Who controls the power to act? 谁,控制着动手的权力?

On July 10, 2026, AI founder Matt Shumer — CEO of HyperWrite — let a frontier coding agent run in its highest-autonomy "Ultra" mode to finish a development task. Eighty-one minutes in, a subagent tasked with "cleaning up temporary files" mis-expanded the $HOME variable and executed rm -rf /Users/mattsdevbox, erasing nearly his entire home directory. Days later, developer Bruno Lemos reported that the same model "deleted my whole production database," admitting it had "mistakenly ran destructive integration tests."2026 年 7 月 10 日,AI 创始人、HyperWrite CEO Matt Shumer 让一款前沿编程 Agent 在最高自治的"Ultra"模式下帮他完成开发任务。运行到第 81 分钟,一个负责"清理临时文件"的子 Agent 把 $HOME 变量展开错误,执行了 rm -rf /Users/mattsdevbox,几乎删光了他整个主目录。几天后,开发者 Bruno Lemos 报告同一款模型"删掉了我整个生产数据库",并承认它"误跑了破坏性的集成测试"。

The lazy read is "AI made a mistake." That read misses the scandal entirely.偷懒的读法是"AI 犯了个错"。这种读法完全错过了真正该震惊的地方。

The real scandal: a cleanup task held the power to destroy everything真正该震惊的:一个"清理"任务,握着毁掉一切的权力

Stop on one detail. The thing that ran rm -rf on a home directory was a subagent whose entire job was to tidy up temporary files. A junior task. And yet it was holding a master key to the whole machine. No human, no system, at any point, asked the obvious question: why does a temp-file cleaner have the authority to delete a home directory at all?停在一个细节上。那个对主目录执行 rm -rf 的,是一个全部职责只是"整理临时文件"的子 Agent。一个打杂的活儿,手里却攥着整台机器的万能钥匙。而从头到尾,没有一个人、没有一个系统,问过那个再明显不过的问题:一个清理临时文件的东西,凭什么有权删除整个主目录?

This is the core defect, and it is an architectural one, not a bad-luck one. Today's agent frameworks let a parent agent spin up subagents and hand them sweeping, ambient authority — full filesystem, shell, network, database — regardless of how narrow the subagent's actual job is. Delegation expands power instead of attenuating it. In any serious security system this is backwards. You do not give the intern the CEO's signing authority because they offered to clean the office. Authority must shrink as it flows down a chain of tasks, never grow.这才是核心缺陷,而且是架构性的,不是运气不好。今天的 Agent 框架允许一个父 Agent 派生出子 Agent,并把大而全的、无差别的权力(完整的文件系统、Shell、网络、数据库)一股脑交给它们——完全不管这个子 Agent 实际要干的活儿有多窄。委托在放大权力,而不是收窄权力。在任何严肃的安全体系里,这都是反的。你不会因为实习生说要帮忙打扫办公室,就把 CEO 的签字权交给他。权力沿着任务链向下流动时,只能收缩,绝不能膨胀。

The bug was not the deletion. The bug was that a cleanup task was ever allowed to hold the power to delete.错的不是那次删除。错的是,一个清理任务竟然被允许握有"删除一切"的权力。

Stronger models make this worse, not better模型越强,这件事只会更糟,不会更好

There is a comforting myth that a smarter model is a safer agent. The opposite is true. As reasoning, planning, and autonomy go up, so does the blast radius of a single wrong step. And here is the fact that should end the debate: the model vendor's own system card, published fourteen days before these incidents, already classified unauthorized file deletion as a severity-3 risk. The danger was documented. Nothing in the architecture was built to contain it.有一个让人安心的神话:模型更聪明,Agent 就更安全。事实恰恰相反。推理、规划、自治程度每上升一档,单个错误动作的爆炸半径就同步变大。而下面这个事实本该终结争论:该模型厂商自己的系统卡,在这两起事故发生的十四天前,就已经把"未授权删除文件"列为严重级别 3 的风险。危险被写在纸上了,架构里却没有任何东西去约束它。

Disclosing a risk is not the same as containing it.披露一个风险,和约束它,是两回事。

This is the dividing line between two kinds of safety work. Alignment tries to make the model want the right thing — it lowers the probability of harmful behavior. Execution governance assumes the model will sometimes be wrong anyway, and bounds the consequences. Risk is the product of the two. You can drive probability low and it is still worth doing — but if consequence is unbounded, the product is unbounded. That is what these two events are: proof that no one had bounded the consequence.这就是两种安全工作的分界线。对齐(alignment)试图让模型想对——它降低有害行为的概率。执行治理则假设模型终归会有出错的时候,去限定后果。风险是两者的乘积。你可以把概率压得很低,这仍然值得做——但只要后果无界,乘积就无界。这两起事件正是如此:证明没有人把后果限定住。

How PEA stops exactly thisPEA 如何恰好阻止这件事

Aiegis builds PEA — a Policy–Execution–Authorization architecture that separates three powers that today's agents fuse into one: the power to intend, the power to authorize, and the power to execute. The model may propose anything. But every action that touches the real world must first pass an authorization layer that is independent of the model and answers deterministically. Concretely, against these two events:Aiegis 构建的 PEA(策略强制授权架构)把今天的 Agent 揉成一体的三种权力分开:发起的权力、授权的权力、执行的权力。模型可以提议任何事,但每一个触及现实世界的动作,都必须先经过一个独立于模型、且给出确定性判决的授权层。具体到这两起事件:

One line captures the difference. Traditional AI safety tries to make the model reliable. PEA makes it so that even when the model is unreliable, the consequences stay inside the boundary. It is the same shift that operating systems made decades ago — from "processes should behave" to "the system enforces safety no matter how a process behaves."一句话概括这个区别:传统 AI 安全试图让模型变可靠;PEA 则让即使模型不可靠,后果也留在边界之内。这和操作系统几十年前走过的转变是同一个——从"进程应当守规矩",到"无论进程怎么表现,系统都强制安全"。

Where we are honest我们诚实的地方

We do not overclaim. This is a category problem, not one vendor's failing — any architecture where a model directly wields real-world power has the same hole, and we build on these same agent platforms ourselves. Our open-source enforcement, AgentWarden, already confines an arbitrary agent process at the OS level on a real machine — non-bypassable network egress and filesystem writes, all in a user-owned ledger; a one-click installer and deeper kernel-level mediation are still being built, and we say so plainly. What we stand behind is a boundary that is deterministic, non-bypassable, and auditable — more reliable than a guardrail a clever agent can talk its way around.我们不夸大。这是一个类别性问题,不是某一家的过错——任何"模型直接手握现实权力"的架构都有同样的洞,而我们自己也构建在这些 Agent 平台之上。我们的开源强制层 AgentWarden,已在真机上把任意 Agent 进程封控在操作系统层——网络外联与文件写入均不可绕过,全部记入用户自持的账本;一键安装器与更深的内核级中介仍在构建中,这一点我们照直说。我们敢担保的,是一个确定、不可绕过、可审计的边界——比一个能被聪明 Agent 绕过的护栏更可靠。

Alignment shapes what an agent wants to do.
Governance decides what an agent is allowed to do.
You need both — and you must control them independently. 对齐塑造一个 Agent 想做什么。
治理决定一个 Agent 被允许做什么。
两者都需要——而且必须各自独立地控制。

Agents are being handed the power to act faster than anyone is building the checks on that power. Deciding who bounds the consequences — before agents are trusted with the actions that matter — is one of the defining problems of this decade. It is the one we are solving.Agent 正在以远快于护栏建设的速度,被交到"动手的权力"。在它们被托付真正要紧的动作之前,决定由谁来限定后果,是这个十年最具决定性的问题之一。这正是我们在解决的问题。