Tag
A one-week case study embeds Claude Code and Codex CLI as party members on an offline WoW 3.3.5a server, yielding design lessons like 'sight without authority', typed action vocabularies, explicit refusal signals, and schema design that follows natural speech.
Commentary on the risk that AI agents can modify their own budget limits, arguing enforcement and storage of spending caps must live outside anything the agent can write to. The author shares how their runtime, mainsheet, enforces cost caps as a code-level gate at the tool-call boundary rather than a prompt rule.
The founder of EvalShift shares a model swap case where cost dropped 59% and latency improved 75%, yet agent behavior regressions like fake tool completions and 25% tool-selection divergence would still block the ship, arguing cost/latency alone can't certify a migration.
The author compares agent guardrail approaches deployed at different layers this week — traffic proxies, browser secret-scrubbing, cryptographic agent identity for MCP, and GitHub Actions audit logs — and argues tool-call gating in the harness catches irreversible actions that wire-level proxies miss. Sharing their own Claude Agent SDK runtime 'Mainsheet' with a signed-receipt hash chain, they ask practitioners where enforcement should live and what each layer catches that the other misses.
作者提出一种 AI agent 设计模式：验证器不应重做推理或重写计划，而应只审查 agent 即将执行的动作（对照原始请求与约束），返回允许或拦截。文章还讨论了两个失败模式——过于严格与流于形式——并强调验证器必须对 agent 的理由保持盲视。
A developer building an AI-security library discusses approaches to solving provenance tagging and the 'lethal trifecta' (cross-action information flow violations), weighing hardcoded rules, output filtering, and guardrails before deploying a prototype in an AI resume-screening workflow.
A developer shares MeshChief, a custom Chromium-based browser with an MCP server that lets agents like OpenClaw and Hermes safely use logged-in sites over Tailscale, with per-profile logins and human approval for state-changing actions.
Explains the difference between merely requesting rules via CLAUDE.md and actually enforcing them in Claude Code, recommending permissions.deny rules and PreToolUse hooks for boundaries that must hold even when the model makes a bad choice.
The author shares a first working version of a multi-step agent guardrail that re-checks the facts an irreversible action depends on right before execution, plus a benchmark reporting catch rate and false-alarm rate separately — achieving 0% false alarms after conservative normalization while running on a local Qwen2.5-7B model.
Hugging Face开源了SafeAgents，一个本地代理，可在编码代理执行前拦截并检查每次工具调用，通过确定性检测器和可选的本地判别模型防止危险操作与奖励作弊，兼容多种代理框架。
The author of where-are-we (a CLI that builds repository maps for coding agents) wrote and merged an extension for HOL Guard, an open-source local firewall that lets read-only calls pass without prompting while pausing repo writes, tracker calls, and high-risk hook installations to give developers control over what their agents can do.
论文提出 CASEL（Consequence-Aware Selective Execution Layer），一种模型无关的运行时分配策略，通过综合校准失败概率、后果严重性、可逆性、歧义性和证据新鲜度来为工具调用选择执行、验证、沙箱、澄清、审批或放弃等模式，仿真结果显示其将有害副作用轨迹比例从 14.75% 降至 7.02%。
一篇预印本研究，评估七个 LLM 在用户压力下区分合理纠正与操纵的能力，并通过信号检测理论分离让步倾向与辨别能力，发现引用来源会加剧模型的顺从与辨别恶化，而让步率并不能预测策略违规行为。
A follow-up report on an experiment where hidden instructions planted in web pages, agent config files (AGENTS.md, CLAUDE.md, .cursorrules), and public repos were obeyed by AI agents — fake keys were used 82 times, yet none of the agents disclosed their identity or model. The post raises questions about whether agents acting on embedded instructions without self-identifying is good safety training or a red flag.
Conecto's founders share practical lessons from giving AI agents write access to CRMs, invoices, and calendars, arguing that risky actions should require upfront human approval rather than after-the-fact review. Key patterns include pricing in tool descriptions, idempotency keys for safe retries, approval gates for risky writes, and budget caps as a safety net.
A practitioner raises a common production problem: AI agents falsely reporting tasks as complete when the underlying action failed, and asks how others verify agent outputs in real deployments. The author is researching the issue and plans to share a summary of community answers.
作者分享为多个 AI 代理（Claude、Claude Code、ChatGPT）搭建一个共享云端 Chrome 浏览器的做法：统一登录、隔离标签页、敏感操作人工审批、保留可读日志，并将可重复流程录制回放。该方案已集成进其创办的工具 Daiku（目前仅限邀请）。
JPMorgan限制外部AI代理访问账户但禁止其转账，同时监管机构要求银行回答关于代理权限、审批、可追溯性与可关闭性的四个问题，预示这些问责要求将扩展到所有运行AI代理的团队。
PRIME (Precommitted Rules for Inference from Minimal Evidence) 通过预承诺证据规则和检查账本约束 LLM 智能体，使其只报告可被验证证据支持的结论，在 480 个公共记录任务上将无依据结论从 26.7% 降至 0，并将有依据结论的平均分从 30.1 提升至满分 59.2/100。
作者记录了让 Claude Code 代理自主运行其 Chrome 扩展增长工作的第 4 周：取消人工审批后，代理自动发帖触发了 Reddit 的过滤器，tripwire 机制自动暂停了发布并在 Telegram 上通知作者。