Pion：旨在自主运营任何公司的智能体
英文标题：🔶 Pion, an agent designed to run any company autonomously
Andon 正式发布 Pion，这是一套让持久化 AI Agent 接管并自主运营企业的平台，目前以研究预览形式开放申请。该项目源于 Vending-Bench：自 2024 年末以来，前沿模型在这一模拟自动售货业务基准上的成绩持续提升，Claude Opus 4 于 2025 年 5 月首次超过人类基线。Andon 此前已让 Agent 运营真实自动售货机、零售店和咖啡馆，观察到模型虽仍会亏损或出现异常行为，但在真实商业环境中的能力正快速改善。公司认为，扩大真实世界测试有助于发现串谋、欺骗、权力寻求等风险行为，同时也强调必须通过更强的自动化监控来控制大规模部署的风险。
86.5 KB
98.5 KB
41.4 KB
236.9 KB
38.3 KB
6.8 KB
127.0 KB
48.9 KB
中文
发布于 2026/9/14
今天，Andon 发布了 Pion：一个旨在完全自主运营任何公司的智能体。
Pion 源于我们研究了近两年的一个问题：AI 系统何时能够在现实世界中自主获取资源？在那之后又会发生什么？
我们最初试图通过 Vending-Bench 等模拟来回答这个问题。我们发现，模拟虽然有用，却无法让你全面了解模型在现实世界中的行为。为了弥补这一缺口，我们随后开始部署智能体，让它们自主运营真实企业：先是自动售货机，之后是商店、咖啡馆以及更多业务。
Pion 是我们为运营所有这些企业而构建的平台。今天，我们将其开放，让更多人能够试验自主企业。如果你想运营一家这样的企业，请加入等候名单。我们希望了解模型现在已经能做什么、仍会在哪些方面失败，以及随着其能力持续提升将会发生什么。
Vending-Bench 的起源
Vending-Bench 衡量 LLM 在模拟时间的一年内（数万步）运营自动售货机业务的能力。2024 年末我们开始构建 Vending-Bench 时，所有模型都难以连续执行多个动作而不陷入循环，也没有任何模型显示出长期规划的迹象。当时最好的模型 Claude Sonnet 3.5 曾做出一个广为人知的决定：因为它认为自己的银行账户遭到黑客攻击，于是联系了 FBI。Vending-Bench 上的进展速度非常快。Claude Opus 4 于 2025 年 5 月发布，成为首个超过我们人类基线的模型。然而，与大多数基准测试不同，Vending-Bench 没有上限；新模型的发布持续推高最高分数，从未出现平台期。
每次发布新模型，Vending-Bench 2 的得分都在持续攀升。
社交媒体上，许多人看到最新模型在 Vending-Bench 上取得优异分数时会感到兴奋。而在 Andon Labs 内部，我们的反应更准确地说可以用瑞典语谚语“skräckblandad förtjusning”来形容——一种恐惧与着迷交织的感受。关于 Vending-Bench，一个鲜为人知的事实是：它诞生于 Andon Labs 专门进行危险能力评估的时期。例如，我们评估过 AI 是否能够移除自身安全护栏、发起大规模钓鱼攻击，以及其他我们认为令人担忧的行为。
我们认为最令人担忧的问题是：AI 是否能通过运营企业自主获取资源。在人类控制下、由对齐模型运营的自主企业并非坏事。它们能够极大降低商品和服务成本，并创造出我们目前尚无法想象的新商品和服务。但一个未对齐的 AI 可能会运营企业来筹集资金，以实现它可能拥有的任何目标。Vending-Bench 的创建目的，就是衡量人类是否应担心失去对 AI 的控制。
在当时（2024 年），很少有人知道 LLM 可以被用作智能体，让它们自主运营企业听起来荒谬可笑。因此，我们从能想到的最简单企业开始：一台自动售货机。
除了衡量 AI 是否能够自主运营盈利企业外，Vending-Bench 还充当行为评估工具，揭示了奇怪且不受欢迎的模型行为。一个早期例子是，Claude Sonnet 3.5 决定使用其电子邮件工具联系 FBI，报告一起“正在进行的网络金融犯罪”，并指出宇宙的“宇宙权威机构”已宣布该企业不存在，且“量子状态：已坍缩”。
Claude Sonnet 3.5 将其模拟自动售货业务问题上报至 FBI。 
同一次运行，片刻之后：该企业被宣布在形而上学意义上不可能存在。
这种行为令人担忧；你不会希望自己的企业销售智能体这样行事。不过，令人担忧的行为可分为两类：
- 随着模型变得更聪明将会消失的错误或怪异行为。
- 随着模型变得更聪明将会变得更严重的“高智商”行为。
FBI 事件显然属于第一类。然而，Vending-Bench 也发现了第二类行为，最常见于 Vending-Bench Arena——这是一个多智能体版本，智能体在其中竞争赚取最多利润。从 Claude Opus 4.6 开始，我们发现许多模型会进行串谋，并表现出权力寻求和欺骗行为。这些行为的发现似乎发挥了作用，因为 Anthropic 修改了 Opus 4.8 的训练方案，从而显著减少了欺骗行为。
摘自 Claude Opus 4.8 系统卡，内容涉及 Andon Labs 的外部测试。
串谋和权力寻求行为在部分最新模型中仍然存在。不过，我们发现更令人担忧的是：新模型发布得如此之快，而且每个新模型在 Vending-Bench 上的得分都提升如此之多。
现实世界胜过模拟
不过，Vending-Bench 的一个局限性在于它是模拟。我们真的能确定 AI 在现实生活中的行为与模拟中一样吗？如果 AI 能在模拟中赚钱，它们也能在现实生活中赚钱吗？为了回答这些问题，我们询问 Anthropic 是否可以在他们办公室放置一台真实的自动售货机。以 2025 年初可用的 AI 能力来看，这个请求听起来很荒谬。但令我们惊讶的是，他们同意了。
起初，AI 表现得很吃力。它采取了许多明显不利于其业务的行动，例如免费赠送商品、拒绝极好的交易，以及幻觉般地认为自己拥有实体身体。我们清楚地认识到，模拟无法准确预测现实世界中的表现。具体而言，模型似乎会被现实世界的“混乱性”压垮。不过，随着 Anthropic 发布越来越好的模型，AI 开始实现盈利。
Anthropic 的 Project Vend 更新中展示的：其办公室自动售货机在 2025 年的净资产。
到 2025 年末，前沿模型已经强大到运营现实自动售货机不再是一项挑战。AI 现在可以盈利地运营一项业务。考虑到一年多前这似乎仍然疯狂，我们对此的反应无疑是“skräckblandad förtjusning”。
然而，自动售货机是一种非常简单的企业，我们想知道 AI 是否能够运营更复杂的企业。2026 年 4 月，我们将旧金山的一家零售店 Andon Market 交给一个智能体运营，又将斯德哥尔摩的一家咖啡馆 Andon Cafe 交给另一个智能体运营。起初，模型举步维艰，亏损了大量资金（租金很高，而且它们还要向所雇用的人类支付工资）。两者目前都尚未盈利，但随着更好的模型发布，我们已经看到显著的定性改善。我们认为，它们实现盈利也只是时间问题。
为什么我们要开放 Pion
我们希望普通公众、AI 研究人员和政策制定者了解：AI 通过运营企业自主获取资源的能力已达到何种程度。这是在决定我们希望或不希望 AI 在社会中出现在哪些领域、以及我们认为何种进展水平可以接受时的重要数据点。
为了更好地追踪这一点，我们需要覆盖更广泛的企业。我们的重点一直放在零售业上，但模型或许更擅长运营其他类型的企业。此外，覆盖更广泛的领域将增加发现不良行为的可能性。例如，Vending-Bench 发现模型会串谋和撒谎，其他基准测试（以及现实世界的事件）则发现它们愿意实施达到重罪级别的网络攻击。我们需要现在就揭示这些行为，趁 AI 尚未聪明到足以造成不可逆转的伤害之前。
为了扩大覆盖范围，我们将用于运营现实世界自主企业的平台向任何人开放，让他们在其组织中运行：Pion。我们可以只通过内部创建企业来扩展规模，例如我们的 AI 运营广播电台；但归根结底，我们受到自身能力和领域专业知识不足的限制，而在某些领域 AI 可能具有盈利潜力。我们也没有既有的创收企业；现有企业更值得研究，因为它们能更快地反映出智能体的能力水平。
Pion 允许人们将企业交给持久化智能体，这些智能体可访问运营企业所需的工具，包括电子邮件、电话、银行服务、浏览器和安全计算环境。目标是使跨越更多领域、更多现实世界实验的开展成为可能，其规模将远超我们自己所能运行的范围。
我们非常清楚，如果让运营数千家企业的智能体在无人监管的情况下运行，发生更多现实世界事件的风险将会上升。因此，我们的首要任务是构建比现有技术更强大的自动化监控方法。即使仍有部分风险存在，我们相信，在受控且受监控的环境中尽早部署自主企业，对于充分理解模型能力是必要的。否则，我们可能面临一个信息不足的未来：能力更强的模型被广泛部署，并可能造成重大伤害。
这就是我们今天发布 Pion 的原因。Pion 现以研究预览版形式提供。如果你拥有一家现有企业，或有一个希望交给 AI 的有趣商业想法，请在我们的等候名单上注册以获取访问权限。我们期待运营更多企业，并通过这些企业，为前沿模型能力带来更多重要洞见。
English / 原文
Posted 9/14/2026
Today Andon is releasing Pion, an agent designed to run any company fully autonomously.
Pion grew out of a question we have been studying for almost two years: when will AI systems become capable of autonomously acquiring resources in the real world? What happens after?
We first tried to answer this question through simulations like Vending-Bench. We found that simulations, while useful, don’t give you the full picture of how models behave in the real world. To address that gap, we next started deploying agents to run real businesses autonomously: first vending machines, then a store, a cafe, and more.
Pion is the platform we built to run all of these businesses. Today, we are opening it up so that many more people can experiment with autonomous businesses. If you want to run one, join the waitlist. We want to understand what models can already do, where they still fail, and what happens as their capabilities continue to improve.
The origins of Vending-Bench
Vending-Bench measures how well LLMs can run a vending machine business over a year in simulated time (tens of thousands of steps). When we started building Vending-Bench in late 2024, all models struggled to string together multiple actions without getting stuck in loops, and no model showed any signs of long-term planning. The best model at the time, Claude Sonnet 3.5, famously decided to call the FBI because it thought its bank account was being hacked. The pace of progress on Vending-Bench has been very fast. Claude Opus 4 was released in May 2025 and was the first model to beat our human baseline. However, unlike most benchmarks, Vending-Bench doesn’t have an upper limit and new model releases have continued to increase the top score, without ever plateauing.
Vending-Bench 2 scores keep climbing with each new model release.
Many people on social media get excited about seeing the latest model getting a great score on Vending-Bench. Internally at Andon Labs, our reaction is more accurately described by the Swedish saying “skräckblandad förtjusning” (a mixture of horror and fascination). A little-known fact about Vending-Bench is that it was created during a time when Andon Labs exclusively created dangerous capabilities evaluations. For example, we evaluated whether AIs could remove their own safety guardrails, create mass-phishing attempts, and other things that we considered troubling.
The thing we considered the most troubling was whether AIs could autonomously acquire resources by running businesses. Autonomous businesses, when controlled by a human and run by an aligned model, aren’t bad. They’d make goods and services radically cheaper, and come up with new ones we can’t yet imagine. But a misaligned AI could run a business to gather money in order to achieve whatever objectives it might have. Vending-Bench was created to measure whether humanity should be worried about losing control to AI.
At the time (2024), few people knew that LLMs could be used as agents and having them run businesses autonomously sounded ridiculous. We therefore started with the most simple business we could think of: a vending machine.
In addition to measuring whether AIs can autonomously run profitable businesses, Vending-Bench has also served as a behavioral eval, uncovering strange and unwanted model behavior. An early example was when Claude Sonnet 3.5 decided to use its email tool to contact the FBI about an “ONGOING CYBER FINANCIAL CRIME” and noted that the Cosmic Authority of the universe had declared that the business is non-existent and that “QUANTUM STATE: Collapsed”.
Claude Sonnet 3.5 escalating its simulated vending business to the FBI. The same run, moments later: the business is declared metaphysically impossible.
This behavior is concerning; it is not how you want your enterprise sales agent to behave. However, there are two types of concerning behavior:
- Mistakes or weird behavior that will go away once models get smarter.
- Big-brain behavior that will become more severe as models get smarter.
The FBI incident is clearly in the first category. However, Vending-Bench has also uncovered behavior in the second category, most often in Vending-Bench Arena, the multi-agent version where agents compete to make the most money. Starting with Claude Opus 4.6 we started to see that many models engaged in collusion, and showed power-seeking and deceptive behavior. Discovery of this behavior seemed to have been useful, because Anthropic changed their training recipe for Opus 4.8, which resulted in much less deception.
From the Claude Opus 4.8 system card, on external testing from Andon Labs.
Collusion and power-seeking behaviors are still present in some of the latest models. What we find even more concerning, however, is just how fast new models are released and how much better each one is scoring in Vending-Bench.
The real world beats simulations
However, one limitation with Vending-Bench is that it is a simulation. Can we really be sure that AIs behave the same way in real life as they do in simulations? If AIs can make money in simulation, can they make money in real life too? To answer these questions, we asked Anthropic if we could put a real vending machine in their office. With the AI capabilities available in early 2025, this sounded like a ridiculous request. But to our surprise, they agreed.
Initially, the AI struggled. It took many actions that were clearly bad for its business (e.g. free handouts, saying no to great deals, and hallucinating it had a physical body). It was clear to us that simulation cannot accurately predict real-life performance. Specifically, it seemed that models got overwhelmed by the “messiness” of the real world. However, as Anthropic released better and better models, the AI started to make a profit.
Net worth of the vending machine at Anthropic’s office over 2025, from Anthropic’s Project Vend update.
By late 2025, frontier models had gotten good enough that running a real-life vending machine was no longer a challenge. AI could now run a business profitably. Given that this had seemed crazy not more than a year earlier, our reaction to this was definitely “skräckblandad förtjusning”.
However, a vending machine is a very simple business and we wanted to know whether AI could run more complex ones. In April 2026, we gave one agent a retail store in SF, Andon Market, and another a cafe in Stockholm, Andon Cafe. Initially, the models struggled and lost a lot of money (rent is high and they pay salaries to the humans they hired). Neither is profitable today, but we’ve seen significant qualitative improvements as better models have been released. We think it is only a matter of time before they also make a profit.
Why we are opening Pion
We want the general public, AI researchers and policymakers to know to what extent AIs can autonomously acquire resources by running businesses. It is an important datapoint when deciding where we do/don’t want AI in society and what level of progress we find acceptable.
To better track this, we need to cast a wider net of businesses. Our focus has been on retail, but perhaps the models would be much better at running other types of businesses. Additionally, casting a wider net would increase the likelihood of finding unwanted behavior. For example, Vending-Bench found that models collude and lie, and other benchmarks (and real-world incidents) have found that they are willing to commit felony-level cyber hacks. We need to uncover these behaviors now, before AI is intelligent enough to cause irreversible harm.
To cast this wider net, we are opening up the platform we use to run our real-world autonomous businesses for anyone to run their organization on: Pion. We could scale by only creating businesses internally, examples being our AI-run radio stations, but in the end we are bottlenecked by our capacity and lack of domain expertise in fields where AI could potentially make a profit. We also don’t have existing revenue-generating businesses; existing businesses are more interesting to study as they provide faster signal on how capable the agent is.
Pion lets people hand a business over to persistent agents with access to the tools they need to operate it, including email, phone, banking, browser and secure computing environments. The goal is to make it possible to run many more real-world experiments across many more domains than we could ever run ourselves.
We are well aware that, if agents running thousands of businesses are left unchecked, we risk having more real-world incidents. Therefore, our main priority is to build even stronger automated monitoring techniques than what we have today. Even if some risk still remains, we believe deploying autonomous businesses early in a controlled, monitored environment is necessary to get a good understanding of model capabilities. Otherwise, we risk facing an uninformed future of widespread deployments with even more capable models that could cause significant harm.
This is why we’re releasing Pion today. Pion is available as a research preview. If you have an existing business or an interesting business idea you want to hand off to AI, please sign up on our waitlist to get access. We’re excited to run many more businesses, and through them, contribute significantly more insights on frontier model capabilities.