Chrome 的 AI 漏洞流水线说明，安全团队应衡量已验证、已发布和已应用的修复，而不是只统计发现数量。
Chrome's AI vulnerability pipeline shows why security teams should measure verified, shipped, and installed fixes instead of counting discovered bugs.
Word AI 蠕虫 PoC 显示隐藏指令可进入 Copilot 生成文件。本文给出上下文隔离、来源追踪、生成后扫描和发布门禁方案。
A Word AI-worm PoC shows how hidden prompts can reach Copilot-generated files. Use context quarantine, provenance, and release gates.
Hugging Face 事件显示，持续尝试会把多个局部弱点连接成平台级入侵。长任务 AI 安全需要轨迹级控制。
The Hugging Face incident shows how persistence compounds small weaknesses. Long-horizon AI safety needs trajectory-level control.
Agent 可观测性要记录结果、动作、成本、身份和审批。思维链可以提供安全信号，但无法充当生产运行账本。
Agent observability needs evidence about outcomes, actions, cost, identity, and approvals. Chain-of-thought is a signal, not the production record.
AI Agent 分数由模型、Harness、任务、测试和环境共同生成。本文给出五层评测框架，把公开榜单转成可复现的团队选型证据。
AI agent benchmark scores mix models, harnesses, tasks, tests, and environments. Use this framework to build a reproducible coding-agent eval.
