方法。综合来看，这些说法描绘了同一压力：更便宜的 inference、更快的执行环境，以及面向机器生成软件规模的 deployment systems。

Consumer products also began testing agent-mediated coordination and transactions. Google Labs updated its CC family agent to support up to five members, shared morning email, and synchronized Calendar and Tasks. Peter Yang reported that Meta’s Muse negotiated $288 in annual Comcast savings and saved him more than $800 per year across cable and phone bills, while warning that many customer-support lines are not ready for agents. Levie predicted that consumer services will increasingly compete to be selected by agents capable of navigating sites, using MCP or CLI tools, and completing transactions end to end. These are early examples and builder forecasts, not evidence that agent-mediated commerce is already broadly adopted.

Consumer products 也开始测试由 agent 介入的协调与交易。Google Labs 更新了家庭 agent CC，支持最多五名成员、共享晨间邮件，以及同步 Calendar 与 Tasks。Peter Yang 表示，Meta Muse 帮他从 Comcast 谈下每年 288 美元的优惠，并让有线电视与手机账单每年总计节省 800 多美元；他同时提醒，许多客服热线尚未准备好应对 agents。Levie 则预测，consumer services 会越来越需要争取被 agents 选择，这些 agents 能浏览网站、使用 MCP 或 CLI 工具，并端到端完成交易。这些仍是早期案例与 builder forecasts，并不能证明 agent-mediated commerce 已被广泛采用。

Builders broadly agreed that better models do not eliminate the surrounding workflow layer. Garry Tan reported completing issue and pull-request work in about half the time expected from raw Codex or Claude Code by using Capy with GStack and GBrain on the same frontier models. Peter Yang said stronger models had not made skills redundant because skills preserve his research, editing, and browser-use instructions. Thariq moved from “bash is enough” toward MCP and operation-specific APIs. Across these accounts, orchestration, durable instructions, tools, and verification remained sources of performance even when underlying models were held constant.

Builders 大体同意，更强的 models 不会消除外围 workflow layer。Garry Tan 表示，在使用相同 frontier models 的情况下，Capy 配合 GStack 与 GBrain 处理 issues 和 pull requests，耗时约为他预计直接使用 Codex 或 Claude Code 的一半。Peter Yang 认为，更强的 models 没有让 skills 失去价值，因为 skills 会保留其研究、剪辑与浏览器操作要求。Thariq 也从“bash 已经足够”转向 MCP 与 operation-specific APIs。综合这些案例，即使底层 models 相同，orchestration、持久 instructions、tools 与 verification 仍然是性能来源。

The main disagreement concerned how to balance safety with competitive speed. Sam Altman argued for safety cases before frontier reinforcement-learning runs expected to raise capabilities, consistent federal requirements, and independent auditors. Aaron Levie supported stronger safety measures but warned that “pacing” can become arbitrary slowdown or regulation that weakens competition. Matt Turck expected progress not to slow because of strong incentives and prisoner’s-dilemma dynamics, while Madhu Guru argued that safety and security should be intrinsic product features rather than external guardrails. The shared premise was that risk is real; the dispute was whether control should come primarily through pre-development review, regulation, product architecture, or market competition.

主要分歧在于如何平衡 safety 与竞争速度。Sam Altman 主张，在预计会提升能力的 frontier reinforcement-learning 训练之前准备 safety cases，建立统一的联邦要求，并引入 independent auditors。Aaron Levie 支持更强的安全措施，但警告“pacing”可能变成人为放缓，或成为削弱竞争的监管手段。Matt Turck 认为，由于强烈激励与囚徒困境式博弈，进展不会放慢；Madhu Guru 则认为，safety 与 security 应成为产品自身功能，而不是外部 guardrails。各方共同承认风险真实存在，分歧在于控制主要应来自开发前审查、监管、产品架构，还是市场竞争。

For product teams, the meaningful reliability metric is moving from answer quality to completed-work quality. Anthropic’s Claude Code postmortem traced user complaints to three product-layer changes rather than the inference layer: lower default reasoning effort, a stale-session cache bug, and an overly restrictive system instruction. Zara Zhang separately described Astra accepting a correction but failing to perform the replacement action. Persistent agents amplify both patterns because context management, instruction handling, and follow-through become part of every long-running task.

对 product teams 而言，真正有意义的可靠性指标正在从 answer quality 转向 completed-work quality。Anthropic 的 Claude Code 复盘把用户投诉归因于三个产品层改动，而不是 inference layer：更低的默认 reasoning effort、stale-session cache bug，以及限制过强的 system instruction。Zara Zhang 还描述了 Astra 接受纠正后却没有执行替代动作的情况。Persistent agents 会放大这两类问题，因为 context management、instruction handling 与 follow-through 会进入每一个长任务。

For enterprises, control must become continuous. Background agents can generate far more activity than interactive sessions, access systems of record, and make inexpensive decisions at high volume. Sandboxes and network boundaries limit execution, narrow judges can gate actions, and classification can scope data access, but these layers need shared identity, logs, and recovery paths to form an accountable system.

对 enterprises 而言，控制必须持续运行。后台 agents 可以产生远多于交互式 sessions 的活动，访问 systems of record，并以低成本进行大规模判断。Sandboxes 与网络边界限制执行，narrow judges 可以把关 actions，classification 可以约束数据访问；但这些层只有结合统一身份、logs 与恢复路径，才能形成可问责的系统。

Analysis: For the industry, the center of value is shifting toward the agent operating layer: persistent state, tool interfaces, evaluation, security, and deployment. Model improvements remain essential, but they increasingly unlock more work for this layer rather than replacing it. That creates room for model providers, infrastructure companies, and systems-of-record vendors to compete for the same control point.

分析： 对整个行业而言，价值中心正在转向 agent operating layer：持久状态、工具接口、evaluation、security 与 deployment。Model improvements 仍然关键，但它们越来越多地为这一层解锁更多工作，而不是取代它。这会让 model providers、infrastructure companies 与 systems-of-record vendors 围绕同一个控制点展开竞争。

Analysis: Watch whether Claude Projects adds the promised local-file, local-tool, and internal-network support, and what permission model accompanies it. The transition from cloud-only context to local and enterprise resources will test whether persistent convenience can coexist with narrow, understandable authority.

分析： 关注 Claude Projects 是否加入承诺中的本地文件、本地工具与内部网络支持，以及它会采用怎样的权限模型。从纯云端 context 进入本地与 enterprise resources，将检验持久化便利是否能与狭窄、易理解的权限共存。

Analysis: Watch whether narrow evaluator models publish reproducible measurements across command safety, document routing, and domain decisions. This week’s speed and cost claims are consequential, but the category will need evidence about false positives, false negatives, distribution shift, and escalation behavior.

分析： 关注 narrow evaluator models 是否会针对命令安全、文档路由与领域决策公布可复现的测量。本周的速度与成本数据很重要，但这一类别仍需要披露 false positives、false negatives、distribution shift 与 escalation behavior。

Analysis: Watch whether enterprise platforms turn durable logs, disposable sandboxes, scoped credentials, and object-level data classification into interoperable defaults. The components now exist; the next question is whether organizations can govern them as one system rather than assemble isolated controls.

分析： 关注 enterprise platforms 是否会把持久 logs、一次性 sandboxes、scoped credentials 与 object-level data classification 做成可互操作的默认能力。组件已经出现，下一步的问题是，组织能否把它们作为一个系统治理，而不是拼接彼此孤立的 controls。

Analysis: Watch open-model share on gateways over more than a single measurement window, and whether multi-model products expose model choice or automate routing while preserving auditability. A sustained shift would affect pricing power, infrastructure demand, and the degree to which applications remain tied to one provider.

分析： 关注 gateways 上的 open-model share 能否在不止一个测量周期内持续，以及 multi-model products 会公开 model choice，还是在保留可审计性的同时自动路由。若变化持续，将影响定价权、infrastructure demand，以及 applications 对单一 provider 的依赖程度。