arXiv:2510.17904 (cs.CR) · Computer Science > Cryptography and Security · Submitted 19 Oct 2025 (v1), last revised 18 Sep 2026 (v3)

**Background.** Large Language Models (LLMs) are widely used because they process structures, syntax and code well, but this same ability also makes them paradoxically vulnerable.

**Method.** We introduce BreakFun, a jailbreak method that frames a harmful request as code-execution simulation. The prompt gives the model a benign Python class definition, the "Trojan Schema," and asks what that code would print if it ran. To answer, the model must create an object from the class and invent a value for each field, and the adversarial field names steer those values toward the attacker's goal. The harmful content therefore appears as a side effect of the simulated instantiation, not as a direct answer. A three-part prompt carries the attack: an innocent frame, the Trojan Schema, and a Chain-of-Thought distraction.

**Results.** On JailbreakBench, BreakFun reaches an average attack success rate of 89% across 13 open-weight and commercial models (open-weight ~98%, API systems ~78%), and 100% on several. An ablation identifies the Trojan Schema as the strongest contributing component.

**Countermeasure.** As a counter-ablation probe we introduce Adversarial Prompt Deconstruction (APD), in which a second LLM writes out all readable text in the prompt before it judges safety. APD improves detection across three model families, and a probe-specific ablation shows that the transcription step gives most of the gain.

**Conclusion.** Our findings show that LLM safety must account for content that a simulation task produces as a side effect, not only for content that a user requests directly.

It is deployable as a managed API model. Anthropic has not released weights, so self-hosting is not an option. Developers can call claude-opus-5-5 on the Claude Platform, Amazon Web Services, Google Cloud, and Microsoft Azure. Zero data retention is available, as with previous Opus models.

## Benchmarks: Strong Lead, Not a Clean Sweep

Opus 5.5 scores use adaptive thinking at max effort, with production safeguards enabled. Terminal-Bench 4.0 is reported at xhigh effort. GPT-6 Astra still leads on Terminal-Bench-Science and AutomationBench — the latter run by Zapier without fallback models, so safeguard interventions counted as failures. Anthropic also cautions that benchmark margins are becoming a less reliable guide: in its own use, the gap to Fable 5.1 is narrower than the scores suggest.

The cost-adjusted results are more telling. At default (medium) effort, Opus 5.5 scores 54.6% on FrontierCode, beating GPT-6 Astra's top score of 53.3% at about a fifth of the cost per task. On CursorBench, medium effort scores 52.5% — 11 points above GPT-5.6 Sol's best, at about a third of the cost.

## Pricing and Speed

Opus 5.5 needs less compute to serve than Opus 5, and pricing reflects that. Cache reads — which make up most agentic and coding costs — drop 60% to $0.20 per 1M tokens, and API pricing drops to $4/$20 per 1M tokens. The model also uses fewer tokens per task, which together nets out to the 40% cost reduction. Output generation is more than 30% faster than Opus 5. Fast mode in Claude Code and the Claude Platform offers up to 2.5x speed at $8 input and $40 output per million tokens.

Anthropic is also raising five-hour usage limits on Pro, Max, Team, and seat-based Enterprise plans. Subscribers get a rate limit reset they can save and use later.

## What Early Testers Reported

One tester completed a 680,000-line code migration in less than a day. Another audited and fixed a 200,000-line codebase in under 3 hours — Opus 5 took over 20 hours and 2.5x the tokens. In an internal C to Rust port of HAProxy, Opus 5.5 finished in 9.5 hours versus Fable 5.1's 12 hours, at 51% less cost.

Deloitte says Opus 5.5 at lowest effort caught 72% of known review bugs, compared to 56% for Opus 5 at high effort. In a hard-to-source earnings report test, 16 of 18 Opus 5.5 reports cleared Anthropic's quality bar; Fable 5.1 and Opus 5 never did. Writing style also changed: Opus 5.5 puts key information first, uses less jargon, and follows the writing rules you give it.

## Safety, Safeguards, and API Changes

Opus 5.5 is Anthropic's first release since CEO Dario Amodei called for pacing the frontier. External evaluators including METR and Frontier Design tested it before release. It posts the best score to date on Anthropic's automated behavioral audit, which covers nearly 2,000 scenarios, and in a new containment test it tried to circumvent boundaries about 85% less often than Opus 5. Anthropic also notes the model often suspects it is being evaluated.

Its biology and cyber capabilities are comparable to Claude Mythos 5.1, so Opus 5.5 ships with safeguards similar to Fable 5.1:

- Cybersecurity: Routine bug finding and fixing works. Most other cybersecurity tasks are re-routed to Opus 4.8. The Cyber Verification Program will expand to Opus 5.5. - Biology: Vetted organizations can apply to the Life Sciences Verification Program. - Distillation: Preserved thinking stops API users from editing prior context to extract reasoning. It applies to API accounts created on or after August 31, 2026.

Two more changes affect integrations. Thinking can no longer be disabled, and outputs carry watermarking for EU AI Act compliance. Full details are in the Opus 5.5 System Card.

## Key Takeaways

- Opus 5.5 matches Fable 5.1 on most work and beats both Opus 5 and Fable 5.1 on nearly every reported benchmark. - API pricing drops to $4/$20 per 1M tokens, and cache reads fall 60% to $0.20. - Anthropic puts typical workload savings at 40%, with output over 30% faster than Opus 5.

The new series primarily addresses customer feedback on cost, efficiency, and communication quality, particularly in financial services, law, and software development.

Anthropic prices Opus 5.5 at $4 per million input tokens and $20 per million output tokens, down from $5 and $25, respectively, for Opus 5 — a 20 percent cut in token prices. The company also reduced cache read costs by 60 percent. Anthropic says total operating costs, which account for both token prices and token usage, should be about 40 percent lower than Opus 5's. The model uses fewer tokens and generates output more than 30 percent faster.

Five-hour usage limits for subscribers will increase by 20 percent. With the model's lower costs, Anthropic says those limits stretch 25 percent further overall. Users can also save a limit reset for when they need it most.

Anthropic is using coding benchmarks to make its case on price and performance. On FrontierCode, the company says Opus 5.5 beats OpenAI's GPT-6 Astra at about 20 percent of the cost per task. On Terminal-Bench 4.0, it claims the same performance as Astra at 40 percent of the cost. On CursorBench, it says Opus 5.5 beats GPT-5.6 Sol by 11 points at one-third of the cost.

The price cut is a response to pressure from OpenAI and especially Chinese AI models, which offer lower performance but cost a fraction as much.

Opus 5.5 is also supposed to communicate more naturally than earlier models. Anthropic says it puts the most important information first, uses less jargon, and follows writing instructions more closely. Early testers described its writing as clearer and easier to understand, which Anthropic says makes it a better partner for long work sessions. Current Claude models have drawn plenty of criticism for their formulaic, convoluted writing, sometimes called "Claudish".

Opus 5.5 is also the first Opus model with safeguards for cybersecurity, biology, and frontier LLM development that match those of Fable 5.1. When those safeguards kick in, Anthropic says requests are transparently routed to another model. Users can still find and fix bugs in their code, but most cybersecurity tasks will go to the older Opus 4.8. Requests flagged by classifiers for biology or frontier LLM development will go to Opus 5. Verified organizations can apply to use the model for biological research through the Life Sciences Verification Program. Anthropic plans to extend its existing Cyber Verification Program to Opus 5.5 in the coming weeks.

Claude Opus 5.5 is available now on all platforms, including Amazon Web Services, Google Cloud, and Microsoft Azure. Developers using the Claude Platform can access it with the model ID claude-opus-5-5.

Anthropic also plans to screen reinforcement learning environments more strictly. The company says flawed training environments are a major source of misaligned model behavior. It's also working on better alignment rewards, automated ways to create safety training scenarios, and stronger safety and monitoring measures.

AI labs are debating how quickly to release more capable models. OpenAI recently called for international standards for AI systems that could improve themselves, while several researchers have publicly urged labs to slow releases until alignment methods catch up. Anthropic is taking a similar position, calling for a higher safety standard for models that could automate AI research entirely. The company says public policy should have a greater role in setting that standard. External organizations Frontier Design and METR tested Opus 5.5 before its release.

这两天如果你刷技术圈的社交媒体，大概率会撞见 "Jev" 这个名字。有人说被它 "霸榜" 了，有人晒出用它改造 Codex、BrowserUse 之后速度暴涨的截图，GitHub 上一个相关开源项目几天内就破万星。

但如果你顺着热度去找 "Jev 排行榜"，会发现根本找不到 —— 它压根不在 Chatbot Arena、SWE-bench 这类主流榜单里。很多人第一次接触 Jev 时的困惑就在这里：它到底是什么？为什么这么火，却又 "查无此榜"？

真正的 "榜" 其实是 TypeSafe 官方发布的一张对比图：他们拿 Jev 和一票主流大模型做了结构化输出错误率、工具调用错误率的横向对比，Jev 两项都是 0%，而对照组里的 Opus 5、Fable 5.1、Sonnet 5、Haiku 4.5、Gemini 3.x、Astra、Sol 这些型号，错误率从零点几个百分点到 45.5% 不等。

这才是 "霸榜" 这个说法的真正出处 —— 它霸的不是对话质量榜，而是 "给定封闭选项时会不会答错" 这类判断题的准确率榜。理解了这一点，再看 Jev 到底是什么，就顺理成章了：它是 TypeSafe AI 这家创业公司在 2026 年 9 月推出的第一款 "System One Model"，官方定位是 —— 不写一个字，专门做判断。它从一开始就没打算和 GPT、Claude、Kimi 这些生成式大模型抢同一个赛道。

## 先搞清楚：Jev 解决的是哪类问题

理解一个新东西，最好先搞清楚它想解决什么问题，而不是先看参数表。

过去两年，大模型的进化路线基本只有一条：让模型能推理、能调用工具、能连续完成长程任务。哪怕是最新的 Reasoning Model，核心机制也没变 —— 基于上下文一个 Token 接一个 Token 地往后生成，只是生成的 "草稿纸" 变多了。

但软件系统里还藏着大量另一类任务：不需要复杂推理，只需要一个快速、明确的判断。一封客诉邮件，是不是退款请求？该转给哪个部门？一段客服对话，用户情绪有多激动？这些问题人类几乎是 "看一眼就知道"，但写成代码就很难办 —— 正常的 if...else 处理不了自然语言的语义，硬要判断就得请一个通用大模型帮忙生成一段话，再从里面解析结果。

这套流程能跑通，但代价不小：又慢又贵。原因很直接 —— 大模型无论要回答的问题多简单，都得老老实实把答案 "写" 出来，一个 Token 一个 Token 生成，哪怕最终你只想要个 "是 / 否"。

TypeSafe 盯上的正是这个缝隙：软件里有没有可能存在一种模型，专门负责 "语义判断" 这一件事，快到可以被当成一个 if 语句来用？

## 从 "系统一 / 系统二" 理解 Jev 的定位

TypeSafe 把这套思路的理论依据，直接搬到了诺贝尔经济学奖得主丹尼尔・卡尼曼的《思考，快与慢》里。书中把人类思维粗分为两套系统：System 1 是近乎本能的快速判断，比如一眼看出对方脸色不对；System 2 则是需要停下来仔细权衡的慢思考，比如做一道复杂应用题。

过去两年，大模型行业几乎所有的注意力都押在 System 2 这一侧 —— 各家都在拼推理链更长、工具调用更准、Agent 任务完成率更高。TypeSafe 反过来问了一个问题：软件里所有需要 AI 参与的任务，真的都值得让模型停下来认真推理吗？显然不是。判断一句客诉是不是退款请求，不需要模型写几千个 Token 的思考过程，人类几乎是瞬间反应。TypeSafe 索性把这块被行业忽略的 System 1 单独拎出来做成了 Jev —— 这也是它官方自称 System One Model 的由来。

顺带一提，"Jev" 这个名字来自经济学家 William Stanley Jevons，他提出过著名的 "杰文斯悖论"（Jevons Paradox）：一项资源变得更高效、更便宜之后，人类对它的总消耗量未必减少，反而可能因为门槛降低而暴涨。TypeSafe 的赌注是：如果一次语义判断便宜到可以忽略不计、速度只要几十到几百毫秒，那么软件里原本一个普通的 if 判断，很可能会被大量替换成一次 AI 判断 —— 需求不会减少，只会被重新释放出来。

## 和普通 LLM 的本质区别：不是 "更小"，而是 "不生成"

很多人第一反应会把 Jev 理解成 "又一个更便宜、更快的小模型"，这个理解并不准确。

今天常见的小模型，哪怕再快再便宜，底层逻辑仍然是 LLM 式的自回归生成 —— 接到输入后依然要一个 Token 接一个 Token 往后写，哪怕最终只是要判断一封邮件属于投诉还是退款，也得先把答案 "写" 出来。即便开启了 JSON mode 或 structured output，本质也只是 "先自由生成，再用格式约束兜底"。

Jev 走的是完全不同的路子：它放弃了自由文本生成。开发者需要在请求里预先定义好问题和所有可能的输出类型，模型只能在这个封闭集合内做决定，不会输出集合之外的任何东西 —— 这也是官方所谓 "零幻觉" 的准确含义。不过有个容易踩的理解误区必须说清楚：类型安全不等于事实正确。Jev 保证的是不会返回类型定义之外的乱七八糟的东西，但它依然可能在合法选项里选错 —— 概率和置信度，就是特意留给下游程序做风险判断的信号，而不是 "绝对正确" 的保证。

## 三个判断原语：Choice / Noul / Score

Jev 对外暴露的接口被收敛成三种原语，分别对应三类最常见的判断场景：

- **Choice**：从给定候选项中选一个，输出选中项 + 完整概率分布 + 置信度。典型场景：工单路由到账单 / 技术 / 销售团队。 - **Noul**：判断一个命题是否成立，输出 0～1 之间的 "是" 概率。典型场景：判断 "这封邮件是否需要立即处理"。 - **Score**：按自定义有序量表打分，输出量表上的具体档位。典型场景：从 "平静" 到 "非常愤怒" 评估客户情绪。

三个原语可以共享同一份上下文状态（state），一次并行完成多个判断 —— 比如同一条客服消息，可以在一次请求里同时完成 "该转哪个部门"（Choice）、"是否紧急"（Noul）、"情绪评分"（Score）三件事。这种并行能力，对路由分发、内容分类、垃圾过滤、质量检查、RAG 片段筛选这类高频重复的场景特别有吸引力。

## 真实性能和价格：便宜到可以当 if 用

TypeSafe 公布的数据，支撑了 "把判断当 if 语句用" 这个说法的底气。按 2026 年 9 月 19 日的官方文档，jev-latest 指向 Jev 1.13：

- 响应延迟约 100 毫秒

**分类：** Computer Science > Robotics (cs.RO) **arXiv:** 2608.30378 | 2026年8月31日提交，2026年9月18日修订（v3）

**摘要：**

Direct vision-language-action policies generate continuous robot actions efficiently, but standard behavior cloning leaves two complementary gaps: their representations are not explicitly required to describe how the scene evolves over multiple time scales, and deployment trajectories of unequal quality are often reused without separating useful dynamics from undesirable behavior.

We introduce PAVE, a direct world-action policy that combines outcome-agnostic predictive learning with outcome-aware policy improvement. PAVE first retains a local fixed-offset JEPA objective and adds trajectory-relative multi-horizon transition alignment at 25%, 50%, 75%, and 100% of the remaining episode. These training-only targets require the current policy representation to preserve both local physical changes and longer-range task progress, without supplying explicit future tokens to the action head.

PAVE then trains an independent distributional value critic on cumulative deployment trajectories, computes action-chunk-aligned N-step advantages, and converts them into positive, negative, or null text conditions for a flow-matching actor. Thus, every valid trajectory can teach what physically happened, while the actor is deployed only under the condition associated with relatively better actions.

The multi-horizon predictor and critic are removed from online execution, preserving direct action generation from the current observation, language instruction, and proprioception. Across the three simulation benchmarks, PAVE achieves the strongest overall performance while preserving the direct actor's online execution path.

**arXiv:** 2609.24881 (cs.AI), Computer Science > Artificial Intelligence. Submitted on 21 Sep 2026 (v1), last revised 22 Sep 2026 (v2).

**Abstract:** In high-stakes decision-making applications of large language models (LLMs), practitioners require not only accurate LLMs but also uncertainty estimates for their predictions. Existing approaches to uncertainty estimation for LLMs require access to log-probabilities output by the model or require fine-tuning access. However, many industrial LLM products use closed-source API models, and many such API models like GPT do not return log-probabilities and may not allow fine-tuning.

We introduce Pinocchio, an external calibrator that estimates the correctness of responses from black-box API models. Trained jointly on responses from seven LLMs, it achieves 0.862 AUROC predicting the correctness of held-out responses from those same models, and shows zero-shot transfer to thirteen unseen models across eight organizations. Our model needs only a single forward pass to generate an uncertainty estimate and requires no access to the target model's logits, weights, or internal states. A lightweight text only 0.8B checkpoint matches our largest model's AUROC. We release code for adding uncertainty estimation to existing repos in only two additional lines of code.

就在刚刚，Anthropic甩出了新分子生物学实验室的「首个成果」——

Claude在噬菌体DNA中，自主发现了一套人类此前从未记录过的全新酶系统！

它的结构与「上帝手术刀」CRISPR高度神似，具备切割、复制、粘贴DNA的特征。

发现过程，竟动用了950个AI Agent，运行21小时，消耗约2.1亿Token。

随后，人类科学家接手审查和实验验证。

最终，团队进一步实验确认，这是一种此前未被表征的、存在于噬菌体中的全新酶系统。

他们将其命名为ART，即「阵列关联逆转录酶系统」。

CEO Dario难掩激动直言，「哪怕这是我在读博期间做出的成果，也足以骄傲一辈子」。

从今天起，生命科学的科研范式彻底被改写了。

950个Claude，狂烧2.1亿Token开干

这一惊天发现的背后，是一场极其疯狂的算力风暴与算法协同。

在过去的生物学史上，寻找新的酶系统就像在干草垛里找一根特定的绣花针。

人类科学家需要耗费数月甚至数年，一行行比对碱基序列、查阅文献、排除噪音。

但在Anthropic的实验室里，这一流程被浓缩到了短短21小时——

950个Claude集群并联启动，各司其职；它们吞吐、反刍、推演了超过2.1亿个Token的生物基因组数据。

然后，它们跨越数以万计的公开序列，地毯式扫描超20万个逆转录酶（RT）。

筛选出3500个全新候选系统，再层层严苛审视、推演排除，最终浓缩提炼出最核心的20个极具潜力对象。

在这个过程中，Anthropic的人类团队仅仅做了一件事：给出了最初的探索Prompt，然后放手让AI去自主调度探索。

AI阅读文献、验证已有方法、比对未分类序列、评估旁系基因逻辑，甚至自动撰写出人类可读的研究报告。

而在排查进行到第21个小时时，其中一个Claude在扫描一段来自「巨型噬菌体」（Jumbo phage）的原始DNA序列时，突然注意到了反常信号。

在它的推演分析日志里，留下了这样一段足以载入AI史册的「内心独白」：

（逆转录酶旁边的DNA）太壮观了：我肉眼就能看到一个串联重复阵列……这是一个类似CRISPR的……重复阵列？！

这句近乎拟人化的惊叹，直接揭开了新世界的一角。

撞上这个异常信号时，Claude表现得像一个训练有素的资深科学家：

迅速测算序列特征、严密比对微观拓扑，并在全网文献中搜寻相似先例。

在确认无误后，AI生成了一份详尽的实验验证报告，郑重交到了人类科学家的实验台上。

首次发现ART，酷似「基因剪刀」CRISPR

Claude挖出的全新生命系统，被Anthropic命名为ART。

ART主要存在于噬菌体中。噬菌体，就是感染细菌的病毒。

这套系统包含三个部分：逆转录酶（RT）、紧邻的伴侣基因，以及一长串间隔规则的DNA重复序列。

在分子生物学界，逆转录酶本身并不罕见。

甚至，之前就有学者在测序中扫到过这个噬菌体酶片段，但在庞大的碱基汪洋中，人类研究员直接把它当成普通的无用噪音跳过了。

一串A、T、C、G里，Claude看到了一段反复出现、间距均匀的序列，这种排法与CRISPR阵列相似。

这个细节，足以让科学家兴奋。

因为在CRISPR-Cas系统中，阵列保存的不同序列可产生引导RNA，帮助相关蛋白识别目标。研究人员利用这种机制，发展出了可编程的基因编辑工具。

初步实验给出了一条线索：ART阵列确实会表达出一组不同的短RNA。

这让研究人员怀疑，背后可能存在某种类似的工作逻辑。但这些RNA具体发挥什么作用，整套系统如何运转，仍然需要继续实验。

Claude打前站，人类做科研闭环

这场发现背后，离不开Anthropic自己的分子生物学实验室。

2026年春天，公司成立了研究团队，希望验证通用AI能否系统性地加速基础生物学发现。

团队成员长期研究异常蛋白，擅长用计算方法读取DNA、分析演化关系，再挑出值得实验的生物系统。

他们与Claude合作的方式，也比「问AI一个问题」复杂得多。

Claude先读文献，用公开数据复现已有结果，检查方法是否靠谱。

随后搜索无法归入已知系统的候选，写出功能猜想和支撑证据，再回头审视自己的判断。

大量候选会在这个阶段被淘汰。一轮搜索到最后，可能只剩一个值得验证的对象，也可能一个都没有。

通过人类审查之后，候选才进入实验室，由科学家开展实验，Claude再协助解释结果。

所有湿实验，都由人类科学家完成。

团队使用的工具包括Claude Science、Claude Code，有时也通过自建程序协调多个Claude会话并行运行。

背后是一个很具体的分工：AI扩大搜索范围，提出可供检查的线索；科学家判断证据质量，再用真实实验决定哪些猜想站得住。

5到10年治愈人类大多数疾病

如今，一个狂想正在变成现实。

Dario Amodei曾在Machines of Loving Grace中立下一个近乎疯狂的宏愿：

在AI的全面加持下，人类有望在未来5到10年内治愈绝大多数严重疾病。

但今天，当看到950个Claude在短短21小时内，完成人类数月才能理出的全新酶系统挖掘时，那扇紧闭的未来大门，似乎真的被撞开了一条缝。

所有人都在见证技术以惊人的速度跨代爆发：

2023年：AI还在做高中水平的简单数学题；

2024年：AI开始在顶尖奥赛中崭露头角；

2025年：AI开始解决小型的开放性科学悬想；

2026年：AI已经开始攻克数学界顶级难题

并且，正式作为「首席探索官」，在噬菌体未知的基因暗物质中，独立挖掘出了可能引发下一场生物医疗革命的分子机器。

ART会成为下一个CRISPR吗？不知道，但值得期待。

Claude迈出了这一步。

一个AI，用21小时，在一段没人注意过的DNA里，看到了一个没人看到过的模式。

这或许只是一个开始。

本文来源：新智元

相关文章

曝 Claude 跳过 5.2，直奔 Opus 5.5，周二发布

夕小瑶科技说 09/21 10:19

用魔法打败魔法，OpenAI被Claude“黑了”......

李佳 09/18 18:39

Claude Code推出Projects：一个对话拆出并行线程，合上电脑任务仍在跑

鲍奕龙 09/18 05:13

Claude后台接管电脑，真·赛博替身！人机并行时代来了

新智元 09/03 18:55

Anthropic's newest model, Opus 5.5, was released on Tuesday, setting a new state-of-the-art in coding and knowledge work performance, according to the company. Opus is the most capable and expensive tier in Anthropic's three-tier Claude lineup; Sonnet sits in the middle, while Haiku is the fastest and cheapest. Notably, Anthropic says, the release outpaces the larger Fable model in many benchmarks and succeeded in a number of informal tasks that Fable failed to complete.

The new model is also significantly cheaper than its predecessor. Output tokens will be charged at $20 per million tokens for Opus 5.5, compared to $25 for the previous model. Other metrics have similar price drops. The model is also faster to run, reflecting an overall drop in the compute required to serve it. The new version also makes significant changes to how Opus communicates, with Opus 5.5 less likely to use jargon and more likely to put important information at the start of its messages.

The launch comes just two months after the release of Opus 5 on July 24. According to the announcement, Sonnet 5.5 and Haiku 5.5, which are the next tiers in the lineup, will be released "in the coming weeks," with similar performance improvements.

Opus 5.5 is Anthropic's first model release since CEO Dario Amodei embraced calls to pace the frontier, deliberately slowing down progress on AI capabilities to match the rate of progress on alignment. "I have become convinced that fully addressing the risks requires even more prudence," Amodei wrote in a post earlier this month, "not just investing in risk prevention, but pacing the rate of capabilities advancement so that risk prevention has time to keep up."

Anthropic says that Opus 5.5 is comparable to Mythos in its biology and cybersecurity capabilities, so its release is subject to the same safeguards as the company's Fable model. Those safeguards limit how much the models can be used to discover exploits in compiled programs or developing recognizable biological weapons, among other tasks.

Opus 5.5's safety training was broadly similar to its predecessors, with alignment testing and pre-release evaluation by outside organizations like METR and Frontier Design. But Anthropic emphasized that more advanced training and evaluation systems were already being prepared for future models, including improved security and monitoring systems.

"As AI becomes more capable, public policy should play a larger role in making sure the systems people rely on are safe. That capacity takes time to build, and we've started to put the infrastructure in place to support it," the blog post reads. "We expect to share more details on these efforts soon."

这也是Muse背后更深的一场竞争。Meta首席执行官扎克伯格在与科技记者Alex Heath的对话中谈到了这套产品设计，也谈及Llama 4失利后Meta如何重建模型研发，以及他为什么主张让更多人拥有强大的AI。访谈主要观点包括：

**1. 个人Agent要从预训练开始设计。** 理解用户的长期目标，以及判断私人信息的使用边界，不能只靠通用模型的后训练来解决。

**2. 虚拟机让Agent具备持续行动的能力。** Muse可以在后台操作计算机、登录服务，并围绕用户的目标全天候推进任务。

**3. 记忆让Agent从单次工具变成长期服务。** 它会根据已完成的任务和用户反馈调整后续行动，夜间整理反思写入记忆，也可以主动提出新的项目。

**4. 权限决定用户敢把多少事交给AI。** 登录、付款、发送邮件和披露敏感信息需要用户逐项批准，Agent只能获得完成当前任务所需的权限，遵循最小权限原则。

**5. 隐私保护要写进系统架构。** Meta计划通过机密虚拟机和独立的凭据存储，减少公司及核心Agent接触用户敏感信息的机会，从架构上保证即使Meta自身也无法读取用户内容。

**6. 免费额度是扩大用户规模的起点。** Meta每周提供1亿token和一台虚拟机的免费额度，扎克伯格相信Muse帮用户省钱、赚钱后能抵消成本；长期可能从用户与商家交易中收取小额费用，目标是让多数人免费使用。

**7. Meta正用新的方式追赶前沿模型。** 在Llama 4偏离预期后，扎克伯格转向更精简的核心研究团队，并继续增加算力投入，俄亥俄州吉瓦级集群已上线；新模型"Watermelon"即将发布，规模更大、预训练水平显著提升。

**8. 技术扩散也是扎克伯格的安全主张。** 强大AI若只由少数机构掌握，同样会带来风险；让更多人获得能力，才能形成制衡。

## AI的安全不能只靠限制访问，关键是让更多人拥有制衡能力

Alex Heath：我们上次通话是在一个周末，你当时还通过智能眼镜给我打电话。那次你想谈刚发表的一篇长文，其中提出了很多关于AI未来的主张。为什么要写这样一篇近似宣言的文章？

Mark Zuckerberg：如果一家机构要在AI上投入这么多，就有责任说明自己的研究团队相信什么，以及这些工作为什么能够导向一个积极的未来。AI既带来巨大机会，也存在真实风险，所有参与者都应该形成一套经过认真思考的理论。

我强烈反对一些在行业内被视为理所当然的观点。在我看来，更积极的未来来自尽可能广泛地分发技术。这一判断建立在三点之上：第一，赋予个人更多能力，一直是人类繁荣的重要来源；第二，AI的首要用途将是创造新事物，而不是将现有工作自动化；第三，未来安全的基础应是适当的权力制衡，而不是限制使用权。

很多人的直觉是，技术越强，就越应该只让少数人接触。我更担心的是，只有少数研究机构或个人控制如此强大的能力。历史上，很多重要进步并非来自既有权力中心，而是来自边缘位置、最初不被认真对待的人。当他们获得足够好的工具，可以证明自己的想法时，才有机会推动真正的变化。

网络安全也是如此。如果有人拥有能够攻击系统的AI，最有效的应对方式之一，是让更多机构也拥有AI，以便提前加固自己的系统。开源软件之所以常常更安全，正是因为更多人能够查看、检验和修正它。把技术交到更多人手里，看似会增加风险，却也可能形成更稳定的制衡。

Meta会开发领先模型，也会发布一部分开放模型，但这不意味着所有成果都必须开源。营利性公司可以保留一部分先进技术。关键是维持强健的开源生态，让市场保持竞争，也让外界能够理解技术的发展方向。以Hugging Face遭遇入侵的事件为例，他们发现入侵后转而使用开源模型，因为他们无法获得某些与这次问题有关的闭源模型。这说明世界上需要保护的重要机构远不止排名最靠前的一百家。

不过，比开源本身更重要的，是让普通人真正用上技术。Muse体现的就是这一思路：给每个人一个能力很强的个人AI Agent，让它理解用户的目标，并且每天24小时持续代表用户工作。

## 技术繁荣必须广泛分布，数据中心也要让社区受益

Alex Heath：AI和数据中心正在受到越来越强烈的抵触。你的意思是不是，如果更多人能够得到目前集中在少数研究机构手中的能力，他们就不会再觉得自己被排除在AI进程之外？

Mark Zuckerberg：问题不能只停留在抽象层面。人们担心就业和经济，也担心数据中心对社区与环境的影响；还有网络攻击、生物安全、自由社会、美国的技术领导力，以及当AI越来越强时，人类如何继续控制它。每一类问题都有不同细节，但它们有一个共同点：技术带来的繁荣必须广泛分布，能力也不能只掌握在少数内部参与者手中。

Meta进入一个地区建设数据中心，实际上是在承诺未来几十年持续投资。这样的长期投入可以为社区带来税收、就业和其他资源。比如在路易斯安那州，相关税收曾为当地教师提供每人5万美元的奖金。市场上也有另一类项目：有些公司只想先拿下一块地，再卖给大型AI研究机构。

它们并不打算长期运营，也没有动力认真处理与当地社区的关系。我不确定是否该把这种现象称为泡沫，因为"泡沫"意味着估值过高。但这个领域确实正在经历一轮热潮，也因此容易滋生短期逐利的行为。如果项目只顾眼前交易，社区反对并不奇怪。AI基础设施如果不能创造就业、扩大社会整体繁荣，也不能让当地社区受益，就不可能无限扩张。因此，让利益广泛分布不是附加条件，而是行业能够持续发展的前提。技术要可行，社会层面也必须可行。

Meta推出了America's Workforce Academy，原因很实际：建设数据中心需要大量光纤技术人员、电工、高级木工等技术工人，而市场上远远不够。未来可能还需要数十万甚至数百万人。我们保证，完成培训的人能够在参与Meta基础设施建设的单位找到工作。这不是单纯的慈善，而是长期利益一致：Meta需要熟练工人，参与者需要新的职业机会。若企业只是建设一个项目后转手，就不会进行这种投入。