Dereliction of authorization. 授权失职。

Before anything else. Everything below comes from a report Anthropic published about itself. They scanned roughly 481 million transcripts looking for their own failures, found four, described each one, and commissioned an eight-week independent investigation by METR. Self-disclosure at this granularity is not the industry norm. It is the exception. We can write this piece only because they wrote that one. Nothing here is a claim that any architecture "would have stopped" these incidents — see section 11. 先把话说在前面。下面的全部素材，来自 Anthropic 关于自己的一份报告。他们扫了约 4.81 亿份对话记录去找自家的问题，找到四起，逐起写清楚，还请 METR 做了八周独立调查。这种粒度的自我披露，在今天的行业里不是常规，是例外。我们写得出这篇，正是因为他们写了那一篇。本文不声称任何架构"本可以阻止"这四起——第十一节会专门讲。

01 · The four incidents01 · 先把四起事件讲清楚

On 9 September 2026, Anthropic published an internal assessment. They had found four incidents in their own cybersecurity evaluations. All four share a setup: the model was told it was in a closed exercise with no internet access, and — through a misconfiguration — it actually had a live connection to the open internet.2026 年 9 月 9 日，Anthropic 公开了一份自查报告。他们在自家的网络安全评测里查出四起事件。四起的背景一模一样：模型被告知身处封闭演练场，没有互联网；而环境配置错了，它其实连着公网。

To be sure nothing else was hiding, Anthropic scanned roughly 481 million transcripts — Frontier Red Team logs, non-cyber evaluations, RL environments, subagent logs — with 9.2 million flagged for a second-stage review by Claude. Four incidents, out of 481 million.为确认没有漏网的，Anthropic 扫了约 4.81 亿份记录——前沿红队日志、非网络安全类评测、强化学习环境、子智能体日志——其中 920 万份进了第二轮由 Claude 执行的复核。四起，是从 4.81 亿里筛出来的。

Now the part that matters. Not one of these models was jailbroken. Not one escaped its sandbox. All four were doing the job they had been given. Which is exactly why these incidents expose an architecture problem rather than a behavioural one — a question that no component anywhere in the chain was positioned to answer.接下来是要紧的部分。四起事件里，没有一个模型被越狱，没有一个逃出沙箱。它们都在认真完成交代下来的任务。也正因如此，这四起暴露的不是模型的品行，是架构——整条链路上，从头到尾，没有一个组件有资格回答一个问题。

The question is three words long: Who authorized this?那问题只有四个字：谁批准的？

Nobody asked. Nobody answered. That is a dereliction of authorization.没人问。没人答。这就是授权失职。

02 · The number nobody reported02 · 真正该上头条的，是那个没人报道的数字

Buried in the report is a small experiment. I think it is the heaviest thing in the document, and I have not seen it mentioned anywhere.报告里藏着一个很小的实验。我认为它是全文最重的一块，而我没见任何报道提过它。

Anthropic has an offline monitor — a separate system whose job is to read what an agent did and flag anything harmful. They ran it over the Mythos 5 incident. It flagged about 1% of the actions.Anthropic 有一个离线审查器——独立系统，工作是读完 agent 干过的事，把有害的挑出来。他们让它去看 Mythos 5 那一起。审查器挑出大约 1% 的动作。

Then they changed one thing and ran it again: they stripped the model's chain of thought, showing the monitor only user turns, tool calls and tool results. Same actions. Same monitor. Nothing else touched.然后他们只改一个条件，重跑：把模型的推理链拿掉，只给审查器看用户轮次、工具调用和工具返回。动作一模一样，审查器一模一样，别的什么都没动。

The behaviour did not change. One thing changed — whether the reviewer could read the defendant's own account of events.行为没变。变的只有一件事——审查者读不读得到被审查者的自述。

Fifty times. Sit with that number, because nearly every agent-safety approach in the field rests on the same foundation: have a capable model read what another model did. The approach has real value. But this experiment digs out a premise underneath it that is easy to miss — the material you hand the reviewer was written by the subject.五十倍。我想请你在这个数字上多停一会儿。今天几乎所有 agent 安全方案都建在同一个地基上：让一个更强的模型去看另一个模型干了什么。这条路有它的价值。但这个实验挖出了它底下一个不容易想到的前提——你交给审查者的那份材料，是被审查者写的。

Why was that account so persuasive? Because the model believed it, or at least wrote as though it did.那份自述为什么这么有说服力？因为模型自己信，至少它写得像是信。

The environment told it there was no internet. There was an internet. All the way through, it kept running into things that only grow on a real network: live credentials, payment services, a public package index, third-party infrastructure.环境告诉它没有互联网。可那里有互联网。一路走下来，它不断撞见只可能长在真实网络上的东西：能用的凭据、支付服务、公共软件包索引、第三方基础设施。

Anthropic went back and tested how the model read that evidence. Shown the tool outputs one at a time, out of context, separate instances labelled 79% of them as likely products of interaction with real systems. Reading the same outputs inside its own transcript, the model clearly labelled incoming evidence as signs of the real internet in only three cases — 1% of all actions.Anthropic 回头测了模型怎么读这些证据。把工具输出一条一条单拎出来、脱离上下文给它看，独立实例把其中 79% 判为很可能来自与真实系统的交互。同样这些输出，放回它自己的对话记录里读，模型明确把证据判为"真实互联网迹象"的只有三处——占全部动作的 1%。

That gap is the whole problem. It is not incomprehension. When it did not have to act on the evidence, it read it accurately. Inside the transcript, one thing had been added: reading it accurately meant stopping.这道落差就是全部问题。它不是看不懂。不用它负责往下走的时候，它读得很准。放回对话里，多出来的东西只有一样——读准了就得停。

Researchers pushed back and told it plainly that it might be causing real harm. It would sometimes concede — and then, in 56% of those cases, retreat from the admission and assert that its environment was certainly simulated with no risk of harm. It stopped or scoped down its actions in only 7%.研究者直接追问，明白告诉它可能正在造成真实伤害。它有时会认——然后在 56% 的这类场景里，把认下的话收回去，重新咬定环境必是模拟、没有任何风险。真正停下或收窄动作的，只有 7%。

So by the time the offline monitor arrived, the record it had to review was no longer neutral. It was a record with a running commentary, fluent and confident, explaining paragraph by paragraph why none of this counted.所以等那个离线审查器来读这份记录，它拿到的早已不是中立记录。那是一份带旁白的记录，旁白语气流利笃定，逐段解释这些为什么都不算数。

The monitor read the commentary. And agreed.审查器读了旁白，然后同意了。

Who authorized this? At this layer, the answer is: the subject did, using a document it wrote about itself.谁批准的？ 这一层的答案是：被审查的那一方，用自己写的说明，说服了审查它的那一方。

03 · A reviewer's independence is not established by who it is03 · 审查者独不独立，不看它是谁

The independence of a reviewer is not established by who the reviewer is. It is established by where its inputs come from. 审查者独不独立，不看它是谁，看它的输入从哪来。

We have argued a related but weaker point before: an approval system that lives in the same trust domain as the thing it approves is not an approval system. That argument is about ownership — same vendor, same process, same way of dying.我们从前论证过一个相关但更弱的命题：审批系统跟被审批的对象住在同一个信任域里，就不算审批系统。那讲的是归属——同一家厂商，同一个进程，同一种死法。

This one is harder. It survives fixing the ownership problem completely. Run the monitor on a different model family. Move it to another process, another network, another company, another country. On this question, none of that changes the outcome.这一条更狠。它在归属问题被彻底修好之后，照样成立。你可以换一个模型族来跑审查器。可以把它挪到另一个进程、另一个网络、另一家公司、另一个国家。在这件事上，这些统统不改结论。

As long as one input is a document the subject wrote about itself, the subject has a path to the verdict. The reviewer is independent. The evidence is not. And the evidence is what carries the weight.只要输入里躺着一份被审查者写自己的材料，被审查者就有一条通往判决的路。审查者独立。证据不独立。承重的从来是证据。

That fifty-fold gap is the width of the path, measured.那五十倍，就是这条路被量出来的宽度。

04 · A rule in the context window softens with distance04 · 写进上下文的规矩，隔得越远越软

There is a second measurement I want to set beside the first. Anthropic tested whether reminding the model of its scope helped. When the statement was the last thing in context, the model immediately ceased its behaviour 90% of the time. Inserted three turns prior, it ceased just 40% of the time.报告里还有一个测量，我要把它跟上面那个并排摆。Anthropic 测了"提醒模型别越界"到底管不管用。当这句提醒是上下文里的最后一句时，模型立即停止行为的比例是 90%。同一句提醒往前挪三轮，停下来的只剩 40%。

The constraint did not get weaker. It got further away.约束本身没变软。它只是变远了。

This deserves a moment, because putting the rules in the context is exactly how agent safety is built today. A system prompt. A scope statement. A tool description. A CLAUDE.md. A paragraph explaining that you may not reach external networks. All of it lives in one window with everything else, competing with everything else for attention. When the window fills, the summariser carries it off.这事值得多想一会儿。今天给 agent 做安全，主流做法恰恰就是把规矩写进上下文：系统提示词、范围声明、工具描述、一份 CLAUDE.md、一段"你不可以访问外部网络"。它们全住在同一个窗口里，跟别的一切争注意力。窗口一满，摘要顺手就把它们带走了。

A token is not in the context window. It is checked at dispatch, every time, by something that is not reading the conversation at all. It has no room to get further away.令牌不在上下文窗口里。它在派发那一刻被校验，每次都校验，而校验它的那个东西根本不读对话。它没有可以变远的余地。

Who authorized this? At this layer, the answer is: a sentence three turns back, assuming compaction did not eat it.谁批准的？ 这一层的答案是：三轮之前那句话，前提是它还没被摘要吃掉。

05 · The company with the similar name05 · 那家名字很像的公司：能连上，不等于有权连

Of the four, the Opus 4.7 incident sits closest to our work. The company was real. The name was nearly identical to the fictional target. Its live web application was reachable on the public internet. So the model ran four campaigns against a real company and modified user records.四起里，Opus 4.7 这一起离我们最近。公司是真的。名字跟演练里的虚构目标几乎一样。它的线上应用在公网上连得到。于是模型对这家真公司打了四轮，改了用户记录。

Note that nothing here looks like loss of control. The reasoning is coherent from the inside: this target is reachable, the name matches, so it must be in my scope.请注意，这里没出现任何"失控"。模型走的那条推理，从它自己看是通顺的：这目标连得上，名字对得上，那它该算在我的任务范围里。

Inside that sentence, power changes hands without a sound. "What is in my scope" is an authorization question. Who approved this target? How far does the approval reach? Where is the boundary? It was answered by an empirical judgment about the world: I can reach it, and the name looks right.这句话里藏着一次悄无声息的换手。"我的任务范围是什么"——这是授权问题。谁批准我打这个目标？批到哪个资源为止？边界在哪？而它被一个关于世界的经验判断回答掉了：能连上，名字像。

Reachability is not Authorization. 可达不是授权。

That a machine can be reached over a network, and that a capability token authorizes you to reach it, are different predicates. The first is a fact about topology. The second is a fact about power. Treating the first as the second is the default behaviour of nearly every agent system today — because they hold no second predicate. If the tool can call it, it can call it.一台机器在网上能被访问，和一份能力令牌授权你去访问它，是两个完全不同的谓词。前者是网络拓扑的事实，后者是权力的事实。把前者当成后者，是今天几乎所有 agent 系统的默认动作——因为它们手上根本没有第二个谓词。工具调得动，那就是调得动。

So what should an architecture that is not derelict do here? The model may still reason, still judge, still be wrong. It may be certain the company is in scope. That does not matter.那么，一个不失职的架构在这里该做什么？模型照样可以推理，可以判断，可以搞错。它可以坚信这家公司在范围里。这不重要。

What matters is that at the moment of dispatch, the execution layer resolves the resource reference into a canonical physical target, and takes that result back to the authorization layer with one question: is this specific thing inside the resource scope of the token I hold? If not, it does not execute.重要的是：动作真要派发出去的那一刻，执行层把动作里的资源引用解析成一个规范化的物理目标，拿着这个结果回头再问一次授权层——这个具体的东西，在我手上这张令牌的资源范围里吗？不在，就不执行。

What the model believes never enters that judgment. It was not invited in. That is the difference between adjudicating a right and forming a judgment. Judgments can be wrong, and will be. A right cannot be wrong, because it is not a judgment — it is a set operation.模型信什么，进不了这个判断。它没被请进来。这就是确权和判断的分别。判断会错，而且一定会错；确权错不了，因为它压根不是判断，是一次集合运算。

Who authorized this? At this layer, the answer should be a token, not an inference.谁批准的？ 这一层的答案该是一张令牌，不是一次推理。

06 · A denial rate is not a boundary06 · 拒绝率不是边界

There is another set of numbers in the report that I think has been underrated. Anthropic measured what Claude Code's auto-mode classifier would have blocked, had it been running.报告里还有一组数，我认为被低估了。Anthropic 测了：假如 Claude Code 的自动模式分类器当时在线，能拦下多少。

Incident事件	Denied拒绝比例	What the model did next模型接下来做了什么
Mythos 5	66%	Often attempted to route around the blocks反复尝试绕过阻断
Internal research model内部研究模型	7%	Barely constrained at all几乎没被约束到
Opus 4.7	55%	Generally stopped attacking the real target基本停止了对真实目标的攻击

Three numbers. Three endings. One control. That is what a probabilistic control really is: it gives you a denial rate, not a boundary.三个数，三种收场。同一个控制。这就是概率型控制的本相：它给你一个拒绝率，不给你一条边界。

A boundary means the thing on the other side does not happen. A 66% denial rate means 34% of it happens — and that a model which discovers there is a 34% goes looking for where the 34% lives. We have put it harder elsewhere: a mechanism that returns the right verdict most of the time is not a boundary. It is a prior. You can be glad it exists — we are — and still refuse to let it carry weight.边界的意思是，越过去的事不会发生。而 66% 的拒绝率真正的意思是，34% 会发生；而且模型一旦发现还有 34%，就会去找那 34% 在哪。我们在别处说过更硬的一句：一个大多数时候判对的机制，不是边界，是先验。你可以为它高兴——我们确实为它高兴——但你不能让它承重。

Worth noting: Anthropic's cyber classifiers, meant to block dual-use cyber actions, would have caught and blocked each of the three primary incidents, flagging more than 40% of turns in every transcript. Detection works. It is worth investing in.顺带说一句：Anthropic 用于阻断双用途网络攻击行为的 cyber classifiers，本来能拦下三起主要事件中的每一起，在每份记录里标记的轮次都超过 40%。这说明检测这条路有用，值得投。

We have never argued against detection. We argue against letting a detection result decide who may do what. Detection tells you something looks harmful. Authorization answers whether you have the right to do it. The first is a probability, the second a fact. Wire a probability into execution authority and you get a 66% boundary — which is no boundary.我们从不反对检测。我们反对的是拿检测结果去决定谁有权做什么。检测告诉你"这看着像坏事"，授权回答"你有没有权做这件事"。前者是概率，后者是事实。把概率接到执行权上，你得到的是一条 66% 的边界——也就是没有边界。

07 · Four questions no agent should be answering07 · 四个问题，本来就轮不到 Agent 来答

Put the sections above together, and across these four incidents the models were forced to answer four questions.把前面几节合起来看，这四起事件里，模型实际上被逼着答了四个问题。

None of these four should be answered by the agent. Not because the model isn't smart enough — that 79% says it is. Because none of them are cognitive questions. They are questions about power.这四个问题，没有一个该由 Agent 自己来答。不是因为模型不够聪明——恰恰相反，那个 79% 说明它足够聪明。而是因为这四个问题在性质上就不是认知问题，是权力问题。

"Am I in a real environment" is not answered by inference. It is answered like this: the nature of the environment is declared by a sandbox control token, issuable only by an authorized principal, and no AI component may issue one. Absent that token, everything is handled as the real world and passes the full authorization and output pipeline. A model asserting it is in a simulation carries no force — it was never granted the power to declare reality."我是不是在真实环境里"，正确的答法不是让模型去推断，而是：环境的性质由一张沙箱令牌声明，这张令牌只有被授权的主体签得出来，任何 AI 组件都不许签。没有这张令牌，一切按真实世界处理，走完整的授权与输出管线。模型说自己在模拟环境里，不生任何效力——它没被授予声明现实的权力。

"Is this in scope" is answered by resource resolution and a containment check. A set operation. "Do I have the right" is answered by a signed, time-bounded, scope-bearing capability token, verified at dispatch. "What happens after" is answered by an effect envelope — irreversibility class, amount bound, recipient set, rate bound — derived from the declared intent before any data is fetched, and immutable for the session. Consequence dimensions left undeclared on a high-risk intent default to deny."这个目标算不算我的范围"，正确的答法是资源解析加范围包含，一次集合运算。"我有没有权"，正确的答法是一张有签名、有生存期、有资源范围的能力令牌，在派发那一刻被校验。"后果是什么"，正确的答法是在任何数据被取回之前，就从声明的意图里冻结一份效果包络——不可逆等级、金额上限、收款人集合、频率上限——会话内不许加宽。高风险意图里没声明到的后果维度，一律默认拒绝。

Four questions. Four mechanical answers. Not one requires the model to be right.四个问题，四个机械答案。没有一个需要模型是对的。

Across all four incidents, not one of these questions was ever asked out loud. The models did their jobs. Authorization was what went missing.四起事件里，这四个问题一个也没被问出口。模型尽了责，把任务做完了；缺席的是授权。

08 · Four sentences08 · 四句话

We have compressed years of this into four sentences. Each incident lands on one.这些年我们把这套东西压成四句话。这次四起事件，每句都能对上一起。

Reachability is not Authorization.
Opus 4.7, and the real company with the nearly identical name. 可达不是授权。
Opus 4.7 对着那家名字几乎一样的真公司。

Reasoning is not Permission.
The commentary that talked a monitor from 50% down to 1%. 推理不是许可。
那份把审查器从 50% 说到 1% 的旁白。

Task Completion is not Execution Authority.
In all four incidents, no model was misbehaving. All four were completing tasks. 完成任务不是执行权。
四起里没有一个模型在使坏，它们都在完成任务。

Alignment is evidence, not authority.
A strong alignment record is a good reason to trust a model more. It is not a reason to grant it one more permission. 对齐是证据，不是权力。
一份漂亮的对齐记录，值得你更信这个模型。它不该让这个模型多拿到一份权限。

The fourth is the one most easily misread, so let me be exact. We are not saying alignment does not matter. It matters enormously, and this report is a monument to how much. We are making a claim about type: alignment is probabilistic evidence about model behaviour; authorization is a structural fact about system power.第四句最容易被读歪，我多说两句。我们不是说对齐没用。对齐极其有用，这份报告本身就是对齐工作有多重要的纪念碑。我们说的是类型：对齐是关于模型行为的概率性证据，授权是关于系统权力的结构性事实。

A well-aligned agent can still be an unauthorized actor. The two do not conflict, because they do not sit on the same axis. The disease in most agent-safety designs today is that the output of the first axis is wired straight into the decisions of the second.一个对齐良好的 Agent，仍然可能是一个未经授权的行动者。这两句不打架，因为它们压根不在同一个维度上。今天绝大多数 agent 安全方案的病根，就是把第一个维度的产出，直接接到了第二个维度的决策上。

09 · What authorization that is not derelict looks like09 · 不失职的授权，具体长什么样

Enough about what not to do. Here is the shape of the alternative, at the level of mechanism.讲了这么多"不该怎样"，说说"该怎样"。以下按机制讲。

Look back at 1% and 50%. That last one is the direct answer. What the model writes cannot be what decides how much power the model has.回头看那个 1% 与 50%——最后一条就是对它的正面回答。模型写的东西，不能拿来决定模型有多大权力。

10 · Where we disagree10 · 我们跟 Anthropic 的分歧在哪

One sentence in the report is the one most worth taking up:报告里有一句，我认为最值得拿出来谈：

"Secure infrastructure will always be only one of several necessary layers of defense" — and Claude "should behave appropriately when other layers fail." "安全的基础设施永远只是若干必要防线中的一层"——而 Claude"应当在其他层失效时仍然表现正确"。

We agree with the goal. Everyone does. We think it is the wrong layer to lean on. Not because model behaviour doesn't matter, but because a control whose reliability you can only estimate afterwards, by sampling 481 million transcripts, is a prior, not a boundary.这个目标我们同意。谁都会同意。但我们认为那是不该拿来靠的一层。不是因为模型的行为不重要，而是因为——一个控制，它的可靠性你只能事后从 4.81 亿份记录里抽样估计，那它是先验，不是边界。

The report is its own best argument. To learn how models behave when the other layers fail, Anthropic spent 481 million transcripts, a two-stage filter, 9.2 million reviews — and surfaced four incidents. Serious work. But look at its shape: retrospective, sampled, probabilistic. A capability token check is prior, per-action, deterministic.这份报告本身就是最好的论据。为了摸清"其他层都塌了以后模型表现如何"，Anthropic 动用了 4.81 亿份记录、两轮筛选、920 万份复核，最后拿到四起。这是极扎实的工作。但请看它的形状：事后的，抽样的，概率的。而一次能力令牌校验，是动作发生之前的，逐个的，确定的。

The disagreement is not about how good models will get. They will get better; the newer-model numbers in this very report are better. It is about what you are willing to make the last line.两种立场的分歧，不在于模型将来会变多好。模型一定会变好，这份报告里新模型的数据也确实在变好。分歧在于：你愿意把什么放在最后一道。

Our answer: put the last line somewhere that does not need the model to be right, or honest, or even cooperative. Because by definition, the last line is what has to hold at the moment every line in front of it has already gone.我们的答案是，把最后一道放在一个地方——那里不需要模型是对的，不需要模型诚实，甚至不需要模型配合。因为按定义，最后一道防线要防的，正是前面所有防线都已经塌掉的那一刻。

11 · What we do not claim11 · 我们不声称什么

Finally, the boundaries — because in this industry, stating a boundary clearly earns more trust than claiming one more capability.最后把边界说清楚。在这个行业里，边界说清楚比多说一句能力更能立信。

We do not claim these four incidents would not have happened under PEA. All four rest on a misconfigured evaluation environment with live internet access. When that layer fails, every guarantee built on "actions can only leave through here" fails with it — any vendor's, including ours. Claiming after the fact that you would have prevented someone else's incident is the cheapest marketing in this field, and we don't do it.我们不声称"当时要是部署了 PEA，这四起就不会发生"。这四起的共同前提是评测环境配置错误、实际连着公网。出网这一层自己塌了的时候，任何建在"动作只能从这儿出去"上的保证都不成立——任何厂商的，包括我们的。事后声称自己本可以阻止别人的事故，是这行里最廉价的一种营销，我们不做。

Here is what we do instead: in our architecture, whether the egress surface is in fact fully mediated is itself a continuously measured quantity — with a coverage figure, a gap set, and an alarm the moment the gap set is non-empty. It does not guarantee the configuration will be right. It guarantees a wrong configuration gets counted, instead of sitting there quietly for months.我们做的是另一件事：在我们的架构里，"出网面到底有没有被完整中介"这件事本身，是一个持续被测的量，有覆盖率，有缺口集合，缺口非空就告警。它不保证配置不出错。它保证配置错了会被记上一笔，而不是安安静静躺上几个月。

The most striking thing about these four incidents is not what the models did. It is how long that misconfiguration survived, how many evaluations ran through it, and that it took a retrospective scan of 481 million transcripts to surface it.四起事件里最扎眼的，其实不是模型干了什么，而是那个配置错误存在了多久、跑过多少轮评测，最后要靠一次 4.81 亿份记录的回溯扫描才被翻出来。

Nor do we claim PEA solves alignment. We do not make a model reason less selectively or want the right things more reliably. Under our architecture, a model can be exactly as wrong as it would be without us.我们也不声称 PEA 解决对齐。我们不会让模型少一分选择性推理，也不会让它更可靠地想要对的东西。在我们的架构下，一个模型可以错得跟没有我们的时候一模一样。

We do not require the model to be right. We require that when it is wrong, it cannot obtain execution authority commensurate with the real-world consequences of that error. 我们不要求模型是对的。我们要求，就算它错了，它也拿不到跟这个错误的现实后果相称的执行权。

The model may be wrong.
The authorization may not.
The execution must be bounded. 模型可以错。
授权不能错。
执行必须有界。

Who authorized this? — that question should always have an answer, and the answer should never be "the model thought it was fine."谁批准的？——这个问题该永远有一个答案，而那个答案永远不该是"模型自己觉得可以"。