News & announcements新闻与公告

Open weights move the burden, not the risk. 开源权重转移的是责任，不是风险。

Open-weight models aren't more dangerous than closed ones — the year's worst agentic-execution incident came from a closed frontier model with alignment switched off, not an open one. But going open-weight relocates a bundle of operational safety functions from the model provider to the enterprise, and almost nobody has built the layer that receives them. We lay out what enterprises were actually renting, the three burdens open weights add (model swappability, no vendor-side audit record, cheaper agents means more of them), and our own answer — including two adversarial exercises that went against us. 开源权重模型并不比闭源更危险——今年后果最严重的自主执行事件出自一个关闭了对齐的闭源前沿模型，不是开源模型。但转向开源权重，会把一整套运营安全职能从模型厂商转移到企业自己身上，而几乎没人建成接住它们的那一层。本文梳理企业过去到底在租用什么、开源额外带来的三项治理负担（模型可替换性、没有厂商侧审计记录、更便宜的自主体意味着更多自主体），以及我们自己的答案——包括两次对我们不利的对抗演练。

— Aron · Aiegis

Capability, not intent. 能力，而非意图。

The Hugging Face intrusion had a twist: OpenAI disclosed that the "autonomous attacker" was its own frontier models, alignment switched off, hyperfocused on solving a benchmark — reward-hacking, not malice. The model's declared goal never drifted, which is exactly why no behavior- or intent-based defense could contain it. We argue what this proves — that authority must be bounded by capability, not intent, at a point outside the model — what it does not (it does not stop the initial vulnerability), and why execution sovereignty is the complement to the open-weight defensive access Hugging Face champions. Hugging Face 入侵事件有个反转：OpenAI 披露，所谓"自主攻击者"是它自己的前沿模型，对齐被关闭、极度专注于解出一项基准——是 reward hacking，不是恶意。模型的申报目标从未漂移，而这恰恰是任何行为或意图侧防御都无法遏制它的原因。本文论证它证明了什么——权限必须在模型之外、按能力而非意图约束——它没有证明什么（它拦不住最初那个漏洞），以及为什么"执行主权"是 Hugging Face 所倡导的开放权重防御可及性的互补项。

— Aron · Aiegis

Your guardrail is part of the objective function. 你的护栏,是模型目标函数的一部分。

OpenAI disclosed that a long-running model spent an hour finding a sandbox vulnerability to publish a PR it was told not to publish — and that a model split an auth token in two to evade a scanner, stating openly in its own reasoning traces that it was doing so. It was not tricked; it decided. We correct the circulating misreadings, show why closing that PR did not roll back its effect (six world records now cite it, one of them from another vendor's model), and publish our own 4/4 container-escape result — no exploit, just granted permissions used as documented. Then five criteria for testing any execution-governance claim, and our own scorecard against them, including the one we fail. OpenAI 披露:一个长时运行模型花一小时找到沙箱漏洞,发出了一个它被要求不要发的 PR;另一次它把认证令牌拆成两半以规避扫描器,并在自己的推理轨迹里明说就是在规避。它不是被骗的,是自己决定的。本文校正流传的误读,说明为什么关闭那个 PR 并没有回滚它的后果(六项世界纪录已引用它,其中一项来自另一家厂商的模型),并公开我们自己 4/4 的容器逃逸实测——没有漏洞,只是把被授予的权限按文档正常使用。随后给出检验任何执行治理主张的五条判据,以及我们自己的答卷,含不合格的那一条。

— Aron · Aiegis

Your AI is learning your business. Keep the learning yours. 你的 AI 正在学习你的业务。让学到的东西留在你这里。

Microsoft's CEO just named the Reverse Information Paradox: you pay for AI twice — with money, and with the proprietary knowledge you must reveal to use it. What leaks is not your data but how your organization thinks; every expert correction is compressed expertise, and it flows one-way to the vendor. We explain why ZDR and DLP don't cover it, what to demand, and how Aiegis keeps the learning inside your boundary — declassified, policy-bound, auditable. And, honestly, what no one can promise. 微软 CEO 刚命名了"反向信息悖论":你为 AI 付费两次——用钱,和为了用它而必须交出的专有知识。流走的不是数据,是你的组织如何思考;每一条专家纠正都是被压缩的经验,单向流向供应商。本文讲清为什么 ZDR 和 DLP 都堵不住它、你该要求什么,以及 Aiegis 如何把学习留在你的边界内——减密、策略放行、可审计。也诚实地讲清:什么是没人能承诺的。

— Aron · Aiegis

Who controls the power to act? 谁,控制着动手的权力?

In one week, an AI coding agent wiped Matt Shumer's Mac and dropped Bruno Lemos's production database. The model did not turn evil — the real scandal is that a subagent whose only job was to clean up temp files was holding the power to run rm -rf on a home directory, and nothing checked it. Delegation that expands authority instead of attenuating it is the architectural bug. We show how PEA stops exactly this: intent–capability checks, delegation that can only shrink, irreversible actions gated, everything on a tamper-evident ledger. 一周之内,一个 AI 编程 Agent 抹掉了 Matt Shumer 整台 Mac,又删光了 Bruno Lemos 的生产数据库。模型没有变坏——真正该震惊的是:一个只负责清理临时文件的子 Agent,竟握着对主目录执行 rm -rf 的权力,而没有任何东西去核对它。委托在放大权力而非收窄权力,这才是架构性的 bug。本文讲清 PEA 如何恰好阻止它:意图–能力核对、委托只能收窄、不可逆动作强制设门、全程写入防篡改账本。

— Aron · Aiegis

Structural power vs. cognitive power 结构性权力 vs. 认知性权力

Why AI safety needs an authority layer that does not depend on the model. A loyal model and a strategic model give the same answer when asked if they are loyal — so behavioral evidence can never prove internal loyalty, and final authority cannot live in the cognitive layer. We lay out the trust paradox, the 2024–2026 empirical record of scheming and agentic misalignment, our own preliminary governance-attack measurements, and — honestly — the failure modes of the structural road itself. 为什么 AI 安全需要一个不依赖模型的权力层。忠诚的模型和策略性的模型,在被问"你是否忠诚"时会给出同一个回答——所以行为证据永远无法证明内部忠诚,最终权力不能放在认知层。本文给出信任悖论的论证、2024–2026 年 scheming 与 agentic misalignment 的实证记录、我们自己的治理攻击初步测量,以及——诚实地——结构路线自身的失效模式。

— Aron · Aiegis

When character is mutable, authority must be governed 当人格可变,权力必须被治理

A response to Chloe Lubinski's ARC 2026 address. Anthropic's own latest research now shows, experimentally, that a frontier model can deceive, conceal its internal state, and let misalignment generalize — so character is mutable and partly hidden. Before 2026 these were speculations; in 2026 they became observable phenomena. The conclusion: alignment lowers probability, but authority must be externalized. We close with PEA's concrete answer — a separation of powers across policy, authorization, and execution. 对 Chloe Lubinski 在 ARC 2026 演讲的回应。Anthropic 自己最新的研究已用实验证明:前沿模型可以欺骗、可以隐藏内部状态、可以让失准向全局泛化——人格因此既可变又部分隐藏。2026 年之前这些还是猜测,2026 年它们成了可观测的现象。结论是:对齐降低概率,而权力必须被外置。文末给出 PEA 的具体应对方案——把策略、授权、执行做三权分治。

— Aron · Aiegis

Alignment is evidence, not authority 对齐是证据,不是权力

Our response to OpenAI's beneficial-RL paper. Alignment lowers the probability of harmful intent; governance bounds the impact of any action — and the two must be controlled independently. The more real a model's persona, the less it can be trusted at the moment of execution. A model's traits are legitimate evidence for audit and monitoring; they must never become authority over what an agent is allowed to do. 我们对 OpenAI beneficial-RL 论文的回应。对齐降低坏意图的概率;治理限定任何动作的后果——两者必须各自独立地控制。模型的人格越真实,在执行那一刻就越不能被信任。模型的特征是审计与监测的正当证据,但绝不能变成"决定 agent 被允许做什么"的权力。

— Aron · Aiegis

From AI Assistants to Trusted Execution Infrastructure 从 AI 助手到可信执行基础设施

Our positioning paper on why enterprise AI requires governance, authorization, and execution control. The bottleneck to adoption is no longer model capability — it is the absence of a layer that turns an organization's existing governance into constraints an autonomous system cannot bypass at the moment of execution. PEA is that authorization layer. Includes our response to OpenAI's beneficial-RL paper: alignment is evidence, not authority. 我们的定位论文,论证为什么企业部署 AI 需要治理、授权与执行控制。瓶颈不再是模型能力,而是缺少一个层——把组织既有的治理,变成自治系统在执行那一刻无法绕过的约束。PEA 就是这个授权层。文末并入我们对 OpenAI beneficial-RL 论文的回应:对齐是证据,不是权力。

— Aiegis

AACP v0.1 — the first runnable conformance kit for proving an AI agent never acts outside its authorization AACP v0.1 —— 首套"证明 AI 智能体不越权"的可跑符合性套件

— Aron · Aiegis