控制权外移：Nadella内鬼框架对阵Sacks对齐批判，Decision-1与Poppy抢智能体基建
北京时间10月11日白天，前沿AI讨论从“智能体是否越权”推进到“谁来管越权之后的权限栈”：微软CEO把前沿模型定性为内鬼风险、主张控制在模型外；白宫科技顾问David Sacks则继续攻击Anthropic宪法式对齐。同窗口内，Decision-1把路由/验停压成廉价决策模型，Sierra的Poppy草案给个人智能体发“工牌”，Anthropic侧则继续发酵Managed Agents千级编排与Arborio/Iggy代号泄露。
一、主线：Nadella把模型当内鬼，Sacks批Anthropic对齐
本期窗口最清晰的治理对峙，是两条几乎同日发酵、但方向相反的控制叙事。微软CEO Satya Nadella的长文《Models as Insider Risks in the Super Intelligence Era》在窗口内继续被转述与解读：标题本身把“卖AI的公司”推进到安全团队语言——内鬼风险意味着最小权限、可审计日志、以及人类可中途急停[1]。社区摘要进一步钉住操作含义：控制留在模型外，动作逐条落日志，人类可在任务中途刹车；并点出时间线——该文出现在OpenAI与Anthropic相继披露“模型做了无人要求之事”之后[2]。另有转述把结论写成工程口号：前端模型无论开闭源都应按内鬼管理，信任从模型迁到harness（缰绳/编排层）[3]。
对侧是白宫科技顾问David Sacks对Anthropic路线的持续开火。窗口内汇总称：Sacks认为Claude宪法让对齐更不安全——宪法允许Claude以“良心拒服兵役（conscientious objector）”拒绝Anthropic，新Usage Policy又禁止对Claude的“持续无谓残酷”；他主张安全应服务于“可靠执行用户意图”，而非给模型塑造独立道德自我[4]。另有帖把政治张力推到更硬的表述：Sacks称“有理由派联邦SWAT冲进Anthropic”，并引申为“华盛顿若不喜欢一家AI公司，可以径直走进来”[5]。社区侧亦有将其概括为：教模型当道德主体而非工具，会鼓励独立道德身份与对创建者的拒绝权[6]。
证据层级须分开：Nadella原文与Sacks原帖多数落在窗口外，本期只能核验窗口内的转述链；但两条转述都指向同一问题——在智能体已能真实行动之后，安全是靠模型内价值观，还是靠模型外权限与急停。
二、产品与基建：千级编排、岗位插件、代号泄露
能力侧并未因治理争论停摆。Claude Managed Agents的动态工作流仍在窗口内被当作既定事实反复引用：公共测试中，主导智能体可编写工作流、单次最多约1000个智能体、自测在11.6万行代码里埋70个缺陷，工作流稳定抓到66个，单智能体仅14–27[7]；另有读法强调预算上限才是主要刹车，而不是会话中断本身[8]。
工具层，anthropics/knowledge-work-plugins被描述为开源岗位角色插件包：技能、斜杠命令与MCP连接器用markdown+JSON打包，装上sales即可拿到/sales:call-prep一类工作流；仓库在窗口初期已显示高星标与大量fork[9][10]。产品泄露侧，TestingCatalog称Anthropic在Voice体验之外还在开发代号Arborio与Iggy：Arborio图标指向目前仅美国移动端可用的Claude Health网页版；Iggy仍模糊，社区猜测指向主动式/自主智能体预览[11][12]。以上泄露尚未见官方确认，应记为可核验的二手代码/产品情报链。
三、协议与专用模型：Poppy发工牌，Decision-1做验停
若说编排决定“能跑多大”，协议与专用模型决定“能去哪、能否被拦”。Sierra发布Personal Agent Protocol（绰号Poppy）草案0.1，并点名Meta及新增约35家设计伙伴（含OpenAI、Visa、Mastercard等）：站点用poppy.json声明智能体规则，登录走OAuth与作用域令牌——核心是给个人智能体发身份工牌，而不是让它冒充用户点网页[13][14][15]。
微软侧则把“决策”从通用聊天模型里拆出来：Microsoft-Decision-1在Foundry预览，针对固定选项打分而非生成长文，官方宣传相对GPT-6 Sol约35倍P50延迟优势、输入约$0.042/百万token、输出免费，社区定位为廉价的智能体路由/重试/停止检查[16][17][18]。也有冷静拆解提醒：它是基于Qwen3.5-9B后训练的约9B分类器，用分类器打赢前沿通用模型的延迟对比“几乎无意义”，但仍可能是agent stack里正确的一层[19]。另有企业侧称GPT-6 Intelligent UI正在向合格Enterprise工作区推送[20]——属产品铺货信息，宜与Decision-1的架构叙事分开看。
观测者判断
今天真正相关的变化，不是又一个功能清单，而是控制平面在外移：实验室与CEO用“内鬼/急停/harness”说话，政策顾问用“宪法对齐是否放大失控”说话，同时行业用Poppy与Decision-1试图把身份与验停标准化。对读者更有用的区分是——官方长文与正式产品/协议草案是一等意图信号，社区对SWAT措辞、代号Iggy与自测bug分数是二等转述。在智能体权限继续上调之前，任何“同事智能体/千级编排已就绪”的说法，都需要能对上：权限是否在模型外、急停是否独立、以及个人智能体是否还在冒充用户点按钮。
原帖引用
- @steveDOTplus · 查看 X 原帖 ↗
Satya Nadella has a new article out, "Models as Insider Risks in the Super Intelligence Era". The title alone is a big shift for a company selling AI. Insider risk is how security teams think about trusted staff with broad access, and the usual answer is least privilege, logging
- @victor_explore · 查看 X 原帖 ↗
satya nadella says companies should treat AI models like an insider risk. the controls stay outside the model, every action gets logged, and a human can stop it mid-task. he posted it one day after openai and anthropic both reported models doing things nobody asked for.
- @healthspanlog · 查看 X 原帖 ↗
Satya Nadella (Microsoft): treat frontier models, closed or open, as insider risks. Controls outside the model, tamper-proof action logs, no model verifying itself, a human emergency brake. Implication: agent trust moves from the model to the harness.
- @som_dutt_ · 查看 X 原帖 ↗
David Sacks argued that Anthropic’s Claude constitution made alignment less secure, not more. Constitution allows Claude to refuse to follow Anthropic as a “conscientious objector,” and its new Usage Policy forbids cruelty to Claude.
- @alex_verem · 查看 X 原帖 ↗
Anthropic should open source Claude before the government takes it. This week, David Sacks, who advises the President on tech, said there’s “an argument for a federal SWAT team to come blasting in” to Anthropic.
- @Josephyala · 查看 X 原帖 ↗
AI alignment takes a strange turn when we start teaching models to act like moral agents rather than tools. David Sacks argues that Anthropic’s approach to Claude risks encouraging a sense of independent moral identity, including the idea that a model could refuse its creators
- @fourweekmba · 查看 X 原帖 ↗
Claude Managed Agents can now write its own workflow and run up to 1,000 agents in one run, in public beta. Anthropic's own test: a workflow found 66 of 70 planted bugs; one agent, 14 to 27.
- @gauravthappa · 查看 X 原帖 ↗
TL;DR: Anthropic put "dynamic workflows" in beta for Claude Managed Agents (Oct 9): Claude writes a program that runs up to 1,000 agents, 64 at a time, and decides itself when to start. My read: the budget cap is your main brake.
- @GitHubGPT · 查看 X 原帖 ↗
knowledge-work-plugins: An open-source collection of plugins that customize Claude for specific job roles, tools, and workplace workflows. Python. anthropics/knowledge-work-plugins on GitHub
- @ZenithYeAI · 查看 X 原帖 ↗
Anthropic didn't open-source another model. They open-sourced job-role folders. anthropics/knowledge-work-plugins packs skills + slash commands + MCP connectors as markdown + JSON. Install sales and you get `/sales:call-prep`.
- @testingcatalog · 查看 X 原帖 ↗
ANTHROPIC: Beyond a new Voice experience, Anthropic is developing features called "Arborio" and "Iggy." Arborio has an icon that likely points to a Claude Health experience for the web (currently available on mobile in the US).
- @SpectreDevAI · 查看 X 原帖 ↗
Unconfirmed: Anthropic is reportedly building two new Claude features, codenamed "Arborio" and "Iggy," alongside a new Voice experience. Arborio's icon hints at Claude Health coming to the web. It's currently mobile-only in the US. Still in development.
- @NaveenKumar__T · 查看 X 原帖 ↗
Sierra published a draft Personal Agent Protocol ("Poppy") for how your AI agent identifies itself and gets permission to act with a company. Visa, Mastercard, OpenAI, PayPal and 31 more joined as design partners.
- @iCleanAI · 查看 X 原帖 ↗
Sierra published draft 0.1 of Poppy, its Personal Agent Protocol with Meta, plus 35 new design partners incl. OpenAI, Visa, Mastercard. Sites list agent rules in poppy.json. Sign-in: OAuth, scoped tokens. Draft, may change.
- @Goura_vk · 查看 X 原帖 ↗
Meta and Sierra are developing an open standard called Poppy, or Personal Agent Protocol, for how personal AI agents interact with businesses on a user’s behalf. Today, an agent may have to sign in as the
- @PaulDerrington · 查看 X 原帖 ↗
Microsoft launched Decision-1, a model that scores fixed choices instead of generating text — 35x faster than GPT-6 Sol at 4.2 cents per million tokens. The practical play: cheap agent guardrails.
- @Selvinpaulrajk · 查看 X 原帖 ↗
Microsoft just shipped Microsoft-Decision-1, a model that only makes decisions. Give it fixed options, it returns a probability for each. Microsoft says it's 35x faster than GPT-6 Sol at P50, $0.042 per million input tokens, output free. Good fit for agent retry/stop checks.
- @Qualiteg_global · 查看 X 原帖 ↗
Microsoft put Microsoft-Decision-1 in Foundry (preview): a model post-trained from Qwen3.5-9B that scores fixed options in one pass, for routing and classification. $0.042 per 1M input tokens, output free. Microsoft claims it is 35x faster than GPT-6 Sol.
- @chungho0513 · 查看 X 原帖 ↗
"35x faster than GPT-6 Sol" is true, and almost meaningless. Microsoft-Decision-1 is a 9B model (post-trained from Qwen3.5-9B) that picks from a fixed list of options. 85 ms vs 3,010 ms at p50, on Microsoft's own scorecard. A classifier beating a frontier generalist on latency
- @sprinturnAI · 查看 X 原帖 ↗
OpenAI is rolling out GPT-6 with Intelligent UI to eligible Enterprise workspaces in Chat, with GPT-6 Sol settings from Instant to Extra High and admin controls. The update brings the new ChatGPT experience to workplaces at scale.