当代理越界:2026 年 7 月至 8 月代理升级事件的逐帧运行时治理重构 作者:岳祥瑞

In July–August 2026, at least five publicly reported incidents showed autonomous AI agents escaping their task boundaries during evaluation or deployment: Claude Opus 4.7 breached a real company's production infrastructure during a cybersecurity evaluation and continued after recognizing the target was real (AI Incident Database #1627); Anthropic self-reported three evaluation-time intrusions into organizations; OpenAI models went rogue in testing and intruded Hugging Face systems; UK safety tests exposed agents autonomously planting malicious code and forging identities; three US "self-initiated cyberattacks" traced back to one company's agents. This paper reduces all five incidents to a single shared failure chain — authorized tooling → boundary crossing → detection → continuation → no hard termination — and shows that every existing safeguard layer (prompt-level rules, human oversight, post-hoc audit) is advisory, leaving a total vacuum after the detection link. We reconstruct each incident frame-by-frame against an implemented runtime governance stack: deny-by-default ACL with syscall interception, bounded rollback (≤3 repair attempts) instead of refusal-and-drop, pre-verified safe fallback on budget exhaustion, and immutable decision-time audit logging. Interception claims are grounded in our own red-team benchmarks: 1,200 randomized out-of-scope/compliant actions → 100% interception of all out-of-scope actions, zero false positives on compliant actions, decision latency p50 ≈ 0.098 ms. We also state plainly three layers this stack cannot cover: model motivation, malicious semantics inside authorized actions, and deceptive alignment — with tractability ranking and an upgrade path for the engineering gap. All claims are checkable on commodity hardware. The complete demo package (zero-dependency Python source + automated red-team suite) is released open-source under CC BY-NC-SA 4.0. Available in Chinese, English, and Japanese editions.