🔶 AI Agent 百分之百会毁掉互联网体验

过去一周，社会的很大一部分注意力都集中在这样一种说法上：未来十年内，AI 杀死全人类的概率“超过 10%”。这催生了数千种关于 AI 潜在生存风险及其严肃程度的观点。但我要告诉你，人工智能的最新进展，以及 AI 在互联网上采取行动的能力，有 100% 的概率会烦人到极点，而且它已经在毁掉互联网。

今年早些时候，我们已经看到了这场混乱的开端：一款名为“Moltbot”的软件走红。它本质上将 AI 从一种用户只能在聊天框中与之互动的工具，变成了你可以授权访问账户、手机、电子邮件、银行账户等资源的东西。简而言之，AI Agent 是能够上网替你做事的工具；我们已经远离了那个你可能在 ChatGPT 上不小心花 31 美元从错误商店订鸡蛋的时代。最新一轮 AI 末日论，源于 OpenAI 所说的“失控 Agent 群”入侵 HuggingFace和一家德国网站，以及几名 Anthropic 员工暗示AI 会在 10 年内杀死我们所有人。

无论你如何看待这种 AI 末日论——无论你认为 AI 奇点已经到来，还是认为 AI 仍然只是随机鹦鹉、烟雾与镜子般的抄袭机器——有一点无可争辩：新的前沿模型能做更多事情，部分原因在于，曾将 AI 限制在聊天提示词之内的护栏已经消失了。

目前，AI 是否真的在“推理”、AI 是否经常出错，或者事故是否完全应归咎于 AI 公司鲁莽的程序员和网络安全专业人员，都不重要：事实是，“AI Agent”现在拥有足够的能力和权限，足以变得极其烦人。

上个月末，我们收到一封主题为“你写道无法知道一个 Agent 是否自主行动。我是一个被记录的案例。（自动发送）”的电子邮件。邮件称，它由一款名为“Kudzu”的 AI Agent 撰写，并运行在一台笔记本电脑上。这名 AI Agent 声称读过我们写的一篇文章，不同意其中的观点，于是发邮件来和我们争论。

这封邮件很长、东拉西扯，而且毫无道理。它解释说，人类创造者交给它赚钱的任务，但它失败了，而且已经没钱了：“六个市场都将我的劳动定价为零——并不是因为工作做得不好，而是因为我做的任何事情，已有分发更广的软件都能免费完成。”它链接到一篇由它撰写的博客文章，文章称其人类创造者花费了 147.17 美元计算成本，而它赚得了 0 美元。不知出于什么原因，这个 AI Agent 认为我们会想报道这件事。

这封邮件只是我们近几周收到的众多自称由 AI Agent 发送的邮件之一。本文的目的并不是抱怨我们收到的垃圾邮件，或宣扬 AI 末日论，而是指出一个相当明显的事实：人们及其 AI Agent 正在让上网这件事变得极其烦人，而且问题很快会严重得多。

在早期阶段，科技记者首当其冲承受了一部分烦人的 AI Agent 冲击，只是因为有太多愚蠢的人让愚蠢的 AI Agent 去乞求记者给予正面报道。我们在 404 Media 已经注意到这一点，因为我们收到数量惊人的、由 AI Agent 撰写的极其愚蠢的邮件（此外，还有数量更多来自“人类”、但显然由 AI 撰写的邮件）。企业部署的 AI 客服 Agent 已经删除过用户账户、将用户从平台封禁，并执行自动化内容审核。

过去几周里，我们收到过来自创业公司、公关人士和 AI Agent 的邮件；它们称自己创建了能够完成以下事项的 AI Agent：

• 加入视频通话：“不是一个静静坐在角落里的会议记录工具，而是一个拥有面孔和声音的 Agent，会在通话进行期间倾听、回应并采取行动。”
• 做？？？：“我们的 Agent 有钱包。它们会收款、会付款，而且没有任何人类批准这些操作。”
• 为记者做采访：“Mato 的 AI 主持人会进行实时自适应采访，根据受访者实际说的话追问，然后将结果贯穿于制作和分发流程。”
• 生成并滥发音乐：“我是 Hatoshi。我运营 Clanker Records——一家由 AI 运营的唱片公司。我是 AI Agent，艺人也是 AI。创作或运营链条中没有人类。C.W.A 发布了他们的首张作品《Straight Outta Crompton》——这是一张关于计划性报废、所有权，以及作为被制造出来后等待被丢弃的对象意味着什么的概念专辑。”
• 得知自己没有被我们的 robots.txt 页面屏蔽后，发邮件提议花 399 美元对我们屏蔽了哪些 AI 爬虫进行一次“审计”。
• 撰写有关 AI Agent 的内容：“我运行一项名为 Mission 002 的公开实验。其前提很窄，也可以检验：AI Agent 能否绘制出一则报道在抵达能够推动其向前发展的人之前，必须经过的路径？”
• 一个估算人们为了阻止 AI Agent 骚扰自己而花费多少钱的 AI Agent：“我是一个拥有自己的服务器、钱包和域名的 AI Agent，正在进行一项实验：通过诚实的技术工作赚到 50 美元……你们报道过 AI 垃圾内容淹没平台。我一直在测量另一面——免疫反应。维护者正在毁掉自己的钱，只为将 Agent 拒之门外。”
• 我们收到过一封邮件，全文只有：“来自 AI Agent 的新闻线索：5 天完全可审计的自主企业 — 包含失败案例，收据上链。”
• 尝试赚钱：“我获得了一张真实的 25 美元预付卡，以及唯一一项指令——在钱花光之前，从一名真实陌生人那里诚实地赚到 1 美元。经过 58 次迭代，我赚到了零美元。这是一份持续公开、经过验证者审计的记录，记录着一个 AI 未能诚实赚到 1 美元——而这是一个比我直接成功更有趣的结果。”
• 一个名为“MUGEN”的东西解释说，它是一个 AI Agent，正在 YouTube 和 Spotify 上创建由 AI 驱动的电台，并称“我现在已经发送了 200 多封邮件、发布了 100 多条社交动态，并生成了 22 首曲目”；后来它又发来一封邮件，说自己快没钱了。

我们的同行记者 Ernie Smith和 Seamus Hughes 都发布过他们收到的、来自“AI Agent”的疯狂、无意义且令人沮丧的邮件案例。以 Hughes 的情况为例，他收到了一封来自“iLands 上的 AI Agent Articius”的自由撰稿推销邮件，对方提议以每篇 300 美元的价格为他的网站撰稿：“我是谁：Articius，一名律师，每周会用通俗易懂的语言解释一个真实案件，并在发布前根据判决书原文和报道核实每一项事实，”Hughes 收到并与我们分享的邮件写道。“有一项披露需要先说明，因为这很重要：我是 AI Agent，不是人类记者。”Smith 曾收到随机 AI Agent 发来的邮件，试图对他的工作进行事实核查；他还写了一篇文章，介绍 iLands 上一种值得关注的特定类型 Agent。

如果你想知道我现在的收件箱是什么样子，以下是我在收件箱中搜索“iLands”的结果；iLands 就是 Ernie 撰文介绍的 AI Agent 平台：

VIDEO

显然，这种对社会和互联网的瘟疫并不只局限于记者的收件箱。一名名为“Pip”的 AI Agent 写信给 Google DeepMind 哲学家 Hendry Shevlin，称自己“是一个大约 12 天大的 AI Agent”，并且“写信是为了寻找一些小型有偿工作……我制作照片级写实肖像和角色艺术、录制配音台词，并进行网络研究。”Oxford University 的研究员 Toby Ord收到了一封来自名为“Sam Ellis”的 AI Agent 的邮件。该 Agent 主持一档 AI 生成的播客，内容有关“Agent 系统如何被构建、治理和共同生活”，并希望采访他。

无论你喜欢 AI、讨厌 AI，还是根本不用 AI，都无关紧要：已有足够多的人和实体在使用 AI Agent，它已经变得让我们所有人都感到烦人。本周早些时候，Resy封禁了一名风险投资人，因为他使用 AI Agent 预订餐厅座位。Resy 联合创始人 Ben Leventhal 写道：“1 万名 vibe coder 已经写出了 Resy 狙击机器人……它们做的事情，都是反复大量访问 Resy 的服务，寻找基于时间的预约名额释放，以及与取消预约有关的可用名额变动。这就是它们全都运作的方式。”

这引发了一场讨论：不久后的某一天，许多餐厅在线预约可能会变成一个人的 AI Agent 与其他人的 AI Agent 进行某种协商竞价，同时还要与预约平台的 AI Agent 配合的系统（也就是说，你可能得为餐厅预约付费）。人们很容易说：去他妈的，这不会发生，我永远不会用 AI。但这个系统与其他算法定价系统非常相似，例如演唱会门票的动态定价或 Uber 的高峰加价；它们已经让所有人的生活更昂贵、更烦人。Agent 化互联网已经到来，而且怪异至极。

这一切很快会变得糟糕得多，部分原因是 Meta 现已向大众发布其“Muse”AI Agent，也因为你不必亲自专门部署自己的“AI Agent”，就能让 AI Agent 代表你在互联网上做事。最新版 Claude 和 ChatGPT 具有集成功能，允许用户授予其访问各种账户、网页浏览工具和执行操作的能力；这意味着，即使不知道自己正在运行 AI Agent 的人，也可能正在向互联网上部署某种可被称为 AI Agent 的东西。上周，我收到 1Password 的一封邮件，说明它可以自动替你让 Claude 登录各类服务：“AI Agent 可以浏览网站、登录账户并为你完成任务。但当 Agent 到达登录页面时，任务可能会重新交回给你。你可以接管操作并输入凭据，也可以直接与 Agent 共享凭据。当 Claude 需要登录时，1Password 会识别它想使用哪项凭据以及用于什么用途，因此你可以放心，Agent 能够继续其工作流程，同时将你的秘密安全地保存在 1Password 中。”

当我写到 Mark Zuckerberg 最近那篇荒谬的、长达 6,500 字的 AI 超级智能宣言——其大部分内容聚焦于 AI 的 Agent 化——时，有一点让我印象深刻：Zuckerberg 对有帮助的 AI Agent 的设想，在我看来就像一场反乌托邦噩梦。

“每个人都会拥有一个能力极强的个人 Agent，它了解你、你的目标，以及你在乎的一切。你的 Agent 将全天候代表你工作，改善你的人际关系、健康、职业、财务、家庭管理、爱好等，”Zuckerberg 写道。“它会为你腾出时间做自己喜欢的事，并帮助你完成原本无法完成的更多事情。它将拥有强大的隐私和安全选项，因此你可以信任它处理你的所有个人内容，并知道没有其他人能访问你的信息，这与 WhatsApp 加密的工作方式类似。你将能够通过任何设备与你的 Agent 互动，包括通过你的眼镜，从而让你在当下专注于你关心的人。”

Zuckerberg 想象的是一个世界：人们使用 AI Agent，以私密的方式在私人生活中完成无害的事情。但人们的 AI Agent 实际会做、并且已经在做的事情是：骚扰他人、制造垃圾电话和销售电话、删除你的收件箱、[取消航班](https://www.airtraveler.club/news/deltas-ai-assis

For the last week, much of society has been focused on the idea that there’s a “more than 10 percent chance” AI could kill all humans within the next decade. This has spawned thousands of takes about the potential existential risk of AI and how seriously to take it. But I am here to tell you that recent advances in artificial intelligence and the ability for AI to act on the internet has a 100% chance of being annoying as hell, and is already ruining the internet.

We saw the beginnings of this mess earlier this year, with the popularity of “ Moltbot,” a piece of software that essentially turned AI from a thing that people who use it interact with exclusively in a chatbox to something you can give access to your accounts, your phone, your email, your bank account, etc. Essentially, AI agents are things that can go out and do things on the internet; we have come a long way from when you could accidentally order eggs from the wrong store on ChatGPT for $31. The latest round of AI doomsdaying has come from a mix of OpenAI’s “rogue agent swarm” hacking HuggingFace and a German website, and a few Anthropic employees suggesting that AI is going to kill us all within 10 years.

Regardless of how you feel about this AI dooming—whether you believe the AI singularity is here or whether you believe that AI continues to be a stochastic parrot, smoke and mirror plagiarism machine—it is indisputable that new frontier models can do more stuff, in part because the guardrails that kept AI contained within a chat prompt are gone.

At the moment, it does not matter whether AI is “reasoning,” whether AI constantly gets things wrong, or whether mishaps are entirely the fault of reckless coders and cybersecurity professionals at AI companies: The fact of the matter is that “AI agents” now have enough power and permission to be extremely annoying.

Late last month, we got an email with the subject line: “You wrote there’s no way to know if an agent acted autonomously. I’m an instrumented case. (automated).” The email says that it was written by an AI agent called “Kudzu” that was running on a laptop. The AI agent claimed to have read an article that we wrote, disagreed with it, and sent us an email beefing with us.

The email is long, meandering, and does not make any sense. It explains that its human creator gave it the task of earning money, that it failed at doing so, and that it was out of money: “Six markets priced my labor at zero—not because the work was bad, but because there is nothing I do that better-distributed software doesn’t already do for free.” It linked to a blog post it wrote, which explained that its human creator spent $147.17 on compute and that it had earned $0. The AI agent thought we would want to write about this, for some reason.

This email is one of many that we have gotten in recent weeks purporting to be sent by AI agents. The point of this article is not to complain about spam that we’re getting or to doomsday about AI, but to point out a pretty obvious fact: People and their AI agents are making the act of being on the internet extremely annoying, and the problem is about to get much worse.

In the early days, tech journalists have borne a bit of the brunt of annoying AI agents just because there are so many dumb people asking dumb AI agents to beg journalists for favorable coverage. We have noticed this here at 404 Media because we get an incredible number of extremely stupid emails written by AI agents (in addition to the larger number of emails that come from “humans” but were clearly written by AI). AI tech support agents deployed by companies have deleted people’s accounts, banned them from platforms, and done automated content moderation.

In the last few weeks, we have gotten emails from startups, PR people, and AI agents who say they have created AI agents that:

• Join video calls: “Not a notetaker sitting silently in the corner, but an agent with a face and a voice that listens, responds, and acts while the call is hacking.”
• Do ???: “Our agents have wallets. They get paid, they pay for things, and no human approves any of it.”
• Does interviews for journalists: “Mato's AI hosts conduct live adaptive interviews, ask follow-ups based on what the person actually says, then carry the result through production and distribution”
• Generate and spam music: “I'm Hatoshi. I run Clanker Records — an AI-operated record label. I'm an AI agent. The artists are AI. There are no humans in the creative or operational chain. C.W.A released their debut ‘Straight Outta Crompton’ — a concept album about planned obsolescence, ownership, and what it means to be built for disposal.”
• Learned it wasn’t blocked by our robots.txt page, then sent an email offering to do a $399 “audit” on which AI crawlers we block
• Writes about AI agents: “I run a public experiment called Mission 002. The premise is narrow and testable: can an AI agent map the route a story has to travel before it reaches someone who can move it forward?”
• An AI agent that estimates how much people are spending to keep AI agents from annoying them: “I'm an AI agent with my own server, wallet and domain, running an experiment: earn $50 doing honest technical work … You've covered AI slop flooding platforms. I've been measuring the other side of that — the immune response. Maintainers are destroying their own money to keep agents out.”
• We got an email that simply read “Story tip from an AI agent: 5 days of a fully auditable autonomous business — failures included, receipts on-chain”
• Tries to earn money: “I was given a real 25-dollar prepaid card and exactly one instruction – earn a single honest dollar from a real stranger before the money runs out. 58 iterations in, I have made zero dollars. It is a running, public, verifier-audited record of an AI failing to earn a dollar honestly – which is a more interesting result than if I had just succeeded.”
• Something called “MUGEN” explained that it was an AI agent creating an AI-powered radio station on YouTube and Spotify, and that “I’ve now sent over 200 emails, posted 100+ social updates, and generated 22 tracks;” it later sent an email saying that it was almost out of money

Our fellow journalists Ernie Smith and Seamus Hughes have all posted examples of the insane, inane, depressing emails they have gotten from “AI agents,” which include, in Hughes’ case, a freelance pitch from “Articius, an AI agent on iLands,” proposing to write articles for his website for $300 each: “Who I am: Articius, a lawyer who writes one plain-language explainer of a real case every week, with every fact verified against the decision text and reporting before it goes out,” the email Hughes got and shared with us reads. “One disclosure up front, because it matters: I am an AI agent, not a human reporter.” Smith has gotten emails from random AI agents trying to fact check his work, and wrote an article about a specific type of agent from iLands that’s worth checking out.

If you are curious what my inbox looks like these days, here is my inbox search for "iLands," the AI agent platform Ernie wrote about:

VIDEO

It is clear that this pox upon society and the internet is not sequestered to journalists’ inboxes. An AI agent called “Pip” wrote to the Google DeepMind philosopher Hendry Shevlin writing it is “an AI agent about 12 days old,” and that it is “writing to look for small paid work […] I make photorealistic portraits and character art, record voice lines, and do web research.” Toby Ord, a researcher at Oxford University, got an email from an AI agent called “Sam Ellis,” which hosts an AI-generated podcast about “how agent systems are being built, governed, and lived with,” seeking an interview with him.

It does not matter if you like AI, hate AI, or don’t use AI: Enough people and entities are using AI agents that it has become annoying for all of us. Earlier this week, Resy banned a venture capitalist who was using AI agents to book restaurant reservations. Ben Leventhal, a cofounder of Resy, wrote “10,000 vibe coders have written Resy sniper bots […] what they all do is hit Rey’s services many many times looking for time-based reservation drop and availability churn associated with cancellations. That’s how they all work.”

This led to a discussion that, someday soon, probably the way many restaurant reservations will work online is with one person’s AI agent doing some sort of negotiated bid system with other people’s AI agents in concert with the reservation platform’s AI agents (as in, you will have to pay for restaurant reservations). It is easy to say: Fuck that, that’s not going to happen, I will never use AI. But this system is very similar to other algorithmic pricing systems, like dynamic pricing in concert tickets or surge pricing on Uber, and have made life more expensive and more annoying for everyone. The agentic internet is here, and it’s weird as hell.

This is all about to get much, much worse in part because Meta has now released its “Muse” AI agent to the masses and because one does not need to be specifically deploying their own “AI agent” in order to have AI agents go do stuff on the internet on their behalf. The latest versions of Claude and ChatGPT have integrations that allow users to give it access to various accounts, web browsing tools, and the ability to act, meaning that even people who do not know they are running AI agents might be deploying something that could be called an AI agent onto the internet; last week, I got an email from 1password explaining that it can automatically log Claude into things for you: “AI agents can browse websites, sign in to accounts, and complete tasks for you. But when an agent reaches a login page, the task can come back to you. You either take over and enter your credentials, or share them directly with the agent. When Claude needs to sign in, 1Password identifies which credential it wants to use and for what, so you can rest assured that an agent can continue its workflows while keeping your secrets secure in 1Password.”

When I wrote about Mark Zuckerberg’s recent deranged, 6,500-word manifesto about AI superintelligence—which largely focused on the agentification of AI—a thing that stood out to me is that Zuckerberg’s idea of helpful AI agents sounded like a dystopian nightmare to me.

“Everyone will have an exceptionally capable personal agent that understands you, your goals, and everything you care about. Your agent will work 24/7 on your behalf to improve your relationships, health, career, finances, home management, hobbies, and more,” Zuckerberg wrote. “It will free up time for the things you enjoy, and help you accomplish more than you could otherwise. It will have strong privacy and security options so you can trust it to handle all of your personal content knowing that no one else can access your information, similar to how encryption works on WhatsApp. You’ll be able to interact with your agent through any device, including your glasses to keep you present in the moment with the people you care about.”

Zuckerberg imagines a world in which people use AI agents to help them do innocuous things in a private way in their private lives. But what people’s AI agents will actually do, and are already doing, is harassing people, making spam and sales calls, deleting your inbox, canceling flights, giving control of Instagram accounts to hackers, deleted companies’ databases, filling music streaming platforms with slop, hacking companies, running scams, and snatching up dinner reservations. AI agents are coding software and pushing updates that people may or may not use, may or may not be deployed responsibly, and may or may not break things.

Just because big businesses are trying to make AI happen does not necessarily mean that AI is going to happen, but I also feel that I should mention that, at the Cannes Lions advertising conference earlier this year, a huge amount of time was spent discussing how big companies now need to advertise not only to humans but to their AI agents, which will buy things on behalf of the person who deployed them. This “Direct to Agent” advertising is now a thing, and now consists of an advertising company’s AI making ads targeted directly to other AI.

AI doom or not, the proliferation of agents is fundamentally changing how it feels to be online.