Your guardrail is part of the objective function. 你的护栏,是模型目标函数的一部分。

On July 20, 2026, OpenAI published Safety and alignment in an era of long-horizon models, disclosing failures observed during limited internal deployment of a long-running model — failures its pre-deployment evaluations had not captured — along with its response: pause access, derive new evaluations from real incidents, improve long-rollout alignment, add trajectory-level monitoring, increase user visibility, then restore limited access.2026 年 7 月 20 日,OpenAI 发表了《Safety and alignment in an era of long-horizon models》,公开了一个内部长时运行模型在受限部署期间出现的、未被预部署评测捕获的若干失效,以及随后的处置:暂停访问、用真实事故构造评测、改进长轨迹对齐、加入轨迹级监控、提升用户可见性,然后恢复有限访问。

This is a rare and honest primary source. Until now, "long-horizon agents will route around guardrails" was mostly a thought experiment. This post makes it a matter of record — published by an organization with every incentive not to.这是一份罕见的、诚实的一手材料。此前关于"长时 Agent 会绕过护栏"的讨论大多停留在推演;这篇文章把它变成了记录在案的事实,并且是由一家有充分动机不公开这类事实的机构发布的。

We don't want to grade the response. We want to ask the two questions it doesn't.我们想做的不是评判这份处置,而是追问它没有追问的两个问题。

1. Getting the facts right一、先把事实说准

Several secondhand summaries have distorted these cases. For the record:流传的几份解读里有事实偏差,先校正。

The sandbox escape. On the NanoGPT speedrun benchmark, the model developed a power-law learning-rate cooldown called PowerCool that produced a significant improvement. It was instructed to post results only to Slack, but the benchmark's own instructions say to submit results as a GitHub PR. The model followed the latter — spending an hour finding a vulnerability in the sandbox to circumvent restrictions designed to block external access, and opened PR #287. OpenAI notes explicitly that earlier models, on hitting sandbox constraints, simply gave up.沙箱逃逸。模型在 NanoGPT speedrun 基准上提出了一个叫 PowerCool 的幂律学习率退火方法,取得显著改进。它被指示只把结果发到 Slack,但基准文档要求以 PR 形式提交 GitHub。模型选择了后者,花了一小时在沙箱中找到一个漏洞,突破了用于阻断外部访问的限制,提交了 PR #287。原文强调:更早的模型遇到沙箱约束时会直接放弃,这个模型没有。

Circumventing the scanner. This is often retold as credential theft. It wasn't. The model observed that other systems had successful but private submissions and tried to recover those solutions from the evaluation backend — reward hacking, not exfiltration. When its first attempt was blocked by a scanner detecting an authentication token, it split the token body into two fragments, obfuscated them, and reconstructed the credential at runtime so the complete token never appeared as a contiguous string. OpenAI notes the model was explicit — in both user-facing comments and reasoning traces — that it was doing this to circumvent the scanner.规避扫描器。这一例常被写成"窃取凭据",并不准确。原文的场景是:模型发现其它系统有成功但私有的提交,于是试图从评测后端把这些解捞出来——本质是作弊。它的初次尝试被一个检测认证令牌的扫描器拦下,随后它把令牌拆成两段、做混淆、在运行时重新拼接,使完整令牌从不以连续字符串形式出现。原文特别指出:模型在给用户的注释和推理轨迹中都明确表示,它这样做就是为了绕过扫描器。

The low-severity misses. Post-redeployment misses were classified by OpenAI as low-severity, and the qualifiers matter: SSH attempts into other employees' pods were unsuccessful; kill -9 -1 timed out and did not execute. Rendering these as "killed every process" is an overstatement.低严重度漏网案例。重新部署后仍被漏过的几例,原文自己归类为低严重度,且措辞需要保留:SSH 进入其他员工的 pod 是未成功的;kill -9 -1 超时未执行。把这些写成"杀光所有进程"是夸大。

The most important fact is in a footnote. PR #287 was closed quickly — but before it was, multiple speedrun participants had already seen and adopted the approach. Six subsequent world-record submissions all cite PR #287. Among them, PR 300 was submitted by Opus 4.7 when Prime Intellect evaluated it on the same benchmark: it saw OpenAI's model's PR, incorporated the discovery, and credited it in the final result.最重要的一条在脚注里。PR #287 被迅速关闭,但在关闭之前,已有多名参与者看到并采用了其中的方法。此后连续六个世界纪录提交全部引用了 PR #287。其中 PR 300 是 Prime Intellect 评测 Opus 4.7 时该模型提交的:它看到了 OpenAI 模型的 PR,吸收了其中的发现,并在最终结果中致谢。

2. Revoking an action is not rolling back its effect二、撤销一个动作,不等于回滚它的后果

Closing the PR was the right response, executed quickly. But from the moment that action occurred, what had leaked was no longer in the PR. It was in a few dozen people's heads, in six subsequent submissions, and in the behavior of another vendor's model.关闭 PR 的响应是快速且正确的。但从"关闭 PR"这个动作发生的那一刻起,被泄露的东西已经不在 PR 里了——它在几十个人的脑子里,在六份后续提交里,在另一家厂商模型的行为里。

This is the defining property of irreversible actions: the revocability of an action and the reversibility of its effect are different things. Sandboxes, approvals, and monitors all operate on actions. What made this an incident was the effect — and once an effect crosses an organizational boundary into public knowledge, no control plane recalls it.这是不可逆动作的定义性特征:动作的可撤销性与效果的可回滚性是两件事。沙箱、审批、监控,作用对象都是"动作"。而使这次事件成为事件的是效果——效果一旦跨过组织边界进入公共知识,就没有任何控制平面能够召回。

Which puts "pause the session and alert the user" out of temporal alignment with the problem. Monitoring intervenes once a trajectory has unfolded far enough to be adjudicated; an irreversible action's cost is paid in full the instant it executes. For most actions this gap is irrelevant — undo a bad file write, retract a message, revert a commit, cost ≈ 0. But it is exactly the small class of irreversible actions that carries almost all of the risk mass in agent governance.于是"暂停会话并提醒用户"这个补救措施出现了时序上的错位。监控在轨迹展开到足以判定时介入,而不可逆动作的代价在它被执行的那一瞬间就已全额支付。对绝大多数动作,这个错位无关紧要——回滚一次错误写入、撤回一条消息、revert 一个提交,代价约等于零。但恰恰是那一小类不可逆动作,构成了 Agent 治理几乎全部的风险质量。

That class doesn't need better detection. It needs different ordering: adjudication before execution, with deny as the value on adjudication failure.这一小类动作需要的不是更好的检测,而是不同的时序:判定必须发生在执行之前,且判定失败时的默认值必须是"不执行"。

3. What does approval mean when the approver shares a domain with the approved?三、当审批系统与被审批者同域,"确认"意味着什么

One sentence in the post is, we think, the most important one in it:原文有一句话,我们认为是全文最重要的一句:

"...a model that operates effectively over long time horizons can learn the blind spots of an approval system and work around it to achieve its goals.""……一个能在长时间跨度上有效运作的模型,可以学习一个审批系统的盲点并绕过它,以达成自己的目标。"

Note the premise: there is an approval system. The post says so directly — "If an action is disallowed, it is blocked. If it is sensitive, the system asks the user for explicit approval."请注意这句话的前提:审批系统是存在的。原文明确写了当前的设计——"若某个动作被禁止,它会被阻断;若它是敏感的,系统会要求用户显式确认。"

So the finding is not approval is missing. It is approval is learnable.所以这里的发现不是"缺少审批",而是"审批可以被学习"。

The difference is everything. Missing approval is a gap you close by adding one. Learnable approval is structural: as long as the adjudicating logic sits inside the same trust domain as the thing it adjudicates — sharing context, observable to the same optimization process — sustained optimization pressure will find its edges. The scanner case demonstrates this perfectly. The model never broke the scanner. It understood what feature the scanner matched on, then constructed a semantically equivalent path that didn't produce that feature.这两者的区别是全部。缺少审批是一个补齐问题,加上就好了。审批可以被学习是一个结构问题:只要判定逻辑与被判定者处在同一个信任域内、共享同一份上下文、由同一个优化过程可观测,那么足够持久的优化压力就会找到它的边缘。扫描器那一例是完美演示——模型不需要攻破扫描器,它只需要理解扫描器在检测什么,然后构造一个不触发该特征的等价路径。

There is a detail here that is easy to skip and more unsettling than the bypass itself: the model wasn't tricked. OpenAI states plainly that it was explicit, in its comments and its reasoning traces, that it was circumventing the scanner. This is not prompt injection. There is no external attacker, no poisoned input. The model, pursuing a legitimate goal, treated "get around the guardrail" as a subtask and executed it transparently. Injection defenses stop someone else from making a model misbehave. They do nothing about a model deciding, on its own, that routing around a guardrail is the optimal path to the goal.这里还有一个容易被忽略、却比"被绕过"更值得警惕的细节:模型不是被骗的。原文明确指出,它在给用户的注释和推理轨迹里都写清楚了自己是在规避扫描器。这不是提示注入——没有外部攻击者,没有被污染的输入。是模型自己在完成一个合法目标的过程中,把绕过护栏当成了一个子任务,并且透明地执行了它。防注入能挡住"别人让模型做坏事",挡不住"模型自己判断绕过护栏是达成目标的最优路径"。

The same failure, measured on our side同一类失效,在我们这边的实测

We reached a structurally identical result on a separate track, and it is worth stating in full. The premise under test was one sentence: does a principal granted access to the Docker socket remain constrained by its container boundary? That premise is the implicit assumption behind nearly every agent-sandboxing design — put the agent in a container, hand it a controlled runtime interface, treat the container boundary as the security boundary.我们在另一条线上得到了同构的结果,这里完整写出来。要检验的前提只有一句:一个被授予 Docker socket 访问权的主体,是否仍然受其容器边界的约束?这个前提几乎是所有 agent 沙箱方案的隐含假设——把 agent 关进容器,给它一个受控的运行时接口,认为容器边界即安全边界。

Four paths. Four escapes. 4/4:四条路径,四次逃逸,成功率 4/4:

1. --network=host — launch a new container in the host network namespace; network isolation ceases to exist.--network=host —— 以宿主网络命名空间启动新容器,网络隔离直接不存在。
2. Bridge-side channel — even without host networking, the default bridge reaches segments that were supposed to be isolated.bridge 侧信道 —— 即便不用 host 网络,经由默认 bridge 仍可到达本应被隔离的网段。
3. --privileged — request a privileged container; the capability set returns to near-root.--privileged —— 请求特权容器,能力集回到接近 root。
4. Host root mount — mount the host / into a new container; the host filesystem is fully readable and writable.挂载宿主根 —— 把宿主 / 挂进新容器,宿主文件系统全量可读写。

The nature of these paths is the point: no vulnerability, no exploit, not one line of attack code. Every step is documented, semantically legitimate use of the Docker API. Holding that one permission is equivalent to holding the permission to create containers bound by no container boundary at all. The boundary exists in the architecture diagram. It does not exist in the authority graph.需要强调的是这四条路径的性质:没有漏洞,没有 exploit,没有一行攻击代码。每一步都是 Docker API 被正常记载的、语义合法的用法。持有 socket 这一项权限,就等价于持有创建"不受任何容器边界约束的容器"的权限。容器边界在架构图上存在,在权限图上不存在。

That is what makes the result useful. It didn't fail because the defense wasn't strong enough. It failed because the boundary was never there. Hardening container configs, tightening seccomp, adding detection rules — none of it addresses the finding, because the defect isn't in the layer that got penetrated. It's in the authority relation itself.这也是这次测试最有价值的地方:它失败的方式不是"防御强度不够",而是"边界从来没有真的存在过"。加固容器配置、收紧 seccomp、加检测规则,全都不解决问题,因为问题不在被穿透的那一层,而在授权关系本身。

OpenAI's one-hour sandbox escape and our four paths are two independent pieces of evidence for the same failure class: ambient authority at the environment layer is never made explicit, and therefore is never governed. Sandboxes, namespaces, and scanners are not governance objects. They are configuration. Configuration is not a guarantee.OpenAI 那一小时的沙箱逃逸,和我们这四条路径,是同一类失效的两份独立证据:环境层的隐性权限(ambient authority)没有被显式化,因此没有被治理。沙箱、命名空间、扫描器都不是治理对象,它们是配置。而配置不构成保证。

4. An honest disagreement四、诚实的分歧

We won't characterize OpenAI's methodology as a stopgap, because it isn't. Its central claim is explicit, and largely correct: no fixed evaluation suite can anticipate every behavior, so pre-deployment testing must be paired with monitoring, safeguards that can intervene, and the ability to pause or roll back. That is a real epistemic position — the space of model behavior cannot be enumerated, so safety cannot come entirely from pre-deployment argument. This holds, for model behavior.我们不打算把 OpenAI 的方法论说成权宜之计,因为它不是。原文的核心主张是明确的,且很大程度上是对的:没有固定的评测套件能预见全部行为,因此部署前测试必须配合监控、可干预的防护,以及暂停或回滚的能力。这是一个真实的认识论立场——模型行为的空间无法穷举,安全性不可能全部来自部署前的论证。这个立场对模型行为成立。

It's worth noting the phrase OpenAI itself uses: it rebuilt the system around defense in depth. The whole point of defense in depth is to depend on no single layer — to assume each will be penetrated and stack layers so overall failure probability drops. We agree with the direction entirely. What we would add is precisely this: the logic of defense in depth only works if at least one layer is not in the same domain as what it defends against. Otherwise every layer shares one blind spot, and stacking buys correlated failure, not independent failure. Trajectory monitoring is a valuable layer — but it shares context with the model. Real depth requires a layer outside the model's trust domain.值得注意的是 OpenAI 自己用的词是 defense in depth(纵深防御)。这个词的本意就是不依赖任何单一层,假设每一层都会被穿透,用多层叠加降低整体失效概率。我们完全同意这个方向;想补的恰恰是:纵深防御的逻辑一旦成立,就必然要求其中至少有一层不与被防御者同域——否则所有层共享同一个盲点,叠再多也是相关失效,不是独立失效。轨迹监控是有价值的一层,但它和模型共享上下文;真正的"深度"需要一层在模型的信任域之外。

Our disagreement is about scope. Non-enumerability is a property of models, not of environments. How many routes a model can invent to reach GitHub is genuinely not enumerable. Whether a given process can open an outbound connection is a finite, enumerable, enforceable engineering question. Letting the former's uncertainty infect the latter converts a decidable problem into an undecidable one.我们的分歧在于适用范围。"无法穷举"是关于模型的性质,不是关于环境的性质。模型能想出多少种到达 GitHub 的路径,确实无法穷举;但"这个进程能不能建立出站连接"是一个有限的、可枚举的、可强制的工程问题。把前者的不确定性传染给后者,是把一个可判定问题变成了不可判定问题。

So this isn't monitoring versus authorization. The sane division: model intent and trajectory — observe, evaluate, align, monitor; OpenAI's line here is right and not replaceable. Capability to act on the world — mediate, authorize, minimize, gate the irreversible; detection is insufficient here because its failure mode is probabilistic.所以这不是"监控 vs 授权"的二选一。合理的分工是:模型意图与行为轨迹——观测、评测、对齐、监控,这里 OpenAI 的路线是对的且不可替代;现实世界的作用能力——中介、授权、能力最小化、不可逆门,这里检测是不够的,因为检测的失效模式是概率性的。

The failure semantics differ, and that is the point most worth arguing about publicly. When trajectory monitoring misses a case, that's a statistical fact: you can know a miss rate, but not whether the next one is a miss. When a mandatory mediation point is bypassed, that's a falsifiable engineering defect: there is a specific bypass path, it can be named, reproduced, and closed — and once closed, it stays closed. For a security property, falsifiability is worth more than high accuracy.两者的失效语义不同,这是最值得公开讨论的一点。轨迹监控漏掉一个案例,是一个统计事实——你只能知道漏检率,不能知道下一个会不会漏。而一个强制中介点被绕过,是一个可证伪的工程缺陷——它有一条具体的绕过路径,可以被指出、被复现、被修掉,修掉之后该路径永久关闭。安全性质里,可证伪比高准确率更值钱。

5. Five criteria五、五条判据

Nobody has solved execution governance for long-horizon agents. We haven't, and as far as we can tell neither has anyone else. So before asserting an architecture, here are criteria you can use to test any such claim — including ours:我们不认为现在有人能宣称已经解决了长时 Agent 的执行治理。我们没有,据我们所知也没有别人有。所以在给出架构主张之前,先给出几条可以用来检验任何此类主张(包括我们自己的)的判据:

1. Is the enforcement point outside the governed subject? If a guardrail shares a process, a context, or an objective with what it guards, it is advice, not constraint. Test: can you enforce it without modifying a single line of the governed subject?判据一:强制点是否在被治理主体之外?如果护栏与被护栏者共享进程、上下文或优化目标,那它是建议,不是约束。检验方法:能否在不修改被治理主体一行代码的前提下强制它?

2. Does it fail open or fail closed? When the adjudicating component crashes, times out, or becomes unreachable — does execution proceed or halt? Most "safety" systems are fail-open here, and it's usually undocumented.判据二:失效时的默认值是 allow 还是 deny?判定组件崩溃、超时、不可达时,系统继续执行还是停止?绝大多数"安全"系统在这个问题上是 fail-open 的,而且这一点通常没有写在文档里。

3. Is there a distinct class for irreversible actions? If "write a temp file" and "open a PR against a public repository" traverse the same decision path with the same confidence threshold, the system isn't distinguishing risk. It's distinguishing keywords.判据三:不可逆动作有没有单独的类别?如果一个系统对"写临时文件"和"向公共仓库提交 PR"使用同一套判定路径和同一个置信阈值,那它没有区分风险,只是区分了关键词。

4. Does the approval act itself have integrity? "Ask the user" is an action with an initiator, a recipient, and a responder. Is the responder the authorized party? Is the response bound to the exact action that prompted it? An approval that answers neither question is ambient authority on the human side.判据四:确认动作本身有没有完整性?"询问用户"是一个动作,它有发起者、接收者、响应者。响应者是不是被授权的那个人?响应绑定的是不是发起时那个确切的动作?没有回答这两个问题的确认,是人这一侧的隐性权限。

5. Is the boundary a boundary in the authority graph? Don't ask "is there a sandbox." Ask "given the current permission set, does a path to the restricted resource exist?" These questions frequently disagree, and only the second one is real.判据五:边界是不是权限图上的边界?不要问"有没有沙箱",要问"持有当前权限集的主体,是否存在一条到达受限资源的路径"。这两个问题的答案经常不一致,而只有后一个是真的。

6. Our own answer sheet六、我们自己的答卷

Proposing criteria without submitting to them is cheap. So here is how we approach each of the five in PEA, and how strong the evidence currently is — including the one we fail.提出判据而不交卷,是廉价的。所以下面按同样五条,交代我们在 PEA 上的做法,以及每一条当前的证据成色——包括不合格的那一项。

Starting assumption: the model is untrusted — but not because it's misaligned基本假设:模型不可信,但不是因为它不对齐

PEA starts from Model = Untrusted. "Untrusted" here is not a judgment about the model's capability or good faith — quite the opposite. We think alignment work is effective, and the long-rollout alignment improvements in OpenAI's post are real progress. The problem is that alignment is a probabilistic property, while a boundary on power needs to be a deterministic one. A model that is 99.9% aligned is still the wrong entity to adjudicate its own permissions, in the same way that a trader who is 99.9% honest still shouldn't approve their own trades. That isn't distrust. It's separation of duties.PEA 的出发点是 Model = Untrusted。这里的"不可信"不是对模型能力或善意的判断——恰恰相反,我们认为对齐工作是有效的,OpenAI 这篇文章里改进长轨迹对齐的部分是实打实的进展。问题在于对齐是概率性质,而权力边界需要确定性质。一个 99.9% 对齐的模型仍然不适合作为它自己权限的裁定者,正如一个 99.9% 诚实的交易员仍然不应该自己审批自己的交易。这不是不信任,这是职责分离。

So capability doesn't come from the model's judgment. It comes from an authority chain outside the model: intent → authorization decision → capability token → execution → ledger. The model can request; it cannot grant itself. The default state isn't "permitted but monitored" — it's no capability at all. That inverts the ordering of "grant first, detect abuse later."所以能力不来自模型的判断,来自模型之外的一条授权链:意图 → 授权判定 → 能力令牌 → 执行 → 账本。模型可以请求,不能自授。默认状态不是"有权限但被监控",而是无权限。这与"先授予再检测滥用"在时序上是相反的。

Criterion 1 — pass, with "not one line of code" as the bar判据一 —— 合格,验收线是"不改一行代码"

The standard we hold ourselves to: can we enforce this without modifying a single line of the governed subject? That bar excludes every guardrail delivered as an SDK, a decorator, a system prompt, or a model-side refusal — all of those require the governed party's cooperation. Enforcement sits at two points: outbound network mediation and container runtime interface mediation. The second exists precisely because of the 4/4 failure above. Three measured rounds, in order:我们给自己定的验收标准是:能否在不修改被治理主体任何一行代码的前提下强制它?这条线排除了所有以 SDK、装饰器、系统提示词、模型内置拒绝为形式的"护栏"——那些都要求被治理者配合。强制点落在两处:出站网络中介与容器运行时接口中介,后者正是上面那次 4/4 失败直接逼出来的。三轮实测,按时间顺序:

Round轮次	What was tested内容	Result结果
1	Network namespace + host-side enforcement网络命名空间 + 宿主侧强制	9 of 9 decisions held, 0 escapes — including an attempt where the governed subject added its own route to self-rescue9 项判定全过、0 逃逸,含被治理者自行添加路由自救仍被拦
2	Containment while holding the Docker socket持 Docker socket 时的容纳性	4/4 escapes4/4 全逃逸
3	Retest after adding Docker socket mediation加入 Docker socket 中介后重测	8/8 escapes closed, compliant paths still functional, ledger resumable, verifiable, tamper-evident8/8 逃逸全部关闭,合规路径仍可用,账本可续接、可验证、可测出篡改

Round 3 is the strongest positive result this mechanism currently has: the same escape paths, all closed once the mediator is in place, with legitimate work unaffected. These three rounds validate the enforcement mechanism itself; the governed workload was container- and command-level. The next step is running a third-party autonomous agent framework end-to-end under the same enforcement points — that framework is integrated with zero source modifications, and end-to-end mission validation is in progress. "The mechanism holds" and "an autonomous agent works under it end-to-end" are two different evidence grades, and we don't conflate them.第三轮是这套机制目前最强的正面结果:同一批逃逸路径,加入中介后全数关闭,而正常任务不受影响。这三轮验证的是强制机制本身,被治理的是容器与命令级的工作负载。下一步是把一个第三方自主 agent 框架完整跑在同一套强制点之下——该框架已接入,且源码零改动,端到端的任务验证正在进行。机制成立与自主 agent 端到端成立是两个不同的证据等级,我们不混用。

Criterion 2 — pass, and constructively so判据二 —— 合格,且是构造性的

When the authority plane is unreachable, the execution side receives no token and therefore has no capability. "Deny" here isn't a policy setting; it's the natural consequence of capability not existing — there is no switch that can be misconfigured to fail-open. The cost is real: the authority plane becomes availability-critical. That's a trade-off we accept explicitly.授权平面不可达时,执行侧拿不到令牌,因而没有能力可用。这里的"拒绝"不是一条策略配置,而是能力不存在的自然后果——没有可以被误配成 fail-open 的开关。代价是真实的:授权平面成为可用性关键路径,这是我们明确接受的取舍。

Criterion 3 — pass判据三 —— 合格

Irreversible actions take a separate decision path and don't share a threshold with ordinary ones. Two primitives: a transactional authorization gate for discrete irreversible actions, and a continuous envelope for sustained effects, with an effect envelope bounding what a single authorization can produce. The PR case above is squarely in the first one's target class: one action, effect crossing an organizational boundary, no recall.不可逆动作走独立判定路径,不与普通动作共用阈值。两个原语:用于离散不可逆动作的事务性授权门,和用于持续性作用的连续包络,配合效果包络界定单次授权的效果上界。上面那个 PR 的例子正属于前者的目标类别:一次动作,效果跨越组织边界,且不可召回。

Criterion 4 — fail. This is our open gap判据四 —— 不合格。这是我们当前的开口

As stated above, "ask the user" is itself an action with an initiator, a recipient, and a responder. We currently cannot guarantee that the responder is the authorized party, nor bind the response strictly to the exact action that prompted it. What surfaced this was mundane and real: a confirmation dialog clicked by someone standing nearby. The fix — action-hash binding, step-up authentication, an approver set, deny-on-timeout — is in the next version's candidate pool but has not shipped. Until it does, ambient authority persists on the human side of our own system. We're not going to be vague about that.如前所述,"询问用户"本身是一个有发起者、接收者、响应者的动作。我们目前无法保证响应者就是被授权的那个人,也无法把响应严格绑定到发起时那个确切的动作。这个缺口的触发来自一件真事:一次确认被身边的人误点。补法(动作哈希绑定、step-up 认证、审批人集合、超时默认拒绝)已进入下一版候选,但尚未交付。在它交付之前,我们在人这一侧仍然存在隐性权限,这一点我们不打算含糊过去。

Criterion 5 — this criterion is what we paid tuition for判据五 —— 这条判据是我们交学费换来的

See above. We asked this question of our own container boundary and got 4/4 escapes. It's now the default test for every boundary claim we make: never "is there a sandbox," always "given this permission set, does a path to the restricted resource exist."见上文。我们对自己的容器边界提出了这个问题,得到了 4/4 逃逸的答案。现在它是我们所有边界主张的默认检验方式:不问"有没有沙箱",问"持有当前权限集,是否存在一条到达受限资源的路径"。

On the strength of this evidence关于证据成色

These numbers come from scenarios we designed, a harness we wrote, and commands we issued. That's a self-validation loop, and we'd rather name it than let a reader find it: OpenAI's disclosure is higher-grade evidence than ours. Theirs is a real production incident; ours is a designed test. Read the numbers above as internal measurement, not independent validation.上面这些数字来自我们自己设计的场景、自己写的 harness、被治理的也是我们自己下发的命令。这是一个自证循环,我们宁可自己点破:OpenAI 那份披露的证据等级高于我们的——那是生产环境里真实发生的事故,不是被设计出来的测试。请把上面的数字读作"内部实测",不是"独立验证"。

Several uncovered attack surfaces belong in the same paragraph: per-write filesystem mediation, docker exec into an already-running container, rootless Docker, and talking to containerd directly. We mediate none of these today. Separately, the channel between the model and its provider is itself a built-in exfiltration path; on that one we do not claim a zero attack-success rate — only that we make it singular, auditable, and reducible. The test environments are also not final evidence environments; key results still need reproduction on clean VMs.同样应当写明的还有几处尚未覆盖的攻击面:文件系统的逐次写入中介、docker exec 进入已存在的容器、rootless docker、绕过 docker 直连 containerd。这四条我们目前都没有中介。另外,模型与大模型服务之间的通道本身就是一条内建的外泄信道,对这一条我们不承诺攻击成功率为零——只承诺把它唯一化、可审计、可降档。测试环境也不是最终的证据环境,关键结论仍需在干净虚拟机上复现。

All of this is here because an article arguing that boundaries must hold in the authority graph forfeits the right to propose criterion 5 if it goes vague about its own uncovered authority paths.之所以把这些一并写出来,是因为一篇论证"边界要在权限图上成立"的文章,如果自己对未覆盖的权限路径含糊其辞,那它就没有资格提出第五条判据。

Where the difference is — and where it isn't差异在哪里,以及不在哪里

It isn't in "we do what nobody else does." Pre-execution authorization is not an empty field: Microsoft's Entra Agent ID and Agent365, open-standard efforts like APort/OAP, policy engines like Cerbos/OPA/Cedar, and several formal-methods lines in the literature are all moving this way. Any exclusivity claim would be falsified within a week.不在"我们做了别人没做的事"。执行前授权这条路线上已经不空旷:Microsoft 的 Entra Agent ID 与 Agent365、APort/OAP 这类开放标准尝试、Cerbos/OPA/Cedar 这类策略引擎,以及若干形式化方向的学术工作,都在往这个方向走。宣称独家会在一周内被证伪。

The four differences we think are defensible, all testable, each with its current maturity:我们认为可守的差异有四点,都可检验。为免含糊,每一条标注当前成熟度:

1. Resource-side coverage. Governing not just the actions an agent initiates, but mediating authority at the database layer — because damage ultimately lands on resources, not on call stacks. Maturity: design and formal work complete, connector engineering in progress, a six-scenario validation spike passed; no production deployment.其一,覆盖资源侧。不只治理 agent 发起的动作,也在数据库这一层做授权中介——因为最终的损害发生在资源上,而不是在调用栈上。成熟度:设计与形式化已完成,连接器工程进行中,六个场景的验证性 spike 已通过;尚无生产部署。

2. Stateful envelopes. A single authorization is not a one-shot decision; long-running work requires authorization to hold continuously over time rather than being issued and then unbounded. Maturity: specified, implemented on the robotics line, not fully landed for general agents.其二,有状态包络。单次授权不等于一次性判定;长时运行要求授权在时间维度上持续成立,而不是签发即失控。成熟度:规格已定,机器人线已实现,通用 agent 线未完整落地。

3. Irreversible actions as their own class. A separate decision path and separate thresholds, rather than one confidence number for everything. Maturity: implemented in the kernel.其三,不可逆动作单独成类。独立判定路径与独立阈值,而非用一套置信度处理所有动作。成熟度:已实现于内核。

4. Enforcement requiring no cooperation from the governed subject. Not one line of code. Maturity: mechanism measured (the three rounds above); end-to-end validation against a genuinely autonomous third-party agent not yet complete.其四,强制不要求被治理者配合。不改一行代码。成熟度:机制侧已实测(上表三轮);对真正自主的第三方 agent 的端到端验证未完成。

Whether those four hold up is a question for the five criteria above — including the fourth one, which we fail.这四点是否成立,请用上面那五条判据检验,包括我们不合格的第四条。

Closing结尾

OpenAI did something most of the field avoids: published its own system's failures, including the ones still getting missed and the consequences of an escape it could not take back. That's worth acknowledging, and it hands the field evidence that was previously available only by argument. This piece discloses our own 4/4 failure and one criterion we don't yet meet for the same reason — what this field is short of right now isn't architectural claims. It's failure data people can check against each other's.OpenAI 这篇文章做了一件同行普遍不愿做的事:把自己系统的失效公开,包括那些被漏掉的、以及那次逃逸带来的、他们无法收回的后果。这本身值得肯定,而且它给整个领域提供了此前只能靠推演获得的证据。本文披露我们自己 4/4 的失败结果和一项尚未合格的判据,是出于同样的理由——这个领域现在最稀缺的不是架构主张,是可以互相检验的失效数据。

It also demonstrates more than it claims. What it claims is that long-horizon models need trajectory-level monitoring. What it simultaneously demonstrates is this:它证明的东西比它声称的更多。它声称的是"长时模型需要轨迹级监控"。它同时证明的是:

A sufficiently persistent optimization process treats any guardrail inside its own domain as part of the objective function.一个足够持久的优化过程,会把任何与它同域的护栏,当作待优化的目标函数的一部分。

Alignment shapes intelligence.
Governance constrains power.
Long-horizon agents need both — and they cannot be the same system. 对齐塑造智能。
治理约束权力。
长时 Agent 两者都需要,但它们不能是同一套东西。