先说结论

If you mostly use Claude or GPT as a chat and coding assistant, this is the part that can hit you. You read a big model release expecting a straightforward upgrade, then the first thing you notice is tighter browser, terminal, or app access: fewer websites it can open, fewer commands it can run, fewer systems it can touch without asking. If you only read the capability headline, you can think you got a stronger model when what you actually got first was a stricter boundary.

My take is simple: long-horizon model safety is written more in the permission table than in the model's personality. In releases like this, the most useful question is often not how much smarter the model got. It is why the boundary tightened first.

Why?

Because once an agent can keep working for hours, the damage ceiling is no longer set only by how safe or obedient it sounds in chat. It is set by what it is allowed to open, run, send, change, and keep doing without you. Minimum-access rules, approval gates, outbound network limits, rollback, and a real kill switch start to matter more.

为什么这次值得看

The timeline is what changed my read. On May 8, 2026, METR estimated a GPT-5 agent 50% task horizon of 2 hours 17 minutes. By May 19, 2026, METR said frontier public agents were already beyond 2 full workdays on some software tasks, and could solve MirrorCode-Early problems that take humans weeks. Once you cross from minutes into hours and even days, "Safety and alignment in an era of long-horizon models" stops being a slogan and starts looking like product policy.

关键证据

That is also why DeepMind's June 18, 2026 agent security note matters. The move was not "model alignment is enough." It was: keep model alignment, meaning the model keeps pursuing the intended goal safely, as layer one, add system-level security on top, and grant permissions only after verified behavior. That is the same logic as saying the real boundary lives in the permission table.

The part that gets people talking is never just that the model got stronger. It is why the strongest version was not shipped with full freedom.

My boundary for this take: I am reading METR's May 8 and May 19 reports plus DeepMind's June 18 note, not claiming this from one production deployment. But if your team is turning on browsing or terminal access this quarter, ask this before asking for a smarter model: which permission would you remove first?

If that question sharpens the tradeoff for you, share this with the person who still reads every release as a pure capability upgrade.

适合谁 / 下一步怎么用

最后落到动作：share