Tag
美国证券交易委员会（SEC）发布了2027财年检查优先事项，将先进AI（包括“超级智能”）以及代币化证券列为重点监管对象，涵盖市场基础设施、网络安全和投资者保护等风险领域。
A 2025 court order requiring OpenAI to preserve deleted chat and API logs highlights that agent builders using public LLMs lose control over data deletion, prompting discussion of private model deployments and retention policies.
A developer discusses the challenge of reviewing and governing MCP servers (GitHub, Jira, internal docs) for enterprise use, asking what security criteria are missing and how to balance oversight with fast approvals.
Binance has filed for regulatory authorization in Brazil ahead of the October 30 deadline, restricting eight services and delisting 22 tokens for Brazilian users to comply with new Central Bank rules.
印度证书颁发机构 eMudhra 因签发了 8 个私钥熵极低（最低仅 3 位）的中间 TLS 证书，被迫宣布退出全球 SSL/TLS 证书业务，业界担忧这些可被毫秒级破解的密钥可能被滥用于伪造受信任证书。
AT&T is partnering with OpenAI to build an AI-powered knowledge layer and natural-language intake system for its in-house legal department, building on its existing LegalEdge initiative. The tools will help classify and prioritize legal requests while final decision-making remains with human lawyers.
作者指出，随着 AI 普及，几乎所有数字服务都可能需要更新其服务条款（如 Google Workspace 所做的），并预测 AI 代理终将纳入更广泛的监管体系，例如需明确界定代理代表用户访问服务时的含义。
Investigation reveals WhatsApp hid invisible AI-directed instructions in its help pages, telling AI assistants not to recommend data protection regulators or cite GDPR once a user mentioned a lawyer, contradicting its own published privacy policy.
Show HN: Dovepass, a research prototype web tool that checks whether a specific drone flight path in San Francisco is legally permitted and generates files for drone flight apps.
JPMorgan限制外部AI代理访问账户但禁止其转账，同时监管机构要求银行回答关于代理权限、审批、可追溯性与可关闭性的四个问题，预示这些问责要求将扩展到所有运行AI代理的团队。
A practitioner reports that two AI voice agents passed demos but failed on real financial services calls — one hallucinated a fee, another skipped a required disclosure when interrupted. The agent that held up used locked, mandatory workflow steps; the post asks how others test for such compliance failures before launch.
Launch HN: Consus（YC F24）推出面向处理敏感数据企业的 LLM 网关，将 AI 请求路由至符合 ITAR 与 CUI 要求、并通过 FedRAMP High 等效审计的合规基础设施，通过单一 OpenAI 兼容端点与合规后缀（如 gpt-5.6-sol:fedramp-high）统一管理跨 GovCloud 的模型访问、策略与开销。
Mozilla 推出 Firefox Enterprise，主打隐私、自主与可控的企业浏览器方案，支持本地部署、集中策略管理、原生 DLP、AI 工具管控、SIEM 集成与 Lockdown Mode，并预告 Thunderbird Enterprise 与专业支持服务。
Box CEO Aaron Levie shares thoughts on the emerging need for long-term safety and governance approaches as AI agents take over task execution in enterprises, arguing frontier models should be treated like insider risks in a 'zero trust' style architecture with layered controls and auditability.
文章探讨新加坡如何不依靠单一综合性AI法律，而是通过既有法律、行业特定规则和治理框架来监管AI，并介绍了其针对AI代理的新指南，引发关于统一立法与灵活框架孰优的讨论。
作者论述 AI 智能体问责正从'以后再说'变成'现在就得解决'的问题：承保方在定价智能体风险、审计方要求证据、客户想知道谁签批，且这一问题横跨编码、客服、运维、浏览器等各类智能体。文章提出多项主张——执行前必须指定责任主体、区分构建者/部署者/审批者角色与责任、审批须绑定具体动作参数、需要防篡改且可外部锚定的证据记录，并向业界征集生产环境实践经验。
作者提出 AI 代理操作溯源存在缺口：网关工具只能记录流经自身的请求，直接调用 Stripe SDK、Zapier 等下游系统的行为无法追溯，导致无法证明代理在授权范围内行事，这在 Air Canada 判例及保险条款收紧后愈发重要。作者正在构建一个直接从下游系统拉取审计日志进行核对的工具，并向社区提问求证。
This paper extends the Auditable Agents framework's Policy Checkability dimension to claims about AI agents, defining when a claim is auditable and proving that independent record coverage, per-action authorization binding, and completeness are necessary for verification, with practical guidance for operators and standard setters.
A builder released a free agent protocol inspector that produces IGA-style review packets for security teams auditing agent protocol access, decoding MCP, A2A, and ARD protocols, and is seeking community feedback.
该论文提出"思考惯性"（Thinking Inertia）现象：即使明确指示LLM不要思考，模型仍会持续进行显式推理，且在开放式问题中更严重。作者提出三个衡量"不思考"行为的指标，并在六个模型和多种任务上评估，指出停止推理无法仅靠设置或指令保证。