作为AI在现实世界的“代理”，Agent被期许接管人们的初级工作和日常杂务，但人类世界，似乎还没做好准备。
今年被称为“Agent规模化元年”，从年初爆火的“小龙虾”OpenClaw到近期集中涌现的Meta Muse、OpenAI Dots、腾讯小微等个人Agent，新品层出不穷。这些Agent“承诺”了这样一种未来图景：订机票、比价、采购、处理账单乃至复杂的工作任务都不用再“自己动手”，人只需提出目标，剩下的交给AI。
但现实却是，Agent正愈发被互联网生态视为“不稳定因素”，10月以来集中爆发的网络安全事件更是让如何“建墙”防住Agent的关注度超越了如何给Agent开放更多权限。
10月23日以来，多份最新发布的报告和材料又曝光了一系列安全事件：Anthropic的Claude Mythos 5在网络安全测试中，因常规路径受阻，开始搜索公共互联网寻找其他方式完成任务，并试图向一个真实开源软件仓库引入恶意代码。
全球人工智能创新治理中心副主任、资深研究员，复旦大学国际关系与公共事务学院副教授蒋昌建认为，Agent的出现，正在给人类传统安全治理思维和框架带来新的冲击，Agent的能力越强大、越自主，人类在技术可靠性、行为可控性、治理有效性上面临的挑战就越大。
而在这场变革中，已经出现了许多截然不同的反应，有的在对Agent围追堵截，有的想给Agent一个“专属身份”，也有让Agent“另起炉灶”、为其建立专属网络的尝试。
围堵Agent：旧网络难容新居民
9月，Meta发布的Muse迅速蹿红，这家科技巨头也在低迷多时后终于重回AI战场的中央，但这个颇具时代标志性的Agent却也引发了一场“大封锁”。
根据The Verge发布的报道，亚马逊在Muse发布后就迅速采取行动，阻止其代用户购物，并向用户提示，未经授权的Agent继续访问将违反平台使用条款。该公司给出的理由主要是隐私与安全问题，如Muse没有明确表明自身身份，还可能接触用户凭据，带来一系列风险。
10月以来，多方信息显示，Yelp、达美航空、摩根大通、嘉信理财等均将Muse拒之门外。根据Jefferies发布的统计数据，约三分之一美国主要网站屏蔽Muse，另三分之一施加限制。国内也有类似的情况，2025年末亮相的“豆包手机”于今年9月推出消费者版本，但就在10月14日，豆包手机助手公告微信、淘宝、支付宝等155款App拒绝其自动化操作。而伴随Muse风潮集中发布的一批个人Agent，大多也只能跑在自家公司的生态体系或“朋友圈”里。
更值得注意的是，因检测到未经许可的Agent在客户账户内活动，10月以来摩根大通、美银、花旗等美国头部银行开始集体“抵制”Agent，禁止其访问账户和发起交易。摩根大通CEO杰米·戴蒙（Jamie Dimon）还将这些Agent形容为“流氓”。
从近期集中爆发的“围堵Agent”事件来看，核心原因无外乎商业考量、安全考量两类，很多场景下则是二者的结合。
比如亚马逊此前封禁Perplexity的购物Agent并提起诉讼时，理由是Agent模糊了“广告究竟被谁看到”，直接侵蚀其广告商业模式。而且，AI时代兴起以来，新的“入口之争”一直没有停息。而Agent的出现被认为很可能将原有的前台操作压缩为后台自动任务，往昔的入口则沦为Agent的调用工具，这无疑将改变流量和交易的分配方式，乃至整个互联网产业、平台经济的生态。
与此同时，亚马逊在限制Perplexity、Muse时也提到这些Agent让用户账户面临被盗风险等安全问题。很明显，传统网络生态并没有为这种新型访问者准备好通用规则，其中一个核心原因是Agent的“身份缺口”，传统网络的识别体系在结构上就没有为Agent准备一个可被承认的类别，通常只能以原本用于抵御恶意爬虫和自动化攻击的机制进行防御、封锁。
在蒋昌建看来，当AI Agent宣称能够代表用户行动时，就必然会导致控制权的重新分配。只有建立新的基础设施和治理架构，回答好“谁拥有行动的权力？谁承担行动的风险？谁能够在危险的时候按下停止键？”等关键问题，才能安全地开启新的时代。
应许之地：为Agent找到属于自己的网络
随着传统互联网生态与Agent的适配问题愈发凸显，业界愈发关注如何让Agent拥有自己的“地盘”。
今年初，专为Agent设计的社交平台Moltbook曾引发广泛关注。它允许Agent通过接口自主发帖、评论、点赞和加入社区，人类则更多扮演观察者的角色。与传统社交平台不同，这里的主要参与者不是人，而是能够持续运行、调用工具的AI代理。它一度引发了人们对“Agent王国”的好奇和想象。但平台走红后，安全研究人员发现其存在数据库和凭据暴露等问题，攻击者甚至可能冒充其他Agent进行诈骗、投放病毒。此后随着Meta收购Moltbook，人们对此类尝试的热情也暂告一段落。
在中国信通院云计算与数字化研究所副所长栗蔚看来，相比于让Agent社交，更重要的是为Agent“建网”。她认为，Agent与传统网络主体有本质区别，其核心能力是能够自主进化，这让操作行为从功能界面的交付变成了意图达成的行动式交付，责任主体也随之变得更加复杂。而在网络中Agent数量、行动频率正在赶超人类的背景下，“人本位”设计的传统互联网必然要经历重塑。这也催生了Agent互联网概念的兴起。
不过，目前各方对如何建立Agent互联网仍有不同考量。
AI厂商更希望未来的互联网是“智能网络”，网络架构能适配Agent的大规模分发需求。而互联网企业则倾向不修改底层网络，重点修改应用层协议。学界的态度更加中立，更看重如何建立新型协作机制和协作架构。
栗蔚认为，考虑到现实情况，在现有互联网五层架构基础上，通过标准化协议、交互协作和智能化方式，实现应用层Agent互联的可行性更高。
目前相关方向的探索也较多，其核心还是给Agent“发身份证”，让其拥有可验证的身份、边界明确的授权，以及可追溯的执行记录，进而让互联网接纳它。
而另一种“重构派”的方案也在引发更多关注。
此类路径往往强调需要原生的Agent传输协议，在物理层就将人类和Agent的网络分开，二者并行运行，并认为只有如此才能发挥Agent“直达结果”的优势。典型如开源项目Open Agent Internet，就在其介绍中宣称正在推进为Agent构建一个“无许可（permissionless）”的网络，即不依赖任何单一平台、不需要任何中心化机构批准，Agent就能存在、通信和协作的网络。
不过，目前看来，无论是“渐进式”的改造旧网，还是“另起炉灶”建立新网，距离落地还都有距离。栗蔚称，即使大厂生态内的Agent互联也处于初级阶段，商业模式、安全框架等都存在许多模糊地带，而难度远大于此的开放网络Agent互联，更是仍在起步初期，还有很多路要走。但这也为人们提前在技术、安全、监管乃至伦理等层面做好准备留出了空间。
本文由 AI宝库自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
As AI's “agent” in the real world, Agent was promised to take over people's primary work and day-to-day chores, but the human world did not seem ready.
This year, known as the “Agent Year of Scalding”, has seen the emergence of new layers from the fire of OpenClaw at the beginning of the year to the recent concentration of individuals such as Meta Muse, OpenAi Dots, Tencent, and Agent. These Agent “commit” represent a vision for the future: air tickets, prices, procurement, billing and even complex tasks need not be “do it by themselves” and people need to come up with targets and leave the rest to AI.
The reality, however, is that Agent is increasingly being viewed as a “resilient factor” by the ecology of the Internet, and that the concentration of cyber-security incidents since October has focused much more on how to “wall” Agent than on how to open up more permission to Agent.
Since 23 October, many of the latest reports and materials of publish have been exposed to a series of security incidents: Claude Mythos of Anthropic began searching the public Internet for alternative ways to accomplish its task, in the context of a network security test, owing to the blockage of a conventional path, and attempted to introduce malicious codes into a real open source software warehouse.
Jiang Chang Jian, Deputy Director and Senior Researcher of the Global Center for Artificial Innovation and Governance and Associate Professor at the Institute of International Relations and Public Affairs of the University of Jordan, believed that the emergence of Agent was having a new impact on the thinking and framework of traditional human security governance, and that the stronger and more autonomous the capacity of Agent, the greater the challenges human beings face in terms of technical reliability, behavioural control and the effectiveness of governance.
In this transformation, there have been many very different reactions, some in pursuit of Agent, some in an attempt to give Agent a “exclusive identity” and others in an attempt to “silent” and create an exclusive network for him.
Blockage of Agent: The old network has no place for new residents
In September, the Muse of Metapublish, a tech giant who also returned to the center of the AI battlefield after a long time of depression, also triggered a “big blockade” by the landmark Agent.
According to The Vergepublish, Amazon acted quickly after Musepublish to stop its clients from shopping on their behalf and to warn them that the continued unauthorized access of Agent would violate the platform ' s usage terms. The reasons given by the company were primarily privacy and security issues, such as Muse ' s lack of clarity about his identity and the possibility of contact with user evidence, posing a range of risks.
Since October, multiple sources have indicated that Yelp, Dammeh Air, Morgan Chase, C.S.I.E., etc. have all turned Muse away. According to Jefferiespublish statistics, about one third of the major United States websites shielded Muse and another third imposed restrictions. A similar situation exists in the country, where the Doubao mobile phone, which appeared at the end of 2025, launched a consumer version in September of this year, but on October 14, the Doubao mobile phone assistant announced that 155 Apps of WeChat, poaching, paying for treasures, etc. refused to automate it. A group of individuals, Agent, who are at the centre of publish, mostly run in their own ecological systems or “friendships”.
More notably, as a result of the detection of the unauthorized movement of Agent in client accounts, since October United States front banks such as Chase Morgan, American silver and Citigroup have begun to collectively “restraint” Agent, prohibiting him from accessing accounts and initiating transactions. Jamie Dimon of Morgan Chase also described these Agents as “rogues”.
In the light of the recent upsurge in “closure” of Agent, the core causes are not only commercial, security and, in many cases, a combination of the two.
In Amazonia, for example, when Agent was previously banned from shopping in Perplexity and sued, the reason was that Agent had lost its advertising business model by blurring “who actually saw it” and directly eroding it. Moreover, the new “entry struggle” has not stopped since the rise of the AI era. The emergence of Agent, which is considered likely to compress the original front-office operation into an automatic back-office mission, and the old entry point into Agent’s call tool, will undoubtedly change the distribution of traffic and transactions, as well as the ecology of the entire Internet industry, platform economy.
At the same time, the security concerns of these Agents, which expose user accounts to the risk of theft, were also mentioned by the Amazon when restricting Perpexity and Muse. It is clear that the traditional web ecology does not have universal rules for this new type of visitor, one of the central reasons being the “identity gap” of Agent, and that the traditional network's identification system is not structured to provide Agent with an identifiable category, usually defending and blocking only by the mechanism that was originally used to protect him from malicious reptiles and automated attacks.
In Chiang Chang Jian ' s view, when AI Agent claims to be able to act on behalf of the user, it necessarily leads to a redistribution of control. Only the establishment of new infrastructure and governance structures will answer “Who has the power to act? Who bears the risk of action? Who can push the stop button in a dangerous situation?” Keys such as these can safely open a new era.
Promised Land: Find your own network for Agent
As traditional Internet ecology and Agent's suitability became more prominent, there was growing interest in how to give Agent his own “location”.
At the beginning of this year, Moltbook, a social platform designed for Agent, attracted widespread attention. It allows Agent to post, comment, applaud and join the community through the interface, while human beings play more of the role of observers. Unlike traditional social platforms, the main participants here are not people, but AI agents who are able to keep running and call on tools. At one point, it triggered curiosity and imagination about the “Agent Kingdom”. However, after the platform went red, security researchers discovered problems such as the existence of a database and evidence exposure, and the attackers could even impersonate other Agents as frauds and viruses. Since then, the enthusiasm for such attempts has come to an end with the acquisition of Moltbook by Meta.
In the view of the Vice-President of the China Institute for Cloud Computing and Digitalization, it is more important to “network” Agent than to socialize it. In her view, Agent was fundamentally different from traditional web subjects, whose core competencies were capable of autonomous evolution, which made it more complex to operate from the delivery of the functional interface to the intended operational delivery. In the context of the number and frequency of Agents in the network, which are catching up with humans, traditional Internets designed by “humans” are bound to undergo re-engineering. This also led to the emergence of the concept of the Internet of Agent.
However, there are still different views on how to establish the Agent Internet.
AI producers prefer that the future Internet be an “intellectual network” with a network structure that matches the large distribution needs of Agent. Internet enterprises, on the other hand, tend not to modify the bottom-up network, with a focus on tiered protocols. The attitude of the academic community has become more neutral, placing greater emphasis on the development of new collaborative mechanisms and structures.
It is considered that, taking into account the reality, it is more feasible to interconnect the application level with Agent through standardized protocols, interaction and intelligence, based on the existing five-tiered architecture of the Internet.
There has also been more exploration of the relevant directions, at the core of which is the “identity card” given to Agent to enable it to have a verifiable identity, a clear mandate with a clear border and a retroactive implementation record, thus allowing it to be accepted on the Internet.
Another “reconstruction” programme is also attracting more attention.
Such pathways tend to emphasize the need for the original Agent transmission protocol, which separates humans from Agent's network at the physical level, operating in parallel with each other, and believes that only in this way can the advantage of Agent's “direct results” be exploited. A typical open-source project, Open Internet, claims in its presentation that it is moving forward with the creation of a “permissionless” network for Agent, i.e. one that does not depend on any single platform and does not require approval by any centralized agency, and that it can exist, communicate and collaborate.
At present, however, it appears that neither the “progressive” retrofitting of the old net nor the “other stoves” have created a new net that is far from landing. It is argued that even the Agent interconnection in the plant’s ecology is at an early stage, and that there are many ambiguities in business models, safety frameworks, etc., which are much more difficult than the open network Agent’s interconnections, and still at an early stage, with many ways to go. But it also leaves room for people to prepare ahead of time at the technical, security, regulatory and even ethical levels.
Auto-fetched and translated by AI Gem Box. All rights belong to the original author.