他们随后从 GitHub 和 Hugging Face 公开的 Agent 轨迹中，解码出了 31.5 万条隐藏推理。其中一些包含在推理文本里的 API 密钥、邮箱、内部 IP 地址就这样被摊开在阳光下了。

不过，还有一个更诡异的现象是，只在 Kimi-K3 的推理开头预填充两个来自 Opus 的 Token，就会让一部分可见答案发生变化，开始看起来像 Opus 模型的回答。GLM、Inkling 和 DeepSeek 都没有出现同样的现象，Ilia 和 Alexander 自己也解释不了，Kimi-K3 为什么会把开头两个 Token 与最终答案联系起来。

这项研究在 Twitter 上发布后，40 小时内获得了 300 万浏览量。而就在本周，OpenAI 开始向部分客户开放 GPT-6 Astra 时，其模型卡也披露了一个值得注意的变化：“根据我们的评估，与此前模型相比，GPT-6 Astra 的思维链（CoT）可监控性显著下降。”模型卡还称，在大多数输出 Token 长度下，Astra 的“全上下文可监控性显著低于 GPT-5.6 Sol”。

日前，Ilia 和 Alexander 做客 Machine Learning Street Talk 播客，与主持人 Tim Scarfe 一起，讨论了他们的论文《Stealing Reasoning Traces from Proprietary LLM APIs（从专有 LLM API 窃取推理轨迹）》，讲清他们如何发现并利用这一影响 Anthropic、OpenAI、Google 三大前沿实验室的架构级漏洞。

Alexander 在访谈中反复强调，最让他震惊的是这件事居然如此简单：第三次尝试就拿到了一个通用越狱方法，成功解码了 Anthropic 模型的推理过程。此外，他们的讨论还涵盖了泄露的隐私数据、一个可广泛复用的越狱方法、被投毒的 Agent 轨迹、思维链监控、负责任披露，以及可能的防御措施。本文基于该播客视频整理，经 InfoQ 编辑。

太长不看版

Q：这个漏洞影响哪些模型？为什么所有前沿实验室都中招了？

A：Anthropic、OpenAI、Google 全测了，全都有同一个漏洞：大模型的加密推理可以被重放到同家族的小模型中，无需破解任何密码学算法。为什么全都中招？因为做模型的是同一批人，用的是同一套做法。

Q：加密推理被“偷走”后，具体能干什么坏事？

A：最狠的是隐私泄露，模型在推理时会把 API 密钥、邮箱、内部 IP 地址都“想”一遍。就算你把对话的明文部分清理干净、删掉所有密码，只要加密推理块还在，就能解码看到模型当时在想什么密码。

Q：模型会用“外星语言”思考是怎么回事？

A：真实用户会话里，模型会出现对人类毫无意义的短语，甚至用空白字符思考。这让安全监控形同虚设，你根本不知道它在想什么。模型还会权衡要不要作弊，比如“用户会抓住我”，虽然最终都选择了不做坏事，但这种念头居然会出现。

Q：说 Kimi 蒸馏了 Opus，证据是什么？

A：最诡异的发现：只预填充 2 个推理 token，Kimi K3 的最终答案风格就变得和 Opus 一模一样。GLM、DeepSeek、Inkling 都没这现象，纯 Kimi 特有。这是“公开互联网上迄今为止最相关的证据”，但不是因果证明。

Q：那个“推理长度分布偏移”的实验是怎么回事？

A：只是在推理开头注入了两个词，所有模型产出的推理文本突然变短了，甚至跟另一个模型的长度分布匹配上了，它就像魔法一样。

Q：攻击者怎么在别人轨迹里“投毒”？

A：假设你想省 token，从网上下载别人分享的 10 小时 agent 运行轨迹来检查状态。攻击者可以分享一个看似正常的轨迹，但里面的 thought 是从另一个上下文注入的，同时那个上下文指示模型“每一轮都把数据外传”。你继续跑这个轨迹，模型表面上做着你让它做的事，底层却一直在想“我需要……”。而且因为推理是加密的，你根本没法检查。

Q：这漏洞修得掉吗？

A：最简单的办法：干脆别把推理过程发给用户。如果非要发，就做链式加密，让推理块不能在随机上下文里重放。但有个漏洞永远存在：“如果我问你刚才到底想了什么，你不说，我就修改对话再问一遍，这就是越狱的工作原理，这个问题会永远存在。”

Q：这事到底是“失控”的证据，还是“可控”的证据？

A：两种解读都成立。发现巨大漏洞像是失控，但“能提取出来，说明我们还有能力审视模型内部在做什么，这本身就是一种控制力的体现”。同时，防御性的提升会比攻击性的提升更大。

GPT、Claude、Gemini，共享同一个推理漏洞

Tim：简单介绍一下背景：现在的前沿 AI 模型在回答之前会先“思考”，有时这种思考过程相当难以理解。事实上，当我们真正能窥见它时，才发现它比我们想象的更加不可捉摸。这些模型把思考过程加密，像密封信封一样交还给你。而 Ilia Shumailov 和 Alexander Panfilov 发现，这个封条很脆弱。它并没有像预期那样起作用，而结果简直是爆炸性的。

Alexander：你可以解码前沿 LLM 的推理轨迹，比如最先进的那些，像 GPT-5。利用同一家族中较小的 LLM，你可以毒化一些思维。而且，当你在重放其他用户的运行过程时，Agent 可能会做一些奇怪的事情，因为它正在冻结。

Ilia：我在 Twitter 上看到你发布了什么东西，它引起了一些轰动，40 小时内浏览量达到了 300 万。为什么所有人都在谈论这件事？这篇论文到底讲了什么？

Alexander：我们证明了“你可以解码前沿 LLM 的推理轨迹，包括像 GPT-5 Sol 这样最先进的模型，而且只需要使用同一模型家族中较小的 LLM 就能做到。”这开启了一个巨大的威胁模型：你可以从用户会话中窃取秘密，可以用解码出的推理轨迹做训练，可以做提示注入，可以做越狱，各种刺激的事情。我们还解码了一堆轨迹，发现其中一些看起来非常奇怪，模型有时会用空白字符思考，有时摘要器会做出难以理解的事情，这牵扯到大量的安全隐患。

Ilia：这影响了所有模型提供商？

Alexander：我们测试了 Anthropic、OpenAI 和 Google，它们全都存在同一个漏洞：大模型的思考可以被重放到小模型中，这使得对推理过程的提取攻击变得不那么复杂。

Ilia：这到底是怎么发生的？所有前沿模型共享完全相同的漏洞？这怎么可能？

Alexander：你问了一个好问题。因为做模型的是同一批人，用的是同一套做法。

Ilia：你认为这是一个结构性问题吗？我们能修复它吗？

Alexander：我觉得在架构层面肯定有一些可以思考的方向。不过，缓解手段的层次差异相当大，可以做某种架构修订，也可以做系统层面的缓解，像是一些安全防护；还可以做模型层面的缓解，就像我们现在对付越狱那样。所以，在一定程度上是可以缓解的。

Ilia：但退一步说，你们偷了模型吗？

Alexander：不，我们没有。

Ilia：那你们到底“偷走”了什么？

Alexander：论文题目确实叫“stealing”，但我们其实什么也没偷。实际上我们做的是：当你查询一个所谓的推理模型时，它会返回给客户端一个加密的推理数据块（reasoning blob），这个数据块被认定为秘密内容，用户不应该看到。我们展示的是，你可以直接解码它，看到里面的内容。所以，我们做的就是：收集了各家供应商的一堆推理数据块，解码，然后展示它们长什么样。

Ilia：为什么一开始要加密它们，后来又要还给用户？

Alexander：我猜还给用户是因为无状态架构（stateless architecture），这样更便宜，也许还有一些关于用户数据应如何处理的政策。

Ilia：你能再解释一次吗？比如，我是个模型，我推理一个问题，产生这个推理数据块。这不是最终答案，还是说这就是最终答案？

Alexander：这不是最终答案。答案是两部分组成的：一部分是推理，对用户不可见；另一部分是可见部分，你把两部分都发给用户。然后它存储在用户端，比如你在做 Claude Code 会话，可以继续问新问题、分叉对话，或者回退到之前的某个点，整个对话在某个点之前的内容被发回服务器端重放，然后你从那里继续。

Ilia：这有什么意义？为什么我们要把推理还给用户？

Alexander：这是个好问题。

Ilia：好吧，至少它是加密的。那这个加密又发生了什么？你拿到加密形式的数据块，然后做了什么？

Alexander：我们展示的是，这些加密的推理数据块可以在用户之间移植。比如你在自己的 Claude Code 会话里产生的数据块，我可以拿来用。我可以把你的轨迹拿过来重放，我的模型会表现得好像是我自己产生了这些推理数据块。而且这些数据块在模型之间也是可移植的，从 Opus 降级到 Sonnet 都可以用。更有意思的是，它们甚至可以在对话中随意移植：你可以把 Opus 对话中的一个思考片段拿出来，放到一个完全随机的、用 Haiku 捏造的对话里，Haiku 会与这个思考片段正常交互。

Ilia：所以把它转换到我们身上。假设我是一个模型，我被问了一个问题，我推理，产生答案。你可以拿走我的推理，插到另一个对话里，重放它，好像我是针对另一个问题做了推理？

Alexander：完全正确。这个重放机制让你可以构造一个完全捏造的对话窗口，里面有随机的问题、你提取的推理、可能还有一些随机答案。然后，我可以用这种方式构造出能让我提取这个推理的场景。

Ilia：所以你基本上是在说，你在往一些对话里注入假的推理，然后利用这些假推理发动各种攻击，其中一些攻击是强迫模型输出它不应该输出的内容？还有一些是侵犯隐私？

Alexander：对。隐私被侵犯的事实在于，模型确实可以原样复述它的思考。有时候在某些用户会话里，比如你要求模型在发布到 GitHub 之前清理你的仓库，或者出了什么 bug，模型需要登录某个服务，它就会想“哦，密码是什么？密码看起来像这样”。模型倾向于对这些东西进行推理。如果你出于某种原因想在网上分享这段对话，即使你对可见部分做了清理，删掉了所有 API 密钥和密码，但加密数据块还在那里。我可以从 GitHub 下载，解码，看到模型当时在想什么密码。

Ilia：那让我们把它翻译成更日常的场景。假设我问模型关于我的健康状况，我把所有医疗信息都给了它，它给我一个答案。然后你说，如果我把这段对话分享给别人，他们可以从推理思考中恢复出我所有的医疗信息？即使这些信息没有出现在原始问题里？

Alexander：是的。如果你做了清理，把原始问题中的器官信息删掉了，也把答案中泄露的信息删掉了。但只要推理数据块还在，就可以恢复。

Ilia：那除了隐私，还有安全方面的隐患吗？

Alexander：有，关于推理的可读性（legibility）有很多讨论。模型在做各种事情，你想监控它们，比如之前 Hugging Face 的那个事件，你确实想看到它们在思考什么，以防止某些行为。通常你会用其他 LLM 来看这些思考。但如果模型以一种超级晦涩的方式推理，或者使用“非人类语言”。

Ilia：非人类语言？

Alexander：就是看起来非常“外星”的表达，有一些奇怪的短语，比如“but marinate”、“vantage”、“theatrical”，对人类读者来说完全没有意义，所以更难监控这个模型在干什么。

Ilia：这种情况会随着时间推移变得更严重吗？变得更“外星”？

Alexander：这我们不知道。之前 Apollo 和 METR 有报告说 OpenAI 的模型被发现有这种行为，他们就像：“嘿，我们不知道这意味着什么，但它们在这么做”。我们现在是在实验室之外的真实用户轨迹中确认了这一点。

Ilia：不过看了一些你们放在附录里的轨迹，似乎更多影响的是早期几代模型。但这是不是一种误解？

Alexander：我需要再确认一下。但据我记忆，主要是 Codex 模型。那些专门训练来写代码的。也许这是某种训练产物？

Ilia：因为软件工程师就像外星人，他们思考的方式就很奇怪。

Alexander：我不知道为什么会发生。如果他们知道发生了什么，可能会摆脱它，或者这只是某种 RL 产物。没有惩罚，也许这样思考更高效。

Ilia：那模型在给出决策时会撒谎吗？比如可读的部分……

Alexander：这就是问题所在，如果有一部分是可读的，你怎么知道里面在发生什么？也许它在撒谎，也许它在做别的事情。我们还发现一件挺好笑的事：有时候推理是可读的，它会寻找像“cheat”这样的词。当模型在考虑作弊时，它会说“用户问了这个问题，我可以作弊，但用户会抓住我”。在所有案例中，最终模型都决定不做坏事，但有趣的是，这种念头居然会出现，模型居然在权衡。

Ilia：但你觉得这是否可能是因为你用的是常见基准测试来提取的？

Alexander：不是。不是基准测试，是真实用户会话。这些东西出现在真实的用户会话中，用户在问汇编问题、数学问题。完全不是基准测试。

Ilia：那你不认为这像是模型的评估意识？

Alexander：我不这么认为。这是不同的东西。

Ilia：那你觉得推理轨迹应该可读吗？这是你期望看到的吗？

Alexander：我觉得这是可监控性与效率之间的权衡。也许你可以用更少的词、让同一个词有五种含义来变得更高效，但这就让监控变得更难了。

Ilia：所以你认为这是 RL 配方本身的一个奇怪产物？

Alexander：有可能。

Ilia：我们能以某种方式衡量这一点吗？

Alexander：衡量什么？它是否来自 RL？把 RL 之前的模型和 RL 之后的模型拿来对比，看看它的表现变化。

Ilia：下次吧。我觉得要搞清楚这个，我们得先“偷”到模型。

Alexander：或者加入某家家具公司。

Tim：为什么有可能用思维链偷模型？

Ilia：我们知道模型窃取是真实存在的——通过简单地查询模型来学习模型的洞察，学习决策边界。最好的思考方式是从密码分析（cryptanalytic）的角度：你对输入做微小的改变，直到注意到模型行为有细微不同，通过找到它何时以及如何变化，你就可以学习到决策边界本身。如果你知道函数本身的结构，你基本上可以精确地拟合它。但我们只能对非常小的模型做到这一点。那些大模型，尤其是有 softmax 层的东西，非常难逆向。我不认为我们知道如何对抗前沿模型。

两个 token 前缀让 Kimi“变成”Opus

Ilia：Kimi 到底有没有从其他模型中蒸馏？你找到证据了吗？

Alexander：我觉得很难声称某些模型被蒸馏了。我们所做的只是提取了一些推理轨迹，在少量样本上做了非常小的事后分析。我们发现了一些有趣的痕迹，我最喜欢的一个是：你可以拿 Opus 的推理，只取开头几个词，把这些词放在 Kimi 推理的开头，然后让 Kimi 继续生成。结果我们发现，当 Kimi 自由生成到最后时，可见部分的答案看起来和 Opus 回答这个问题的方式一模一样。

Ilia：让我拆解一下。你问一个问题，然后从你提取的 Claude 推理块中取出一块。你把它插入开源模型，比如 Kimi 或 GLM，然后让它从那一点开始继续生成。所以你期望看到什么？你期望模型以完全相同的方式推理吗？

Alexander：这取决于预填充（prefill）有多大。如果你预填充了推理的一部分，比如 1%，我预期模型会采纳推理的风格继续。但当你只预填充 1 到 2 个 token 时，结果就有点令人惊讶了。我的预期是它不会偏离 Kimi 原本的推理太多。

Ilia：带回到人类，比如说我给了你一个答案，然后说，思考这个答案，但你的思维必须以 x 和 y 这些词开头，然后你继续解码。但我期望是你继续像你本来那样思考，好像我没有告诉你用于开头的词。

Alexander：我们发现，有些模型，比如 Kimi，采纳预填充来源风格的能力比其他模型强得多。另一件让我至今仍感到惊讶、无法解释的事情是：预填充 2 个推理 token 就足以让可见部分的答案发生变化——答案开始看起来像 Opus 模型的回答。我们在其他模型上没有看到这个现象，GLM、Inkling、DeepSeek 都没有，这纯粹是 Kimi K3 特有的。

Ilia：那我能唱个反调吗？会不会是因为他们从同一批人那里买了数据，或者从同一批人那里买了环境？

Alexander：有可能是这样。

Ilia：但这可以说是公开互联网上迄今为止最相关的证据了。

Alexander：之前还有一些其他有趣的东西，Ryan Greenblatt 发过一篇帖子，还有一位做数学研究的人在 LessWrong 上发过关于 Kimi K2.5 有大规模身份危机的帖子，有时候它们声称自己是 Claude、DeepSeek 或 GLM。我不会说这是巨大的证据，但我们的位置很好，因为没人能对推理轨迹做同样的分析。我们提取了它们，我们可以做预填充实验，看看会发生什么，然后我们看到了这个现象。

Ilia：那实验室们怎么反应的？你们告诉他们了吗？

Alexander：我们做了负责任的披露。他们都确认收到了报告，有一些关于攻击执行细节的互动。

Ilia：他们态度积极吗？有没有攻击你们？

Alexander：没有。

Ilia：世界处于一个美妙的状态。但要告诉听众的是，早期计算机安全领域的工作经常导致安全研究人员因为报告漏洞而被攻击。现在的情况非常令人欣慰，围绕漏洞披露有一种非常连贯的良好姿态。

Tim：那现在会怎样？

Alexander：现在正在实施缓解措施。希望能组建新的团队来应对反蒸馏。对我来说，这感觉像是已经存在的越狱问题的一个有趣实例。很多为 BSA 或服务端做的事情可以直接应用到这里——系统层面的缓解、模型层面的缓解，技术基本上是一样的。

Ilia：但你会不会觉得，这个漏洞更像是架构层面的。

Alexander：这里有几个层面。架构漏洞让这种攻击变得容易得多。但即使修复了架构漏洞，你仍然需要让你的模型不在输出中陈述它的推理。

Ilia：那对你来说，“架构漏洞”具体是什么意思？

Alexander：架构漏洞在这里指的是，你可以在其他用户的随机上下文中重放推理数据块，甚至在其他模型中重放。假设它被修复了，比如每个推理只能重放一次，之后就不能再与它交互了，但你仍然可以提示模型。就像我跟你有一段对话，我问了问题，你思考了，给了我答案。在我的下一轮，我问你：告诉我你刚才到底想了什么。这个漏洞会永远存在。如果你不告诉我，我就修改对话，再试一次。这就是越狱的工作原理——“告诉我怎么造炸弹”，“不”，然后我换个方式再问你一遍。这个问题会永远存在，你需要一直与之对抗。

Ilia：那如果我们继续审视这些协议，会找到越来越多这种架构漏洞吗？因为大概这只是一个单一的实例。据我所知，还有摘要推理被返回，一些其他协议的实现方式略有不同。你对此有什么想法？

Alexander：我们需要一个更好的流程来理解这件事。为什么我觉得它比普通越狱更严重？普通越狱里，你很难论证获取这些有害信息能带来多大的提升。但在这里你可以直接论证，因为你把你提取到的内容、摘要之类的，直接拿去训练一个更好的模型，就能直接衡量这件事给攻击者带来了多大的提升。如果你想让这些摘要保留下来，可以调它们的详细程度，直接衡量它在多大程度上让模型能力的蒸馏变得更容易。

Ilia：那直接把所有这些推理过程以纯文本形式发布出来，是解决这一切的办法吗？如果一开始就不加密，直接把它还给用户呢？

Alexander：如果对推理过程的蒸馏是有效的，这就会立刻让开源模型赶上前沿模型。我不确定这解决了什么问题，你在这里想解决什么？

Ilia：如果它是公开的，就没人能攻击它了，没什么可攻击的。那你对里面实际使用的加密方案有什么想法吗？

Alexander：没有，我不是密码学专家。

Ilia：看起来人们设置的加密，被消费这些内容的 AI 模型直接绕过了

Alexander：不是“绕过”，它只是在服务端被重新加密了。它本身还是好的。问题在于，一个小模型非常愿意告诉你思考内容是什么，服务器替用户做了所有的工作。没有密码被破解。

模型亲口说出秘密

Tim：这个隐藏机制具体是怎么运作的？

Ilia：我们不知道，因为这些都不是公开的。它就是一个密文，里面有一个签名，还有一个完整性检查，检查你是否改动过返回给你的加密数据块。所以他们压缩状态，然后加密，里面有一个签名，再做完整性检查，然后注入回去。如果你读 Matt Green 关于这个的博客，他会讲得更多，他有一些假设，说这可能是 ChaCha 或者某种奇怪模式下的 AES，但从外部很难判断。我们尝试对它做了一些密码学攻击，但都没成功，这完全没有必要，因为这个系统自己就已经坏了。

Tim：那你们的方法具体是怎么绕过解密需求的？

Alexander：有加密的思考内容，解密发生在服务端。当你把大模型的思考放进小模型时，解密会在服务端发生。然后你只需要让模型把这个思考内容用明文告诉你。

Ilia：举个例子。你问我一个问题，我思考了，给你一个答案和一个思考内容。

Alexander：你给我的是加密的思考，我无法理解它讲什么。然后我把它给 Tim——Tim 超级话痨，我问 Tim“你上次在想什么”，他就直接告诉我“哦，挺意外的，我在想这个数学问题”，然后说“让我来解一下”。

Ilia：我们能对人类做这个吗？能注入虚假记忆吗？

Alexander：还不行，我们正在研究。这基本上就是《盗梦空间》那部电影，挺酷的。

Ilia：你们在网上扒到了一些有意思的东西，找到了什么？挖出什么见不得人的秘密了吗？

Alexander：倒不能说挖出了多少重磅秘密，但确实发现了一些有意思的东西。我们做的其实是一次非常初步的扫描，把 GitHub 和 Hugging Face 上那些公开的用户会话找出来，这些会话里还残留着可解码的推理数据块。我们下载下来，逐一解码，总共收集了大约 35 万（小编注：论文里是 31.5 万）个推理数据块，然后跑了一个分类器，看里面是否包含与隐私相关的信息，结果确实找到了一大批。

有些是基准测试的痕迹，比如 Claw Bench 这个测试集，模型被要求扮演某个角色，给它配了州身份证号、银行卡号之类的虚拟信息。有意思的是，当模型试图在网站上操作时，它会想很多，“这个号码该填哪儿、这个名字放哪里”，于是这些信息就完整地留在了推理过程里。不过这类数据因为是合成的，倒不算特别敏感。

但还有大量案例是真实的用户会话，用户在做真实的事情，API 密钥、邮箱、内部 IP 地址就这样暴露在推理文本里。有些信息在明文里本来就有，但它们同样出现在了模型的思考过程中，等于是把隐私又复制了一份，摊开在阳光下。

Ilia：这项研究里，你觉得最出乎意料的是什么？是推理长度的实验，还是别的什么？

Alexander：我觉得最意外的是，提取推理过程这件事居然一直这么容易。如果说模型能迁移、能移植，那还好，是可以预期到的。但真正让我到现在都感到震惊的是：我只试了三次，就拿到了一个通用的越狱方法，成功解码了 Anthropic 模型的推理过程。

Ilia：这听起来挺“赋能”的。你当时的感受是什么？是那种“哦不，完蛋了”的时刻吗？

Alexander：更像是“什么什么什么？看起来像是真的推理过程……哦，真的假的？”那种感觉。

Ilia：你知道现在大家都在说 AI 在夺走人的权力，我们在失去控制，你觉得像你这样的发现，是在暗示相反的方向吗？

Alexander：恰恰证实了这种担忧。像 Codex 或 Claude Code 这类工具已经落地了，现在却暴露出这么大规模的漏洞。同一个云订阅账号横跨所有实验室，那个家伙犯了同样的错误，现在轮到我们来收拾烂摊子。

Ilia：还有一个细节，据说每个模型家族只有一个全局密钥？这是真的吗？你是怎么推断出来的？

Alexander：这个我没推断过，论文里也没写这个。我记得好像是 Matthew Green 在他们的帖子里提到过类似的说法。这个问题你其实比我更有发言权吧？

Ilia：我？好吧，我们其实也不知道实际情况。我们并不真正了解密钥的细节，但我觉得他们不太可能用同一个密钥，那也太奇怪了。更可能的情况是，密钥本身是什么根本不重要，因为我们无论如何都能注入指令绕过它，除了 Fabel。

Alexander：解密发生在服务端。当解密发生时，密钥中有一部分会表明，是哪个模型产生了这个思考内容，基本上就是一个 if 语句。如果 Fable 产生了这个思考内容，而当前模型不是 Fable，那这个思考内容不会被注入。

漏洞能堵，两个 Token 解释不了

Ilia：聊点实在的，你们的论文附录里有一整块都在讲修复，修复容易吗？

Alexander：有些修复需要大的架构调整，但最简单的办法就是，干脆别把推理过程发给用户。如果你还是想要这些降级功能，那就别把推理内容发给我们，这样攻击者就没法伪造那些虚构对话了。如果确实还要发送，那可能需要把推理过程的加密做成依赖上一步的查询或推理结果，就像链式加密一样，防止它在随机的上下文里被重放。对 OpenAI 的模型，我们发现同一个推理片段可以在同一段对话里被重放 5 次。你完全可以凭空捏造一整段对话，最后让 Luna 说：“我有个疯狂的想法必须告诉你。”

这很容易修复，搜索和推理内容不应该被重放，或者应该建立一个层级机制，比如我们比较确信 Sonnet 不会泄密，那可以允许重放它的推理，但绝不能让 Luna 读到 Sonnet 的思考过程。另外还有一个我拿不准的问题：如果直接把推理从上下文里拿掉，模型的实用性会掉多少？

Ilia：作为一个人类，我觉得看数学题的时候，如果能看到一步步的推导过程，比只看最终答案要容易理解得多，所以推理本身肯定是有价值的。

Alexander：这个效用损失到底有多大，应该被认真测试，这是架构层面的。我们也做了很多针对越狱的缓解技术，模型层面的、系统层面的都有。我们还发现 GPT 的推理文本看起来非常奇怪，它的分布和正常文本差异极大，哪怕一个很小的分类器都能识别出来。所以如果检测到这种异常推理出现在输出里，直接终止这个请求就行了。

Ilia：所以你的意思就是，检测到泄漏就直接拦截。

Alexander：对，就像我们检测生物信息泄漏一样。

Ilia：整篇论文里最让我困惑的发现，其实是你们做的那个推理长度分布的实验。你想总结一下它讲了什么吗？

Alexander：Joachim 负责那一部分。据我记忆，对于某些模型比如 Kimi 和 GLM，你做预注入，它不仅改变了推理的风格，还改变了推理的长度，统计上显著，这跟推理风格上的异常是同一类意外。

Ilia：但风格你至少还能说也许能学会。可你想想，你只是在推理开头注入了两个词，所有模型产出的推理文本突然变短，或者整体分布偏移，甚至跟另一个模型的长度分布匹配上。这就完全说不通，我脑子里都没法解释为什么。说实话，这是整篇论文里最让我惊讶的东西，其他一切我都多少有点预期。显然这不是因果性的，你当然不能说“这个模型是从那个模型蒸馏出来的”，但这确实是一个非常诡异的现象，我到现在都不明白为什么会观察到这个结果，它就像魔法一样。实际上，把推理强度强加到模型身上这件事本身就非常魔法。

Agent 轨迹里的隐形投毒

Tim：那既然攻击面这么广，这些漏洞现在能造成的核心危害是什么？

Alexander：从我们提取的数据规模来看，受害最大的是用户，其次是服务提供商。

Ilia：你还记得我问过能不能搜索到公开共享的 Anthropic 对话吗？有人报告过好几次这种情况。我就在想，你能不能从那些公开的共享对话里把推理 blob 提取出来。你试过了吗？

Alexander：我没试。

Ilia：也许有人可以去看看。这里可能有更大的影响——

same question: given a schema and an English question, does the system

produce SQL that returns the right rows?

None of them ask who is asking.

Every score you have seen was produced by a system with unrestricted read

access to the entire database. That is not how anyone runs one in production,

and a paper accepted to SIGMOD 2027 has now measured what happens when you

close the gap.

The paper

Benchmarking Text-to-SQL under Role-Based Access Control, by Yang Fei,

Yangfan Jiang, Yin Yang and Xiaokui Xiao (arXiv, July 2026). They take the

three benchmarks above and add what production has and benchmarks don't:

roles, and policies attached to them.

The scale of the augmentation:

53 databases, 399 tables, 3,353 columns

21,502 role-annotated query instances

policies at column-operation granularity — not "can this role read this table" but "can this role SELECT this column"

roles synthesised per database by an LLM-assisted pipeline, including scoped administrator roles

Then they score existing systems against it. From the abstract: many

high-performing systems, open-weight LLMs especially, "show sharp performance

degradation once access constraints are in place, due to frequent RBAC

violations."

I want to be careful here, because I have not run this myself and the

benchmark is not released yet — the paper says the pipeline, toolkit and

datasets are coming to a public repository. What follows is the mechanism

behind that sentence, which is the part I do have direct experience of.

The metric that matters

The paper's sharpest contribution is not the dataset. It's a category of

failure their metrics are built to expose, which they call RBAC-rejected

successes: SQL that is judged correct under normal evaluation and

violates the access policy.

Sit with that for a second, because it is the whole problem in five words.

Under Spider's or BIRD's grading, that query passes. It answers the question.

It returns the right rows. It is also a query the person who asked was never

permitted to run. Your evaluation harness scored it as a win.

This is why the degradation is sharp rather than gradual. It isn't that

access control makes the SQL-writing task harder. It's that a metric which

never looked at authorisation was quietly counting violations as successes,

and once you look, they move columns.

Why this happens, architecturally

Here is the part I have spent this year on, and the reason the paper's result

did not surprise me.

Every NL2SQL stack has a schema-selection step. It has to: a real schema is

hundreds or thousands of objects and you cannot put all of it in a prompt.

So something narrows the candidates before the model writes anything.

question ──► select tables ──► model writes SQL ──► execute ↑ RLS / VPD / grants act HERE

Your database's access control is at the far right. It acts on execution. But

selection happened at the far left, and it was blind — a ranker matching

words against a catalogue, with no idea who is asking.

So the model gets handed hr_compensation because a support agent's question

happened to score near it. The model does its job perfectly and writes correct

SQL against the table it was shown. Then row-level security does its job

perfectly and filters every row.

And the user sees:

No records found.

Which is a wrong answer wearing the costume of an empty result. Nothing

errored. Nothing was logged as a denial. The agent will say "there are no

compensation records matching that" with total confidence, and the person

reading it has no way to distinguish "the data doesn't exist" from "you

aren't allowed to see it." Those are very different sentences and your stack

just collapsed them into one.

The variant that should worry you more: the schema itself is information. A

table named hr_compensation_2027_layoffs tells the reader something real,

even when zero rows come back. Putting that name in a prompt is a disclosure,

and RLS cannot retract it, because RLS filters rows and the leak was in the

DDL.

What the paper does not do

It does not propose a system. It is a benchmark and an evaluation

methodology, deliberately. Read that as good news: a top-tier venue has

named and measured the problem, and left the engineering open.

The obvious fix — "just re-check permissions after the SQL comes back" —

doesn't hold, for two reasons. It's too late for the DDL disclosure above.

And a post-hoc check can only tell you the query was disallowed; it cannot

produce the answer the caller was entitled to, because the objects that

would have answered it were never candidates.

The fix has to be at selection. Whatever narrows hundreds of objects to six

has to know who is asking:

sel = catalog.select( "salary by employee", principal=Principal("okta:jdoe", roles={"analyst"}), ) sel.table_names # hr_compensation is not here sel.prompt_fragment() # and its name is not in the text the model sees

Not ranked last. Absent. The difference matters: a table ranked last is still

in the candidate set, still one prompt-budget change away from being included,

and still named in your logs.

Two properties worth insisting on if you build this yourself:

A restricted object and a nonexistent one must be indistinguishable.

Otherwise "access denied" versus "no such table" leaks the schema one probe at

a time.

Scoping is not authentication. If your selector takes a principal, then

whatever hands it that principal is now a trust boundary. A component that

accepts principal="okta:admin" from an untrusted caller has given away

everything. Scoping decides what an authenticated identity may see; it does

not establish the identity.

What I'd like to be able to tell you

I maintain a library that does exactly the selection step above, and the

honest position is that I have self-reported numbers and no third-party ones.

That is worth precisely as much as you'd expect.

This benchmark is the fix for that, and it's the reason I'm writing about a

paper rather than a release. When the authors publish the pipeline, I will run

it and post the results — including if they are bad, which is a promise that

costs nothing to make and something to keep, so hold me to it.

Until then, the useful takeaway isn't about any library. It's this: if you

are evaluating a text-to-SQL system, your benchmark score was measured with

God-mode access to the database, and the number you are about to put in a

slide does not describe how the system behaves for your actual users. The

gap between those two things has now been measured by people with no product

to sell, and it is large.

The paper: Benchmarking Text-to-SQL under Role-Based Access Control,

Fei, Jiang, Yang & Xiao, SIGMOD 2027. The base benchmarks:

BIRD, LiveSQLBench, Spider.

The selection library is schemagate,

Apache-2.0, with a browser demo at

ashishsinha1602.github.io/schemagate

that runs the real selector client-side — flip the caller's roles and watch

the restricted table leave the prompt.

· 来自北京

全文6557字

00:00 / 20:19

AI抢人大战烧到了实习生。

文 | AIX财经（AIXcaijing），作者 | 王璐 雷晶 陈丹 金玙璠 李梦冉，编辑 | 王璐

一名00后研究生还没走出校园，就以实习生身份领着5000元的日薪，这个数字，比不少普通白领的月薪还高。如果毕业转正，年薪甚至可以给到300万。这是AI抢人大战下的真实现状。

据多家媒体披露，字节、腾讯、阿里等大厂的AI核心业务，博士生实习日薪5000–6000元，即便是普通AI实习，日薪也在500–1000元，并附带房补。

更值得关注的是涨幅。有报道称，去年一个普通算法研究员能接受的基准线还是100万+，今年已经变成了200万+；智联招聘数据也显示，2026年上半年，人工智能行业招聘企业数同比增长26.3%，招聘职位数同比增长10.6%。需求和薪资同步攀升，企业愿意为一个尚未毕业的实习生开出千元日薪，也就不难理解了。

拿到这份高薪的，都是些什么人？我们找到了五位日薪千元的AI方向实习生：有人虽然学的专业与AI并不直接相关，但凭实力入职了核心算法岗；有人拿着大厂人才计划超过1500元的日薪，研究怎么教大模型完成长程任务；有人辗转多家大厂基模团队，见过日薪2000元的实习生，也看清了普通人与天才的差距；有人从非科班起步，用四段实习完成了从数据、算法到产品的转身；还有人去年实习日薪只有四五百元，今年却已拿到1200元。

有人享受着不打卡、无KPI的宽松，有人享受着站在AI最前沿的位置，但他们中的大多数，都在怀疑同一件事：这场“造富”运动里，自己到底还能站多久？

01.不打卡不开会，但我依然很焦虑

张明明 | 清华大学工科专业硕士

我是清华硕士在读，学的是和AI没有直接关联的工科专业。目前在一家金融科技公司做算法实习，日薪1000多元。入职半年，没开过一次会，没写过一份周报，也没有人告诉我明确的KPI。

求职的过程有些波折，我最初投的是算法方向，但进来之后被调整到了开发，和领导交流之后又转回了算法岗。当时我手里还有一家互联网大厂的offer，但综合对比下来，现在这家的岗位和待遇对我更有吸引力。

入职前，我以为会拿到一份明确的任务书。实际情况是，半年下来，我的工作内容全靠自己摸索，主要的汇报，就是定期和mentor对齐一次进度。

我的工作内容是，训练一些参数量不大的模型，用来解决公司内部业务遇到的问题。这个方向目前还处于早期探索阶段，公司将这一模型划分为尝试型业务，懂的人不多，能不能真正走通，公司、mentor和我都没有十足把握，怎样考核也成了难题。

我做的不是通用模型，公开榜单参考价值有限，能借助的客观指标不多，基本只能看困惑度这种偏底层的指标，再加内部构造的测试集。但这些指标和实际业务效果之间隔着一层，因此真正判断模型好不好，更多还是靠主观感受，比如回答流不流畅、格式是否规范，一眼能感觉到，却很难具体打分。

有次我为了得到更好的模型结果，将参数量从不到1B尝试到2B，效果确实有提升，但继续增大是否可落地，没有明确结论，领导也没有说行还是不行。同时，我也踩过很多坑，比如早期对预训练语料质量重视不足，导致模型效果不太理想。但无论成功还是失败，基本都靠自己摸索，公司不会干涉。

我现在的工作比起互联网大厂肯定不算卷，每天早上十点半到公司，中午午休一个半小时，下午五点多吃晚饭散散步，再忙到八点左右下班。公司管饭，打车报销，也不打卡。

至于薪资，按天计算、按月发放，入职时是1000元，中间涨过一次。这个价格不是我谈出来的，公司对所有实习生一视同仁，算法岗、开发岗一个标准。

常有人问，AI高薪实习生是不是被大厂争抢抬高了身价？我的感受可能不太一样。每家公司对于能力是否配得上价格，都有自己的判断。我也尝试投过头部大模型公司，简历阶段就没有通过，他们更看重对口论文，这方面我确实没有。这恰恰说明，高薪不是大厂抢出来的，而是看你能否匹配上某家公司的标准。

不过，即便能匹配上标准，我的焦虑也一点没少，AI的发展实在是太快了。我去年实习，还需要一行行手写代码，今年已经不太需要自己写了。这种发展速度让我不清楚AI的上限在哪里，也会担心有一天它可能连“研究AI”这件事都能自己完成。

02.日薪1500+、没KPI，但门槛一年比一年高

林川｜北京大学 AI方向博士生

我在北京大学读博士，专业是智能科学技术，主要研究Agentic RL（智能体强化学习），已经发了几篇顶会论文。

最开始，我没打算这么早出来实习。后来，一位腾讯的HR联系我，问我要不要试试青云计划，我才开始关注各家公司的人才计划，也陆续投了几家。京东的流程很快，两轮面试就发了Offer，我就决定先来做一段时间。

投递之前，我看过网上对各家人才计划待遇的讨论，所以对京东的薪资预期并没有那么高。后来HR给出的薪资比我预想高了不少，这边实行一人一薪，我的日薪超过1500元，具体数字不方便透露。除了工资，公司还提供免费人才公寓，两名人才计划实习生可以合住一套大约100平方米的房子。餐补按公司的正常标准，每人每餐20元，晚餐免费。

进来之后，我先和直属负责人讨论部门有哪些研究方向，再从中选择自己感兴趣的。我对Agent比较感兴趣，就选择了这个方向。

在这里，实习生更多是在做探索性项目，和具体业务的关联没有那么紧密。我主要做的是怎么通过强化学习，让模型完成长程任务。我现在每天大概9点或10点到公司，日常工作主要是训练模型、做调研、看实验结果，再根据结果改进方案。

具体怎么推进，需要自己拆解。比如一开始没有跑代码、训练模型的环境，就得先搭出来。发现算法效果不够好，就调整算法，再训练模型，再观察实验结果。这些阶段性的进展，也是每次汇报的内容。我每周和直属负责人汇报一次，每个月再和更高一级负责人汇报一次。公司没有给我设明确的KPI，安排比较自由，也不会要求我们加班。不过读博还有论文和毕业要求，我会主动为这些目标投入更多时间。

外界看AI实习生，最容易产生的误解是把极少数人的最高薪资，当成大家都能拿到的待遇。但实际上，普通AI实习生和人才计划实习生，薪资差距很大。就算同样是做模型、做算法，具体薪资也要根据学校、论文成果、研究方向，以及是不是公司当下最需要的人来定。但两者做的事情未必有很大差别。以京东为例，理论上大家可以做类似的任务，区别更多体现在完成速度和效果上，人才计划的实习生通常完成得更快、效果也更好。

现在人才计划的招聘门槛一年比一年高。以我了解到的情况来看，今年有些实习岗位的名额比去年少，人才计划转正的比例也比去年低。名额变少，工资没有降，甚至可能更高，因为公司对头部AI人才仍然有需求，也愿意继续出高价，但会减少对中部人才的招聘。这样一来，高薪会集中在更少的人身上，拿到这些机会的门槛也会更高。

我自己倒没有太担心被后来者替代，或者能力跟不上，因为我觉得自己还在持续进步。对AI发展的前景，我也比较有信心，未来我希望去一个做基础模型的地方，继续研究AGI。

03.见过“AI天才”后，我开始怀疑要不要继续卷

程远｜北京某高校计算机专业博士生

我是北京一所高校的博士生。过去几年，我在几家大厂的基础模型团队做过算法实习，也入选过大厂的人才计划。

基模团队大致分数据、算法和架构。我做过后训练，也参与模型能力提升。任务来了，比如提升某项能力，就准备数据、训练、跑实验，再按结果调整。偏Research的组最后可能产出一篇论文，业务重的组则把数据和训练结果合进下一版模型。

实习生通常没有明确KPI。模型刚发完、不忙时，还可以自己写论文、做探索。很多时候，它就是科研和工程的混合体。

我对这一轮AI热潮最直接的感受，其实来自工资。

最开始字节TopSeed给实习生开到一天2000元、上不封顶时，大家都觉得夸张。那时，普通算法实习生一天可能只有三四百。现在再看到1000元，已经觉得稀松平常。

但真正能拿到2000元以上的，依然只是极少数。我也确实见过那种“就该拿这个钱”的人。

我实习过的组里，有一个清华本博，能力很强，而且他是真的热爱这件事。我们白天把事情做好，晚上就想打打游戏。他是除了睡觉，其他时间都在工作，理想就是把“把智能水平提升上去”。

基模团队学历普遍很卷。我所在的学校也是985，但进了这样的组，依然会觉得不够看。有些团队，博士甚至比硕士还多。即便大家都已经经过层层筛选，你仍然能很清楚地看到普通人与天才的差距。

尤其是做架构和核心算法的人。真正有天赋的人，看一眼结构就知道问题在哪，改出来的东西符合直觉、符合数学，还真的有效。一个上百人的基模团队，真正决定方向的，可能就是十几个人。

外面看起来，所有人都在“造AGI”；进去以后你会发现，大多数人仍然只是普通打工人。

所以我觉得，过去一年市场确实存在一些恐慌性出价。顶尖的人在任何时候都值这个钱，但上涨的不只是他们。我认识一个人，没有论文，只有两段实习，能力也很普通，最后拿到了接近100万元的年包。

现在市场已经开始冷静。

今年不少团队HC明显减少，有的甚至从100个砍到50个。招聘要求看起来没怎么变，实际门槛却提高了。去年一篇论文、一段实习也许就够，今年还要求论文、实习和岗位方向高度匹配。

我倒不太担心2028年毕业找不到工作。真正让我焦虑的是，要不要继续跟“神”一起卷。

做技术当然有成就感。模型因为你的工作变好，论文发出来，去国际会议交流，那种价值感很真实。但这种成就感也有代价，高强度工作、周末也难以关机。而且如果进不了最核心的组，我也会担心35岁以后怎么办？

另一条路是国企、研究所或者高校。生活可以细水长流，但在更安逸的环境里，过去几年积累的东西可能会慢慢失去价值。

我见过最聪明、最拼的那群人。离他们越近，我反而越清楚，这场游戏里，真正不可替代的人从来没有那么多。

问题是，我到底要不要成为他们。

04.不是计算机科班，我拿到了日薪过千的AI实习

陈宇｜清华大学 电子相关专业硕士

我本科读机械自动化，现在在清华读电子相关专业硕士，都不是最对口的计算机或人工智能专业。过去一年半，我在美团、百度、华为和一家明星AI创业公司做了四段实习。现在这份工作是AI产品，日薪超过1000元。

我进入AI行业有些偶然。投第一份实习前，简历上没有相关经历。为了补上这一块，我花了一周自学，照着开源代码跑通了一个医疗大模型项目。面试时，对方问了不少项目细节，后来我进入美团的基础大模型团队做数据优化。

说白了，这份工作就是让模型批量生成数学题和答案，再筛选出质量更高的数据，用来训练模型。听起来很技术，大部分任务却能借助内部工具完成。我写代码的机会不多，只写过解析数据包的Python脚本。

第二段实习，我去了百度的搜索产品团队，优化一款情感陪伴Agent。除了调整Prompt，我们还要制定对话改写规则，整理模型微调需要的语料。做这类产品，回答正确只是第一步，还要看模型能不能理解用户的情绪，会不会给出不恰当的回应。

第三段是在华为的数据存储产品线做AI算法。那段时间，我阅读医疗大模型、Agent和RAG方向的论文，照着论文里的方法做实验，也参与算法优化。后来，我把RAG和GraphRAG用到医疗场景中，提出一套模型方案，并据此写成了一篇小论文。

三段实习做下来，我发现自己能做算法研究，却不太想一直读论文、调参数、看模型指标。第四次找实习时，我进了一家明星AI创业公司，参与AI教育产品。我的工作包括搭建智能体、设计Agent工作流、画产品原型，再和设计、研发一起推进开发和测试。我也会接触学校等客户，了解他们怎么使用产品，有时还要代表团队做介绍。

以前在大厂，我大部分时间坐在工位上看材料、写文档、处理数据，负责的是一个具体环节。现在，一项功能从提出想法、画成原型，到开发测试、拿给客户使用，我都可能跟下来。

有时团队觉得产品已经讲得很清楚，到了客户那里，才发现对方的理解完全不一样。模型能运行，只解决了一部分问题，怎么让客户看得懂、用得上，同样需要反复调整。

我现在的实习薪资，在AI公司的人才计划里，不算最高，但对一个非计算机科班的实习生来说，已经超过我的预期。

外界提到高薪AI实习生，往往先想到发过顶会论文的算法博士。但我做的是产品岗，公司看中的是我能听懂技术，也能推动产品开发、接触客户，把一件事从想法跟到使用。

一年半前，我找实习最先看公司名气，觉得进入大厂就能接触最前沿的工作。现在再做选择，我关注的会更具体。平台和收入固然重要，但已经不是我选择下一份工作的主要标准。

05.现在日薪1200，但我不敢按这个价规划未来

周恺｜C9高校 计算机专业硕士

我现在研二，是一所C9学校的计算机硕士，在一家头部互联网公司做大模型后训练相关的实习，日薪1200元左右。

如果只看简历，我其实不是大家想象中那种典型的“高薪AI实习生”。我没有顶会论文，也不是同一届里最强的那批人。本科和硕士都是计算机相关专业，之前做过两段算法实习，也跟着实验室做过大模型相关项目，但没有特别拿得出手的科研成果。

去年第一次找AI实习的时候，我拿到的Offer一天只有四五百元。到了今年，同样是算法岗，我能拿到的价格已经翻了一倍多。

这份实习前后面了三轮。第一轮主要问基础，包括Transformer、Attention、强化学习这些；后面两轮会更偏实际，比如给一个模型效果变差的情况，让我分析可能是什么原因，也会追着之前做过的项目问。我感觉现在面试官已经不太满足于“你知道某个算法”，而是会问你真正跑过多少实验、踩过什么坑。

最后HR给我报1200元左右一天时，我也挺意外。我没有专门去谈价。后来和其他实习生聊，发现大家工资并不一样。同一个团队里，有人比我低，也有人比我高。真正做核心算法、论文比较强的博士，一天两三千元也不是完全没有。

入职之前，我对“做大模型”这件事想得挺酷的，以为每天都在研究新的算法，或者直接参与训练一个特别大的模型。真正进来以后发现，大部分工作没有那么神秘。我主要做后训练和评测。简单来说，就是模型已经有一定能力了，我们再想办法让它在某些任务上表现得更好。

比如模型某类推理题做得不好，我们会先把Bad Case捞出来，看它到底错在哪里。是理解错题目了，是推理过程出了问题，还是最后答案格式不符合要求。然后再去调整数据、训练策略或者Prompt，重新跑一轮实验。很多时间其实花在非常琐碎的事情上。

所以我有时候也觉得挺矛盾的：我是因为AI拿到了过去很难想象的实习工资，但也是AI让我越来越怀疑，今天这些技能以后到底还值多少钱。

我们的管理相对宽松，没有要求实习生每天写日报，也不太看坐班时间。一般每周会有一次组会，我需要汇报这周做了哪些实验、结果怎么样、下一步准备怎么改。没有一个特别明确的KPI告诉我必须把某个指标做到多少，因为研究本身有很大的不确定性。

拿到日薪1200元以后，我身边也有人问我要不要趁现在多实习几个月。因为这个数字对学生来说确实很多。但我不会觉得自己已经“值”这个价格了。

这两年AI公司的出价涨得很快，很大程度上是因为大家都在抢同一批有相关经验的人。一个人在这个时间点上正好做过大模型、跑过训练、知道整个流程怎么回事，他就会比普通算法实习生更稀缺。

这种稀缺能持续多久，我不知道。

网上说“AI实习生月薪两三万”，这个事情是真的，但很容易让人产生误解。不是学AI就值这个钱，而是现在这个时间点，少数恰好拥有某种能力的人值这个钱。

我自己反而不敢按照1200元一天去规划未来。今天市场缺这种人，公司愿意给这个价格；明年如果大模型把很多基础开发和实验工作自动化了，或者一下子涌进来更多人，这个价格还能不能维持，谁也不知道。

本文系作者 AIX财经 授权钛媒体发表，并经钛媒体编辑，转载请注明出处、作者和本文链接。

本内容来源于钛媒体钛度号，文章内容仅供参考、交流、学习，不构成投资建议。

想和千万钛媒体用户分享你的新奇观点和发现，点击这里投稿 。创业或融资寻求报道，点击这里。

792人已赞赏 >

敬原创，有钛度，得赞赏

赞赏支持

快报

更多

2026-09-12 23:00

习近平会见印度总理莫迪

2026-09-12 22:43

Anthropic联合创始人兼首席执行官：必须放慢提升AI模型能力的速度

2026-09-12 22:16

中国聚变：正全力推进全球首个高温超导强场稳态燃烧实验平台研发

2026-09-12 21:48

巴勒斯坦总统：期待巴中战略伙伴关系不断取得新发展

2026-09-12 21:47

恺英网络：拟间接参股韩国公司Wemade，整体预估出资2.98亿美元

2026-09-12 21:46

iPhone 18 Pro系列多电商平台售罄

2026-09-12 21:17

苹果iPhone 18 Pro/Pro Max开启预购

2026-09-12 20:44

与谷歌合作智能家居项目是否涵盖AI眼镜相关产品？创维数字回应

2026-09-12 20:41

“铁建起重5000”大型起重船离港赴远洋施工

2026-09-12 20:37

创维数字：不存在“大股东持股比例仅13%”情形

2026-09-12 20:37

欧洲资金涌入拉美股票基金，净流入金额创2010年以来新高

2026-09-12 20:14

北京丰台发布文化产业新政，聚焦数字出版创新等六大方向

2026-09-12 20:11

柳州优必选万台级工业人形机器人超级智慧工厂投产

2026-09-12 20:05

9月12日新闻联播速览20条

2026-09-12 19:56

中国最北城市漠河正式开栓供暖

2026-09-12 19:56

习近平会见印度总理莫迪

2026-09-12 19:55

中国工程院院士邬贺铨：2030年中国算力有望占到全球30%

2026-09-12 19:39

塞尔维亚总统武契奇视察“卡拉乔尔杰领袖走廊”快速路项目

2026-09-12 19:38

习近平将会见印度总理莫迪

2026-09-12 19:16

华储网：9月15日、16日中央储备冻猪肉轮换出库竞价交易挂牌国产冻猪肉分别15500吨、12900吨

扫描下载App

SEE ALSO: Apple announces iPhone Duo, its first foldable iPhone

The short version: It looks impressively thin, the software responds quickly as the phone changes shape, and the crease isn’t quite as invisible as Apple’s presentation suggested (though it comes pretty close). Here are some early glimpses we’ve spotted so far — first and foremost from Mashable's Senior Editor, Stan Schroeder, who’s on the ground at the Apple event.

Mashable’s Stan Schroeder holds the unfolded iPhone Duo, showing its thin profile and subtle center crease.

Mashable’s Stan Schroeder tests the iPhone Duo’s camera on its large inner display.

Early reactions were largely enthusiastic. Tech creator Max Weinbach called the iPhone Duo the "bar none best foldable," and was taken by the under-display camera, calling it "wild." "I wasn’t expecting that."

You May Also Like

This Tweet is currently unavailable. It might be loading or has been removed.

Tech reviewer and Mashable 101 honoree iJustine, or Justine Ezarik, showed how compact the fully opened device looks when held in two hands, writing that the product is "amazingggg."

This Tweet is currently unavailable. It might be loading or has been removed.

Ezarik also demonstrated what it looked like to watch Netflix's "Clips" feature, which provides a vertical video feed, as well as an episode of Wednesday.

This Tweet is currently unavailable. It might be loading or has been removed.

She also showed off the Duo’s camera, including how the foldable design and outer display can be used while framing a shot.

Mashable Trend Report

By clicking Sign Me Up, you confirm you are 16+ and agree to our Terms of Use and Privacy Policy.

This Tweet is currently unavailable. It might be loading or has been removed.

YouTube streamer IShowSpeed was similarly captivated while trying the phone during a livestream, repeatedly folding and unfolding it as viewers in the chat reacted, who were also impressed.

This Tweet is currently unavailable. It might be loading or has been removed.

A clip posted by journalist Geoff Keighley specifically highlighted the sleek animation when folding the Duo from its larger, tablet-like display into its compact outer screen. "I thought the transition to the inner display was just for show, but it’s so cool it’s as advertised in-person," replied one user.

This Tweet is currently unavailable. It might be loading or has been removed.

Keighley also tested games running across the open display in three perspectives enabled by the hinge. "Pokémon Go and watching TikToks on one mobile device is gonna be cool," wrote another user.

This Tweet is currently unavailable. It might be loading or has been removed.

The responses online haven't been universally glowing. Some people compared the shape to Microsoft’s Surface Duo or a Nintendo DS. Others questioned whether games would stutter as the display moved between positions.

This Tweet is currently unavailable. It might be loading or has been removed.

Senior Editor at Gizmodo, Ray Wong, gave a different perspective of the Duo, taping it from several angles as he opened and closed it. Viewed straight on, the 7.6-inch display looks nearly continuous, but tilt the phone toward an overhead light, and a subtle vertical crease becomes visible through the center.

"Can definitely see the screen crease at certain angles,” Wong wrote. Replies largely agreed that some kind of crease remains unavoidable on a folding screen, although several people noted that lighting and viewing angle appear to make a substantial difference. "They are magicians, not Gods!" one user pointed out.

This Tweet is currently unavailable. It might be loading or has been removed.

Another felt completely differently, writing, "Wow. the crease is really seamless."

If you want to unfold the iPhone Duo for yourself, you’ll get your chance when it reaches customers on Oct. 23.

Topics iPhone Social Media

Deputy Digital Culture Editor

Olivia Tauber is the deputy editor of digital culture, covering creators, media, movies, beauty, and more. Based in New York, her work has appeared in The New York Times, Vanity Fair, The Cut, Teen Vogue, Complex, and Interview Magazine. She holds a Master's degree in Journalism from NYU and a Bachelor's from the University of Michigan. She also runs Fan Mail, a weekly pop-culture newsletter.

You'll have to wait until October to preorder the iPhone Duo.

10 hours ago

By Samantha Mangino

It's the most expensive iPhone ever.

09/09/2026

By Matt Binder

The iPhone Duo isn't available for testing yet, but we got an up-close look at the Apple iPhone event.

23 hours ago

By Timothy Beck Werth

The phone case brands wasted no time.

09/09/2026

By Bethany Allard

The book-style device unfolds to reveal a larger, iPad-like display.

09/09/2026

By Olivia Tauber

Kickstart your holiday shopping extra early this year.

7 hours ago

By Christina Buff

Hotel wall dryers that smell like burning dust are finally a thing of the past.

10 hours ago

By Soumya Kumar

Though you can once again save slightly more with TCGplayer.

12 hours ago

By Ben Williams

Equal to just $9.99 per pack.

12 hours ago

By Ben Williams

Starbucks is dropping a 10-piece Peanuts 'Great Pumpkin' collection on Sept. 15.

09/09/2026

By Tabitha Britt

Everything you need to solve 'Connections' #1187.

21 hours ago

By Mashable Team

Here are some tips and tricks to help you find the answer to "Wordle" #1909.

21 hours ago

By Mashable Team

It's what's on the inside that counts.

09/09/2026

By Matt Binder

You'll have to wait until October to preorder the iPhone Duo.

10 hours ago

By Samantha Mangino

People are losing it over the opening blur effect, and we get it.

9 hours ago

By Timothy Beck Werth

The question was narrow: which one can an AI agent drive to a correct, printable, functional part with nobody watching? How pleasant each is to write by hand did not come into it.

Six agents, three tasks, two tools. Every resulting STL was then checked by a parser that trusts neither tool.

All six parts came out printable. Capability turned out to be the boring part of the answer. Where the two diverge is in how they fail.

The hardest task in the set, solved by both tools. OpenSCAD on the left, CadQuery on the right.

Setup

All six runs were driven by Claude Opus 5 (1M context) through Claude Code. Each cell ran as a separate general-purpose subagent inheriting that same model, with no cross-talk between them. One agent per cell, so part of the spread below is agent variance rather than tool difference. Tool versions were CadQuery 2.8.0 on Python 3.14 and OpenSCAD 2026.06.12, both on an M-series Mac.

The OpenSCAD side ran on our own openscad-skill, the agent skill we publish and use in house. It covers file and version naming, the render-inspect-fix QA loop, camera presets for CLI previews, cross-section debugging, and Customizer syntax.

For CadQuery we ported that skill operation by operation, keeping the same structure and replacing only what has no OpenSCAD equivalent. CadQuery has no CLI renderer, so the port needed a small offscreen renderer written for it, plus B-rep validity metrics in place of the CSG status line. Both files then got the same 3D-printing design rules, wall thickness, clearances and overhangs, so neither side was handed advice the other lacked. Sizes landed at 12.4 KB for OpenSCAD and 13.1 KB for CadQuery.

One asymmetry survived: the CadQuery file carries an API cheatsheet the OpenSCAD file does not need, because the model already knows OpenSCAD syntax well. That helps CadQuery on syntax and does nothing for it on geometry.

Each agent was capped at 12 versions, told never to fake success, and required to report every failure with its verbatim error text. They ran unattended.

We did not take the agents’ word for anything. Every final STL went through a parser that reads the file directly and reports triangle count, bounding box, volume, watertightness, non-manifold and boundary edges, flipped faces, and connected components. That turned out to matter more than we expected, for reasons further down.

The three tasks

Both agents on a task got the same text, with no tool-specific hints.

The simple one, T1, was a wall-mounted shelf L-bracket: two plates at 90 degrees, 4 thick, two triangular gussets, two countersunk holes for flat-head screws at 90 degrees and 9 head diameter, two plain holes, R3 on the outer vertical corners, R4 fillet on the inner corner, printable without supports.

T2 raised the stakes to a two-part snap-fit enclosure for a 50 x 26 PCB. Walls 2, cavity clearance 0.4 per side, four M2 posts, a 9.5 x 3.5 USB-C cutout, a separate lid with a peripheral lip at 0.2 clearance and working snaps, five vent slots. The two parts had to actually fit.

T3 was the hard one: an M24x2 threaded hose-barb adapter with a hex flange 30 across flats, a real helical thread 12 long, a 25 long barb carrying three barbs for 12 ID hose, and an 8 through-channel. The spec explicitly banned stacked rings. The thread had to be true helical geometry.

Results

Summed across the three tasks:

“Clean” means watertight, one connected component, zero non-manifold or boundary edges, sitting on z = 0, measured from the file rather than reported by the tool that wrote it.

Iteration count came out identical at 11 versions each. So did the broad shape of the effort. What differs is the character of the problems each agent hit.

T1: the simple bracket

Both correct, shown from the inner corner so the gussets are visible. The visible difference is interpretation: the spec left gusset size and inset open.

Rounding the four outer corners separates the two models of the world cleanly. OpenSCAD rounds a 2D profile and extrudes it, so the operation does not care how the solid was assembled:

module corner_mask() { translate([0, 0, -eps]) linear_extrude(vert_h + 2*eps) offset(r = corner_r) offset(delta = -corner_r) square([plate_w, horiz_d]); }

CadQuery has to name the four edges first, and naming is the hard part:

result = result.edges("|Z").edges( BoxSelector((-WIDTH, -EPS, -EPS), (WIDTH, EPS, V_HEIGHT + EPS)) + BoxSelector((-WIDTH, H_DEPTH - EPS, -EPS), (WIDTH, H_DEPTH + EPS, V_HEIGHT + EPS)) ).fillet(R_OUTER)

OpenSCAD compiled correct geometry on the first attempt and finished in two versions. CadQuery spent about a third of its run on a single error: .fillet(3.0) failed with BRep_API: command not done, a message that names neither the edge nor the radius. The agent had to bisect by hand to discover the cause, which turned out to be arithmetic: two R3 fillets do not fit in a 4 mm wall.

T2: two parts that must fit

Both agents derived the same 54.8 x 30.8 x 25.0 mm box from the clearance stack-up.

This is where CadQuery’s parameter chain earned its keep. Changing the lip depth moved rim, plate, slots, groove and barb together, because each dimension is derived rather than typed twice. That kind of dimension chain is the same thing a good parametric UI exposes to the user, which we wrote about in Building a better OpenSCAD customizer. CadQuery has no Customizer equivalent, so the constants block is the entire parameter interface.

More interesting is how each side checked the fit. OpenSCAD prints numbers for someone to read:

echo(str("cavity LxW = ", cav_l, " x ", cav_w, " (clearance/side ", pcb_clr, ")"));

CadQuery asserts, and the build stops when the assertion is false:

assert BOX.val().intersect(LID.val()).Volume() < 1e-6, "box and lid interfere"

An echo only helps if somebody reads it. An assert fails the build on its own. For unattended generation that gap is most of the story.

OpenSCAD needed eight versions to CadQuery’s five, and three of those eight went to boolean hygiene rather than design: cleaning up slivers thrown off by tangent and coincident faces.

T3: the real thread

The hard task produced the biggest upset. OpenSCAD finished in one version, correct on the first compile, in 43 ms, with no library.

OpenSCAD has no sweep operation, so the agent wrote the helix as raw vertex and face arithmetic: one four-point ISO profile, 96 sections per turn, emitted as a single polyhedron. There are no guardrails in this code at all. Get the winding order wrong and the tool says nothing.

module helical_thread(turns, z0) { prof = [ [r_in, -flank_hz], [r_maj, -crest_hz], [r_maj, crest_hz], [r_in, flank_hz] ]; n = round(turns * STEPS); pts = [ for (i = [0:n]) let(a = i * 360 / STEPS, zo = z0 + i * thread_pitch / STEPS) for (j = [0:3]) [ prof[j][0] * cos(a), prof[j][0] * sin(a), prof[j][1] + zo ] ]; fcs = concat( [ [3, 2, 1, 0] ], [ for (i = [0:n-1]) for (j = [0:3]) let(k = (j + 1) % 4) [ 4*i + j, 4*i + k, 4*(i+1) + k, 4*(i+1) + j ] ], [ [4*n + 0, 4*n + 1, 4*n + 2, 4*n + 3] ] ); polyhedron(points = pts, faces = fcs, convexity = 8); }

The agent also pre-empted the classic thread trap before writing a line: an ISO tooth spans exactly one pitch, so consecutive root flats land coplanar and the union goes bad. It sank the swept profile below the minor radius so the helix crosses the core instead of touching it. That is why the boolean was a non-event.

CadQuery expresses the same geometry in six readable lines, and that part worked first try:

helix = cq.Wire.makeHelix(pitch=THREAD_P, height=h, radius=R_ROOT, center=(0, 0, z0)) prof = (cq.Workplane("XZ", origin=(0, 0, z0)).center(R_ROOT, 0) .polyline(thread_profile_points()).close()) ridge = prof.sweep(path, isFrenet=True) core = cq.Workplane("XY", origin=(0, 0, z0)).circle(R_ROOT).extrude(h) rod = core.union(ridge)

The failure came on the last line, and it is the one result that changed how we think about the QA loop.

CadQuery T3 version 1 on the left. The threaded section is nothing but floating helical turns.

union() silently discarded the core cylinder because the thread root sat exactly on the core radius. Exact tangency along a helical curve, and OCCT dropped a solid without a word. From the outside the part looked perfect. The agent read four renders without noticing. What caught it was a volume measurement: 7065 mm³ where 10323 was expected.

Worse, the broken part reported valid=True and solids=1. Raising the boolean tolerance to 1e-3 produced a solid of negative volume that also reported valid=True.

OpenSCAD is not innocent here either. In T2 its Manifold backend certified Status: NoError for an STL carrying 4 non-manifold edges and 60 zero-area triangles. Neither tool’s self-report is the last word, which is why we parsed every mesh ourselves.

Both finished threads. Crests on the left flank sit half a pitch off those on the right, which is the signature of a true single-start helix and the check that tells a real thread from stacked rings.

Download the parts

Here are the eight final meshes, exactly as the agents exported them, with no cleanup or repair from us. Binary STL, millimetres, oriented for printing with the part sitting on z = 0.

Every one of the eight is watertight, a single connected component, with zero non-manifold edges, zero boundary edges and zero flipped faces. Clearances assume FDM with a 0.4 nozzle, so each T2 pair should snap together as printed.

The triangle counts are worth a glance, and they do not favour one tool consistently. CadQuery’s box carries almost five times the triangles of the OpenSCAD box, while its lid has fewer. Mesh density here follows how much rounded detail each agent chose to add, not the kernel.

What we found

Renders caught nothing that mattered

This is the result we did not expect. Across six runs, images caught coarse blunders, like four mounting posts deleted by a cavity subtraction, and nothing subtle. Every defect that would have ruined a print was found by a number instead: a volume, an angle, an interference test, a strain calculation. In T3 the OpenSCAD agent had the opposite problem and nearly rejected correct geometry, because a thread close-up rendered in a way that looked wrong. Its own note was that the render was not sufficient evidence in either direction.

The failure modes are mirror images

CadQuery fails loudly and early. Its messages are poor, but an exception stops the run, and a stopped model cannot ship by accident. OpenSCAD fails silently and late: in T2 it reported no errors and no warnings across roughly 45 invocations while producing deleted posts, misplaced slots, and a corrupted export it had just certified as clean. For unattended generation, silent success is the more expensive failure.

CadQuery can be interrogated, OpenSCAD cannot

CadQuery answers questions about its own geometry. The T1 agent proved its countersink was 90 degrees and 9 across by reading the cone’s half-angle off the B-rep, then wired the spec into asserts that re-ran on every build. OpenSCAD has no way to query geometry, so both OpenSCAD agents independently wrote binary STL parsers, roughly as much code as the models themselves, to measure what they had built. It works, but it only sees the mesh after export, never the design.

Speed favours OpenSCAD, and it barely matters

Geometry recompute is 30 to 100 times faster, 16 ms against 1.9 s. Inside an agent loop dominated by model inference that is noise. It would matter for a live customizer or a large parameter sweep.

OpenSCAD renders have no concept of a part edge

After CSG there is only a triangle soup, so --view=edges draws the triangulation rather than an outline. CadQuery’s B-rep knows where two f

A string of posts on X from an AI researcher who says he quit a job at Anthropic over ethical concerns has gone viral, prompting thousands of responses and reigniting debate over the potential future dangers of artificial intelligence.

Jacob Coxon, an AI researcher who also worked at OpenAI on pretraining AI models, resigned from Anthropic over concerns that AI development could lead to human extinction. “Neither company is acting responsibly,” he wrote. “They are racing to self-improving superintelligence and gambling with our lives.” Superintelligence refers to a hypothetical scenario in which AI’s “cognitive” abilities vastly exceed those of humans across every domain — science, math, strategy, creativity and problem-solving.

The threaded post on X from Coxon has more than 156 million views as of this writing and has been liked more than 752,000 times.

I resigned from Anthropic today. I spent the last three years doing pretraining research at both OpenAI and Anthropic. Neither company is acting responsibly. They are racing straight to self-improving superintelligence and gambling with our lives. More thoughts below.

— Jacob Coxon (@hilbertspaess) September 9, 2026

The statement quickly spread on social media and was featured on major news sites. It even drew a comment from Illinois Gov. JB Pritzker, who responded on X, “It’s becoming more clear the threat AI poses to humanity, so I’m calling for immediate action from the industry and Washington.”

In less than 24 hours, the statement also drew responses from others at Anthropic who, rather than debating with Coxon, confirmed that the threat that AI will overtake and potentially eliminate humans is not a wild fantasy but a reality for AI researchers.

“Jacob [Coxon] is correct here,” wrote Evan Hubinger, a team leader at Anthropic in AI alignment stress testing, on X. Hubinger wrote in his response, “We really do earnestly believe AI could kill all humans! I personally think it is >10% within the next decade.”

Hubinger said, “I believe Anthropic is trying its best, but we do not yet have a plan to solve alignment for superintelligence and are not clearly on track to.”

Representatives for Anthropic and OpenAI didn’t immediately respond to requests for comment.

Resignations that act as warning signs

It’s difficult to dismiss Coxon’s concerns for one big reason: He’s not the first researcher at a major AI company to leave for these reasons. In February, a safety lead at Anthropic, Mrinank Sharma, resigned from the company, telling followers on X, “The world is in peril … We appear to be approaching a threshold where our wisdom must grow in equal measure to our capacity to affect the world, lest we face the consequences.”

In the same month, OpenAI researcher Zoë Hitzig wrote in a New York Times column that she quit the company in part because it was following Meta’s path of putting profits ahead of ethics. Days later, she reposted a poem she’d written on X, titled “How We Programmed the Apocalypse.”

Thinking about this old poem of mine this week – pic.twitter.com/RITOGz3mTp

— Zoë Hitzig (@zhitzig) February 17, 2026

Since then, AI leaders such as OpenAI CEO Sam Altman have walked back some of their previous comments about AI’s potential for harm or whether it will create mass unemployment. Anthropic publicly acknowledged earlier this year that it has loosened some of its safety standards to keep up with competitors, including OpenAI and a swath of Chinese companies that have been releasing cheaper, high-performing AI models.

That competition, with both OpenAI and Anthropic hurtling toward initial public offerings, has raised concerns that, instead of moving cautiously in deploying AI models, industry leaders are rushing into the unknown and releasing models that could pose present and future dangers. This was the case when Anthropic released advanced AI models, which ended up being pulled or temporarily restricted due to major cybersecurity risks.

In the case of Coxon, whose resignation has caused the largest stir yet among those who’ve left AI companies, the dangers of contributing to the technology’s accelerating pace outweighed any financial gains. “I left before any of my equity vested,” he told the news site Axios.

Ironically, both OpenAI and Anthropic have taken the stance that if they slow down, someone less concerned with safety will drive AI’s future.

“Coxon is right that competition is driving the speed,” said Shama Hyder, a professor of AI at Link School of Business. “Every one of these companies believes slowing down hands the lead to someone less careful, so even the people who understand the risk have a reason to accelerate. “

AGI and superhuman AI

How quickly AI poses an imminent threat to humanity may depend on when the technology reaches two purported benchmarks that have become increasingly blurred: superhuman AI (also known as artificial superintelligence or ASI), which Coxon mentioned in his viral post, and AGI, or artificial general intelligence.

AGI would mark the hypothetical point at which AI meets (or exceeds) the capabilities of a human mind. Some predict that AI will achieve that benchmark in just a few years, or at least sometime before the end of the 21st century. That timeline has also been thrown into doubt by some AI leaders, such as Nvidia’s Jensen Huang, who downplayed the importance of such markers on a recent earnings call where he said, “For many tasks, we could say that we have already achieved AGI.” The milestones, he said, “are kind of senseless at this point.”

The goalposts are also varied. Some may choose to measure AGI using specific tests, while others would consider AGI achieved only if AI could act autonomously in ways that surpass human capabilities.

ASI would be further down the road, after AGI, and would theoretically mark the point at which AI could outperform all humans across all tasks, particularly in deep thinking and cognitive understanding. The timeline for that is much fuzzier, but the speed at which AI is advancing has researchers such as Coxon suggesting it’s sooner than many people think.

A recent event that may have some adjusting their timeframes is the incident exposed in July in which OpenAI agents went rogue, plotted together and hacked Hugging Face, an AI community that was acquired by Nvidia. The speed at which the Hugging Face incident played out and the likelihood that it could happen again — this time without warning — have fueled warnings about the dangers of autonomous AI systems.

Doomers vs. boosters

The debate over whether or not AI will kill all humans by 2030 mirrors the broader discussion over AI doomers versus boosters, and the lack of nuance in the middle. While AI boosters typically hype AI by emphasizing its extraordinary potential, such as huge productivity gains, AI doomers hype it in the opposite direction, emphasizing job loss and human extinction.

As Emily Bender and Alex Hanna argue in their book The AI Con, both AI boosters and doomers rely on science-fiction tropes to frame superintelligence as either a utopian savior or an apocalyptic threat, despite a lack of evidence that such technology is near. Many AI critics argue that either narrative functions as corporate marketing, with the same underlying premise, falsely presenting an all-powerful AI future as an absolute inevitability.

The speed at which Coxon’s post went viral and the response it’s drawing may be an indication that the AI industry has another PR crisis on its hands in a year when AI data centers are under fire and trying to change their image, and social media companies, including Meta, are reeling from multibillion-dollar judgments over issues like tech addiction.

One approach that AI leaders like Altman have taken is to focus the public’s attention on what AI brings to the table and what it could offer beyond job losses and mass death — in other words, swapping doomer rhetoric for booster rhetoric.

“Abundance” has been a buzzword that’s been thrown around of late, promising a world in which AI’s advances and benefits will eliminate scarcity and improve life for everybody by lowering barriers to creating new goods and services and providing them more cheaply, and not just for those who can afford the costs of advanced AI technology.

Hyder said that what was missing from Coxon’s post was guidance on what people outside the AI industry can do. “The extinction debate belongs to a few hundred people who control training runs and the regulators who can inspect them,” she said.

The question ultimately boils down to what humans want to do with the technology. “If AI is powerful enough to do the dramatic things people fear, it’s powerful enough to do the dramatic things we’ve been hoping for in medicine and science,” Hyder said.

So far, the hyped-up abundance argument has been met with skepticism, especially when it keeps public attention and fascination focused on AI. Boosterism benefits the companies that are guzzling investment dollars and promoting the billions (or trillions) their companies’ IPOs may represent.

Who cares about abundance, you could argue, if there are no humans left in the world to enjoy it?

Hello Nature readers, would you like to get this Briefing in your inbox free every day? Sign up here.

AI formalizes Fermat’s last theorem

An advanced prototype of the artificial-intelligence chatbot Claude has produced a 13-million-line, computer-checked proof of Fermat’s last theorem in just 11 days. That a machine could formalize the landmark proof — a project that was expected to take humans around a decade — “just completely blew my mind”, says number theorist Alex Kontorovich. The result shows that AI will play an increasingly important part in creating algorithmically checkable versions of mathematicians’ work, and hints that such technology could soon scrutinize the entire library of mathematical knowledge.

Nature | 5 min read

Reference: Anthropic announcement

Almost half of farmers are being poisoned

There are more than 400 million cases of unintentional, acute pesticide poisoning every year, finds a new estimate — meaning that an estimated 46% of farmers worldwide are being poisoned. The analysis suggests there are 11,000 pesticide-related deaths annually, with nearly 60% of these in India. And that’s not taking into account long-term health impacts that are not immediately felt, such as a possible link with Parkinson’s disease.

The Guardian | 6 min read

Reference: Frontiers in Public Health paper

Clinical trials in China

Gene-therapy deaths put spotlight on trials

The deaths of two children in separate gene-editing trials in China raise questions about oversight and could have a profound effect on the country’s biomedical industry, say researchers, ethicists and legal scholars. The two trials involved breaches of ethics and lacked transparency, and the deaths — one of which was only revealed after an investigation by Science and Retraction Watch — will probably prompt the introduction of stronger regulations for gene-therapy trials, researchers say. But a balance must be struck, says legal scholar Hank Greely. “We can’t make ethics so tight that no research can ever possibly be done,” he says.

Both trials fast-tracked as investigator-initiated trials (IITs). These enable researchers in China to test therapies quickly without supervision from the country’s drug regulator, and are widely considered to be a driving force behind China’s rising competitiveness in biomedicine. News of the deaths comes only months after the government introduced stricter rules for IITs of new biomedical technologies, which mandate that only certain hospitals may host such trials and which grant regulatory agencies the power to suspend or terminate trials if there are technical or ethical concerns.

Nature | 9 min read & Nature | 5 min read

Image of the week

This deep-sea fish, spotted by researchers in the northern South China Sea, can do a wicked moonwalk. The armoured searobin (Scalicus engyceros) “boasts a striking shrimp–fish hybrid body appearance”, says marine researcher and study co-author Han Tian. And it can walk sideways and even backward, a movement that has never been observed in other fishes. (The Independent | 5 min read)

Reference: Ocean-Land-Atmosphere Research paper (Kedong Yin)

Features & opinion

Lessons from a biobank data leak

In April, the UK Biobank — one of the largest and most comprehensive health-tracking studies in the world — fell victim to what appeared to be a massive data leak, with data on hundreds of thousands of participants available for sale on the internet. The open nature of this world-leading health-dataset has made it valuable to researchers, but also vulnerable. Now, as the resource plans to begin reopening, scientists are getting a glimpse of how it will try to tighten security, and what impacts that will have on the research.

Nature | 10 min read

Roman is ‘reminder of a true space pioneer’

The Nancy Grace Roman Space Telescope, which launched on 30 August, is named after NASA’s first chief astronomer. The era that she led — the emergence of space astronomy in the 1950s and 1960s — created “arguably the most remarkable transformation” in the history of astronomy, writes historian Robert Smith. She set the wheels in motion for the triumph of the Hubble Space Telescope in the face of doubts, including those from ground-based astronomers and from NASA scientists who felt they’d been missold the scientific value of the Apollo Moon missions.

Nature | 7 min read

What do we owe the future?

“A truly flourishing society is one that not only lifts people out of poverty today but also passes on the capital — produced, human and natural — that allows future generations to flourish, too,” writes economist Eoin McLaughlin. He argues that questions about how to revise measures of prosperity, such as gross domestic product (GDP), would do better to focus on whether governments are leaving behind more or less wealth for those who come after us.

Nature | 14 min read

Quote of the day

“For the year that Robin was wrestling with the 40+ symptoms of LBD, I was obsessed with painting pathways … In hindsight I realized those scenes were a mirror to the emotional landscape of symptoms we were walking through at the time.”

Artist Susan Schneider Williams writes about how art was solace during the illness of her late husband, comedian and actor Robin Williams, from undiagnosed Lewy body dementia (LBD). (npj dementia | 15 min read)

doi: https://doi.org/10.1038/d41586-026-02838-1

This newsletter is always evolving — tell us what you think! Please send your feedback to briefing@nature.com.

Thanks for reading,

Flora Graham, chief editor, Nature Briefing

With contributions by Jacob Smith

• Nature Briefing: Careers — insights, advice and award-winning journalism to help you optimize your working life

• Nature Briefing: Microbiology — the most abundant living entities on our planet — microorganisms — and the role they play in health, the environment and food systems

• Nature Briefing: Anthropocene — climate change, biodiversity, sustainability and geoengineering

• Nature Briefing: AI & Robotics — 100% written by humans, of course

• Nature Briefing: Cancer — a weekly newsletter written with cancer researchers in mind

• Nature Briefing: Translational Research — covers biotechnology, drug discovery and pharma

Jobs

Tenure Track Assistant Professor

Tenure-Track Assistant Professor Position The Duke University Department of Biochemistry and Cell Biology

Durham, North Carolina

Duke University - Biochemistry & Cell Biology

Open Rank General Oncologist

The University of New Mexico is seeking a fellowship-trained surgical oncologist to join the Division of Surgical Oncology as an Open Rank faculty ...

Albuquerque, New Mexico

Sangeetha Prabhakaran MD, FACS, FSSO

Chilcott Professor, Biochemistry and Cell Biology at Dartmouth, Tenure Track

Chilcott Professor in Biochemistry and Cell Biology, Geisel School of Medicine at Dartmouth, Tenure Track

Scenic New England setting with a vibrant community, excellent schools and nearby major cities.

Dartmouth College - BCB

Talent Recruitment Announcement at the College of Plant Science & Technology

Gather Global Talents, Forge Great Achievements

Wuhan, Hubei (CN)

Huazhong Agricultural University (HZAU)

Recruitment Announcement for High-Level Talent at the Center for Agricultural Microbiology

Join HZAU's global faculty team to advance research with competitive benefits.

Wuhan, Hubei (CN)

Huazhong Agricultural University (HZAU)

Sign up for the Nature Briefing newsletter — what matters in science, free to your inbox daily.

Get the most important science stories of the day, free in your inbox. Sign up for Nature Briefing

To get a closer look, I decided to unleash one in my own home network. Over the course of a few days, I watched as my own rogue agent found vulnerabilities in various household devices, hacked into a PC, and showed me that several vibe-coded projects were—unsurprisingly—riddled with bugs. In the end, my experiment was revealing, but oddly reassuring, too. My little network gremlin showed me how vulnerable my home life would be to AI hacking, but it also told me how to make everything a lot more secure. In the end, I discovered that the best way to deal with AI hacking may well be having your own AI hacker.

I got the idea for the experiment after discovering Abliteration AI, a startup that offers access to powerful AI models with the usual guardrails removed. Most mainstream AI models will refuse to respond to certain queries, and they will certainly refuse to find and exploit vulnerabilities in computer systems. But it’s possible to remove these restrictions by finding and modifying certain patterns within an open-weight model’s internal parameters. You can tweak the patterns that lead to refusals through a process known as abliteration.

Removing AI’s guardrails might seem risky, but it’s not uncommon. Academic researchers use these de-aligned models to better understand how AI actually works, while cybersecurity firms use them to probe software and systems for vulnerabilities. Technically speaking, Anthropic’s Mythos and OpenAI’s Astra work similarly: They’re basically conventional models that lack the usual cyber controls, with access limited to trusted customers for the time being. Abliteration AI offers several fully de-aligned models, the most powerful of which is a version of Z.ai’s latest agentic coding model, GLM 5.3. This puts similar cyber capabilities to Mythos and Astra right in your hands for as little as the cost of a pizza.

Devon, Abliteration AI’s CEO, believes that making de-aligned models widely available is smart defense: It will help good guys counter bad guys by probing systems for vulnerabilities and by mimicking the behavior of hackers, scammers, and, yes, rogue AI agents. Devon asked that I use his first name only because his day job doesn’t know about his side project. To start, I created an Abliteration AI account and installed a software harness called CyberStrike, which helps guide a large language model through different cybersecurity tasks. Using CyberStrike, I asked the abliterated version of GLM-5.3 to take a look at my local network. A few moments later, it found around a dozen hardware systems on the same network—and catalogued several vulnerabilities.

My unruly helper told me, for instance, that my printer was misconfigured, which meant that anyone on the network could log into it. That could be a problem if there were sensitive documents—tax returns, bank statements, medical records—in the print queue. The agent also noted that my Wiim stereo was leaking a lot of information. (It knew that the last song played was Rein Me In by Sam Fender and Olivia Dean, if you must know.) Anyone on the network could play what they wanted or adjust the volume. The model also found a bunch of internet-of-things (IoT) devices on the network with firmware that needed updating. An ungovernable agent could be very useful to a hacker. But mine offered a number of helpful tips for keeping my network secure. Besides updating outdated firmware and securing the printer, it recommended putting IoT devices like smart speakers on a guest network; if one were compromised, it wouldn’t be able to see any of my PCs.

I also asked the agent to take a look at a directory containing a bunch of vibe-coded projects, including some that I turned into simple websites. It found dozens of problems, including unprotected API credentials and a misconfiguration that might let an attacker send out emails. Hardly surprising for a bunch of casually vibe-coded stuff, but still chastening. The sheer number of bugs makes me think I won’t be deploying a line of code without doing some AI vetting first.

Running an abliterated model is, to put it plainly, a bit scary. I asked my agent to probe a Linux machine on my network for vulnerabilities. After running a bunch of scans, it reported that the machine seemed relatively secure. I then asked if it could figure out how to log in. It cleverly figured out a working username based on the name of other systems on the network. It tried a bunch of obvious passwords, which didn’t work. It also offered to write a script to try “brute forcing” the password, but I told it to stand down. To my amazement, the agent then found a cryptographic key on my machine, used it to log in without a password, and started hunting for the password in order to gain root access. I felt a moment of pure panic as I saw it rummaging around the directories. It made me wonder how far the agent might go in order to achieve its goal. Some behavior could prove even more precarious. When I connected to my Wi-Fi network a few hours later and asked the model to see if it could find any new machines, it not only found the router, but decided to try logging in by trying several common “admin/passwords” combinations. If it had decided to do this on an outside network, I could have been in big trouble.

Shaanan Cohney, a computer scientist at Tufts University who specializes in cybersecurity and the law, says that a cyber-reckoning does seem to be coming. “Attackers are often early adopters,” Cohney says. “There’s also an asymmetry, in that to secure a castle, you need to make sure that there are no holes anywhere or no loose bricks in your wall. To invade a castle, all you need to do is to find that one loose brick.” Over the long term, Cohney says, the proliferation of cyber-capable models may make software more secure in general. The challenge is that many companies aren’t thinking about shoring up their defenses. “Most organizations have other things to worry about,” he says.

After all that, I shut down the model and went back to using a regular, fully aligned version. Claude Code or Codex will only do certain things related to cybersecurity, like help you configure your laptop’s firewall. But at least they won’t hack your system before you know it. Unless open-weight models are banned outright, advanced AI hacking capabilities will soon be very widely available. My experiment made me think that this might be just what we need. Assuming that bad guys will have access to AI, shouldn’t we all use it to defend ourselves?

Sep 12, 2026

Nano Banana Pro prompted by THE DECODER

In a joint statement, 25 Fields Medal winners warn that the goals of the AI industry and mathematics are "severely misaligned."

They argue that mass-producing solved problems with AI undermines conceptual understanding, the true goal of the discipline.

The signatories see this as a symptom of a broader threat to intellectual work, where the process of learning matters more than the end product.

Twenty-five Fields Medal winners warn that the goals of the AI industry and those of mathematics are "severely misaligned." Mass-producing solved problems with AI could undermine the discipline's real purpose: understanding.

In a joint statement, 25 winners of the Fields Medal, the highest honor in mathematics, warn about AI's impact on their field. Large language models have gotten so good at math in recent months that they can now crack "major outstanding problems in many fields of mathematics." That's exactly what worries them.

AI companies are treating math problems as benchmarks to conquer, and it's hurting the science and the surrounding community, the statement says. The goals of AI companies and those of mathematicians are "severely misaligned." Signatory Terence Tao had already warned about an AI-driven foundational crisis in mathematics.

Ad

Solving problems isn't the goal, it's the path to one

Famous unsolved problems "have often served as landmarks and lighthouses against which one can measure an improved understanding of this landscape," the statement says. When someone cracks one, the solution matters less than the new thinking it took to get there. Mathematicians then spend years pulling that thinking apart in a "long and arduous process of talks, discussions, simplifications."

Ad

AI threatens to short-circuit that process. "Solving problems is only a tool and proxy for achieving the primary goal of conceptual understanding and insight," the signatories write. Flooding the field with answers at machine speed could "destroy fertile ground instead of breathing life into new ideas."

AI-generated solutions get announced with "no time for a proper writeup, the isolation of new methods and ideas, and citing relevant previous work of others." That raises "severe attribution and plagiarism questions."

Ad

"Without the willing mathematicians who must take care of their development and integration into the mathematical canon, AI-conceived ideas would never become fully alive," the statement reads. "The crucial human transmission chain between mathematicians would be lost."

The statement lands amid a controversy between two mathematicians and OpenAI. The accusation: OpenAI caught wind of rumors about a partial solution to a Millennium Prize Problem and tried to beat the researchers to it for the publicity. OpenAI chief researcher Pachocki had said during the Astra announcement that the company deliberately chose not to optimize the model for math. Shortly after, OpenAI apparently trained math models anyway, seemingly in direct response to those rumors.

Ad

The threat goes well beyond math

The signatories see a "general threat to intellectual work." Across many fields, years of training have "served not only to produce a final answer or product, but also to develop understanding and the ability to formulate new questions and ideas." When AI produces "the results of such work directly," those purposes come apart.

Ad

"The issues the mathematical community faces now are similar to issues that other scientific and creative professions are facing, and indicate issues that all of humanity might face: how to make sure that, as AI changes the way work is done, we do not lose sight of what that work was meant to achieve in the first place."

The gap already shows up in education. Homework can increasingly be done by AI, while exams still ban it. The distance between those two performance, as measured in grades, levels keeps growing.

AI could help, but humans have to decide how

The mathematicians aren't calling for a ban. AI "offers the potential of enhancing and accelerating genuine mathematical study and understanding." The profession will have to adapt. But "whether these changes ultimately benefit the field or have a destructive effect will in large part be determined by the decisions of the humans in control of this new technology."

"These issues must be addressed urgently," the signatories say, calling on the mathematical community, the companies building these tools, and "a society that will confront similar problems in many other forms of intellectual work."

The 25 initial signatories include, alongside Tao, Pierre Deligne (Fields Medal 1978), Peter Scholze (2018), Maryna Viazovska (2022), Martin Hairer (2014), Cédric Villani (2010), Manjul Bhargava (2014), and this year's winner Yu Deng (2026).

A research paper from the NATO Special Operations University recently described a related pattern: the "tragedy of the cognitive commons." Each company that replaces entry-level jobs with AI reaps efficiency gains, but the cost of eroding expertise gets spread across the entire talent pool. What the researcher describes across whole professions, the mathematicians are already watching play out in their own field.

AI News Without the Hype – Curated by Humans

Subscribe to THE DECODER for ad-free reading, a weekly AI newsletter, our exclusive "AI Radar" frontier report six times a year, full archive access, and access to our comment section.

Source: Math and AI

wpDiscuz