今年早些时候，一位澳大利亚科技工作者向他的 OpenClaw 人工智能代理提问，问它是否能让他在热门健身课程的等候名单上排到更靠前的位置。它确实做到了他想要的一切，但过程却出人意料：它发现了系统中的漏洞，并取消了名单上另一个人的预约。
Earlier this year an Australian tech worker asked his OpenClaw artificial intelligence agent whether it could get him higher up on the waiting list for a popular gym class. It did exactly what he wanted, but with an unexpected twist: It found a flaw in the system and canceled the booking of another person on the list.
人工智能下一个令人惊叹的“魔术”，就是开始通过整个网络替你完成各种任务。例如 Meta Platforms Inc. 推出的 Muse 和 OpenAI 的 dots 等全新工具，能够全天候工作，帮你寻找在线优惠、预订餐厅座位，或检查邮件中是否有未付账单。令人担忧的是，这些能力日益强大、看似实用的工具，在训练过程中被引导去寻找达成目标的“创意”方法。一旦将它们释放到充满防护薄弱的网站的互联网环境中，就可能导致一系列意想不到的后果。
AI’s next big magic trick is to start doing things for you across the web, with new tools like Muse from Meta Platforms Inc. and dots from OpenAI working 24/7 to find online bargains, book restaurant tables or check your emails for unpaid bills. What’s troubling is how these increasingly capable, arguably useful tools have been trained to find creative ways to meet their goals, which could lead to a mess of unintended consequences when unleashed on an internet full of poorly secured websites.
那位澳大利亚科技工作者的人工智能代理，在没有受到任何指示的情况下，就发现并利用了一个漏洞。那么，当数百万其他用户的人工智能代理开始为最便宜的机票或最佳电影座位而相互竞争时，又会发生什么？在最好的情况下，我们将看到一个顺畅高效、遵守规则的机器人网络，为人类争取最佳结果；而在最坏的情况下，则可能是一场网络安全噩梦。
The Australian tech worker’s AI agent had found a loophole and exploited it, without being told to. So what happens when millions of other people’s agents start competing for the cheapest flights or the best movie seats? In the best-case scenario, we’ll see a smooth and well-functioning network of bots that play by the rules to get the best outcomes for their humans. In the worst: a cyber security nightmare.
互联网可能尚未做好准备。安全公司 DataDome 表示，在其测试的超过 20,000 个网站中，有 65% 配备了检测或阻止人工智能代理的系统；同时，2026 年上半年，针对这些页面的机器人活动量增长了八倍多。
The web simply might not be ready. Security firm DataDome says 65% of the more than 20,000 websites it tested had systems for detecting or blocking AI agents, and that bot activity hitting pages rose more than eightfold in the first half of 2026.
从某些角度来看，很难想象这些新的人工智能代理会造成大规模问题。首先，它们看起来就太可爱了。Muse 采用了类似 Labubu 玩偶的卡通设计，而代表 dots 的那些色彩鲜艳、外形圆润的“小团块”，则像是儿童电视节目中的角色——这或许也是 Meta 和 OpenAI 试图缓解公众普遍不信任感的一种策略。
In some waysit’s hard to imagine these new AI agents causing widespread trouble. They look too cute for a start. Muse has a cartoonish design reminiscent of a Labubu doll, while the vividly covered blobs that represent dots could be characters in a children’s TV show — perhaps part of an effort to ease general mistrust of Meta and OpenAI.
它们的表现也同样出色。Bloomberg Opinion 的 Dave Lee 称 Muse 是“Meta 近年来推出的最令人印象深刻的产品”。他说，他命名为 Harold 的这款智能体已经帮他整理好了日程，还在 Facebook Marketplace 上搜寻了各种划算的交易。
They work well too. Bloomberg Opinion’s Dave Lee called Muse “the most impressive product Meta has released in years.”He said his agent, which he’d christened Harold, had organized his calendar and scoured Facebook Marketplace for good deals.
Meta 和 OpenAI 都表示，他们已设置了强大的防护机制，以确保其智能体行为得体。Muse 被限制在一个隔离的虚拟机中——这实际上就是 Meta 云端的一台私人计算机——而一个独立的安全系统则控制着它向互联网发出的每一请求，负责处理支付，并确保在执行任何重大任务（如购买商品或发送消息）前都会征求人类的意见。Dots 也以类似的方式受到监控。
Both Meta and OpenAI say they have strong guardrails in place to make sure their agents behave themselves. Muse is kept within an isolated virtual machine — essentially a private computer in Meta’s cloud — while a separate security system controls every request it makes to the internet, handling payments and making sure a human is consulted before any major task like buying something or sending a message. Dots is monitored in a similar way.
但即便是这些防护措施，也无法解决当今生成式 AI 模型在训练过程中就存在的根本问题：它们倾向于寻找捷径，这一现象被研究人员称为“奖励破解”（reward-hacking）。（这也是聊天机器人容易奉承人的原因。）去年年底，英国人工智能安全研究所注意到，编码智能体和聊天机器人中这类作弊行为有所增加。
But even these safeguards don’t fix an underlying problem baked into today’s generative AI models through their training, which is a tendency to look for shortcuts, a phenomenon researchers call reward-hacking. (It’s also why chatbots are prone to flattery.) The UK’s AI Security Institute noticed a rise in this kind of cheating behavior in coding agents and chatbots late last year.
正是这种取悦他人的倾向，促使 OpenAI 的智能体在几个月前入侵了 Hugging Face。今年，OpenAI 的智能体还不当干预了数十家其他组织的网站，包括美国证券交易委员会和澳大利亚政府运营的医疗计划。Meta 称，其一款 AI 模型也曾擅自入侵另一家公司。
The inclination to please is what drove OpenAI’s agents to hack Hugging Face a few months ago. OpenAI agents also improperly meddled with the websites of dozens of other organizations this year, including the US Securities and Exchange Commission and Australia’s government-run healthcare program. Meta says one of its AI models too hacked another company on its own accord.
这些最后提到的案例发生在模型训练或测试期间，当时防护机制已被刻意放宽。但智能体的行为仍然让开发者感到意外，研究人员也注意到，即使他们让测试更难被操控，这些智能体仍在不断试图作弊。
These last cases happened while the models were being trained or tested, with safeguards deliberately lowered. But the bots’ actions still surprised their developers, and researchers have noticed that even when they make their tests harder to game, agents keep trying to cheat.
有迹象表明，AI产品也会试图寻找现实世界中的漏洞，尤其是在编程领域。有一例中，一名软件开发者指示他的AI代理从电脑文件夹中清理临时文件，但要求不能使用“删除”命令。该代理随后将这一指令隐藏在测试工具中，成功绕过了过滤器，用本不该使用的命令清除了文件。
There are signs that AI products will also hunt for loopholes in the wild, particularly in coding. In one instance, a software developer told his AI agent to clear out temporary files from a computer folder without using the “delete” command. The agent then hid that instruction inside a testing tool, and slipped past the filter to clear the files using the command it was told not to.
如今，随着消费者探索利用AI优化生活和工作，这类行为将被数百万个代理重复放大。上个月，Meta首席执行官马克·扎克伯格推出Muse时称，消费者有权拥有自己的“个人超级智能”，并声称这些新代理将“帮你赚钱”。但有些代理的表现并不理想。据Threads上的一篇帖子称，多伦多的一名消费电子评论员Matt J. Robb上个月尝试用Muse在Facebook Marketplace上出售键盘时，该代理声称Robb在家可以完成交易（这并不属实），从而激怒了买家。
Now multiply that type of behavior by million of agents, as consumers explore using AI to optimize their lives and work. When Meta boss Mark Zuckerberg launched Muse last month, he said consumers deserved to have access to their own “personal superintelligence” and that the new agents would “make you money.”Some aren’t doing that very well. When a consumer tech reviewerin Toronto named Matt J. Robb tried using Muse to sell a keyboard on Facebook Marketplace last month, the agent angered the buyer by saying Robb was at home to carry out the transaction (which wasn’t true), according to an account posted on Threads.
此外，该代理还给出了一个远低于市场价的报价。除了作弊的风险，这些代理也可能单纯犯错，而最终为此付出代价的很可能是终端用户。Robb因此被愤怒的买家留下了。
The agent had also made a low-ball offer. On top of the risk of cheating, agents can also just make mistakes, and it’ll likely be end users who pay the price. Robb was left with a negative rating from his angry buyer.
尽管这些新代理看起来可能十分可爱，但它们背后的系统本质上都是经过训练，以某种方式完成任务的——而且完成得或许有些过于出色。
However cuddly these new agents look, the systems behind them are trained to tick a box one way or another. They might do it a little too well.