作为AI在现实世界的“代理”，Agent被期许接管人们的初级工作和日常杂务，但人类世界，似乎还没做好准备。
今年被称为“Agent规模化元年”，从年初爆火的“小龙虾”OpenClaw到近期集中涌现的Meta Muse、OpenAI Dots、腾讯小微等个人Agent，新品层出不穷。这些Agent“承诺”了这样一种未来图景：订机票、比价、采购、处理账单乃至复杂的工作任务都不用再“自己动手”，人只需提出目标，剩下的交给AI。
但现实却是，Agent正愈发被互联网生态视为“不稳定因素”，10月以来集中爆发的网络安全事件更是让如何“建墙”防住Agent的关注度超越了如何给Agent开放更多权限。
10月23日以来，多份最新发布的报告和材料又曝光了一系列安全事件：Anthropic的Claude Mythos 5在网络安全测试中，因常规路径受阻，开始搜索公共互联网寻找其他方式完成任务，并试图向一个真实开源软件仓库引入恶意代码。
全球人工智能创新治理中心副主任、资深研究员，复旦大学国际关系与公共事务学院副教授蒋昌建认为，Agent的出现，正在给人类传统安全治理思维和框架带来新的冲击，Agent的能力越强大、越自主，人类在技术可靠性、行为可控性、治理有效性上面临的挑战就越大。
而在这场变革中，已经出现了许多截然不同的反应，有的在对Agent围追堵截，有的想给Agent一个“专属身份”，也有让Agent“另起炉灶”、为其建立专属网络的尝试。
围堵Agent：旧网络难容新居民
9月，Meta发布的Muse迅速蹿红，这家科技巨头也在低迷多时后终于重回AI战场的中央，但这个颇具时代标志性的Agent却也引发了一场“大封锁”。
根据The Verge发布的报道，亚马逊在Muse发布后就迅速采取行动，阻止其代用户购物，并向用户提示，未经授权的Agent继续访问将违反平台使用条款。该公司给出的理由主要是隐私与安全问题，如Muse没有明确表明自身身份，还可能接触用户凭据，带来一系列风险。
10月以来，多方信息显示，Yelp、达美航空、摩根大通、嘉信理财等均将Muse拒之门外。根据Jefferies发布的统计数据，约三分之一美国主要网站屏蔽Muse，另三分之一施加限制。国内也有类似的情况，2025年末亮相的“豆包手机”于今年9月推出消费者版本，但就在10月14日，豆包手机助手公告微信、淘宝、支付宝等155款App拒绝其自动化操作。而伴随Muse风潮集中发布的一批个人Agent，大多也只能跑在自家公司的生态体系或“朋友圈”里。
更值得注意的是，因检测到未经许可的Agent在客户账户内活动，10月以来摩根大通、美银、花旗等美国头部银行开始集体“抵制”Agent，禁止其访问账户和发起交易。摩根大通CEO杰米·戴蒙（Jamie Dimon）还将这些Agent形容为“流氓”。
从近期集中爆发的“围堵Agent”事件来看，核心原因无外乎商业考量、安全考量两类，很多场景下则是二者的结合。
比如亚马逊此前封禁Perplexity的购物Agent并提起诉讼时，理由是Agent模糊了“广告究竟被谁看到”，直接侵蚀其广告商业模式。而且，AI时代兴起以来，新的“入口之争”一直没有停息。而Agent的出现被认为很可能将原有的前台操作压缩为后台自动任务，往昔的入口则沦为Agent的调用工具，这无疑将改变流量和交易的分配方式，乃至整个互联网产业、平台经济的生态。
与此同时，亚马逊在限制Perplexity、Muse时也提到这些Agent让用户账户面临被盗风险等安全问题。很明显，传统网络生态并没有为这种新型访问者准备好通用规则，其中一个核心原因是Agent的“身份缺口”，传统网络的识别体系在结构上就没有为Agent准备一个可被承认的类别，通常只能以原本用于抵御恶意爬虫和自动化攻击的机制进行防御、封锁。
在蒋昌建看来，当AI Agent宣称能够代表用户行动时，就必然会导致控制权的重新分配。只有建立新的基础设施和治理架构，回答好“谁拥有行动的权力？谁承担行动的风险？谁能够在危险的时候按下停止键？”等关键问题，才能安全地开启新的时代。
应许之地：为Agent找到属于自己的网络
随着传统互联网生态与Agent的适配问题愈发凸显，业界愈发关注如何让Agent拥有自己的“地盘”。
今年初，专为Agent设计的社交平台Moltbook曾引发广泛关注。它允许Agent通过接口自主发帖、评论、点赞和加入社区，人类则更多扮演观察者的角色。与传统社交平台不同，这里的主要参与者不是人，而是能够持续运行、调用工具的AI代理。它一度引发了人们对“Agent王国”的好奇和想象。但平台走红后，安全研究人员发现其存在数据库和凭据暴露等问题，攻击者甚至可能冒充其他Agent进行诈骗、投放病毒。此后随着Meta收购Moltbook，人们对此类尝试的热情也暂告一段落。
在中国信通院云计算与数字化研究所副所长栗蔚看来，相比于让Agent社交，更重要的是为Agent“建网”。她认为，Agent与传统网络主体有本质区别，其核心能力是能够自主进化，这让操作行为从功能界面的交付变成了意图达成的行动式交付，责任主体也随之变得更加复杂。而在网络中Agent数量、行动频率正在赶超人类的背景下，“人本位”设计的传统互联网必然要经历重塑。这也催生了Agent互联网概念的兴起。
不过，目前各方对如何建立Agent互联网仍有不同考量。
AI厂商更希望未来的互联网是“智能网络”，网络架构能适配Agent的大规模分发需求。而互联网企业则倾向不修改底层网络，重点修改应用层协议。学界的态度更加中立，更看重如何建立新型协作机制和协作架构。
栗蔚认为，考虑到现实情况，在现有互联网五层架构基础上，通过标准化协议、交互协作和智能化方式，实现应用层Agent互联的可行性更高。
目前相关方向的探索也较多，其核心还是给Agent“发身份证”，让其拥有可验证的身份、边界明确的授权，以及可追溯的执行记录，进而让互联网接纳它。
而另一种“重构派”的方案也在引发更多关注。
此类路径往往强调需要原生的Agent传输协议，在物理层就将人类和Agent的网络分开，二者并行运行，并认为只有如此才能发挥Agent“直达结果”的优势。典型如开源项目Open Agent Internet，就在其介绍中宣称正在推进为Agent构建一个“无许可（permissionless）”的网络，即不依赖任何单一平台、不需要任何中心化机构批准，Agent就能存在、通信和协作的网络。
不过，目前看来，无论是“渐进式”的改造旧网，还是“另起炉灶”建立新网，距离落地还都有距离。栗蔚称，即使大厂生态内的Agent互联也处于初级阶段，商业模式、安全框架等都存在许多模糊地带，而难度远大于此的开放网络Agent互联，更是仍在起步初期，还有很多路要走。但这也为人们提前在技术、安全、监管乃至伦理等层面做好准备留出了空间。
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
As AI's “agent” in the real world, Agent was promised to take over people's primary work and day-to-day chores, but the human world does not seem ready.
This year, known as “Agent's Year of Scalding”, has seen a proliferation of new products from OpenClaw, the firehouse, to the recent concentration of individuals such as Meta Muse, Open AI Dots, Tencent, and Agent. These Agent “commit” represent a vision for the future: no more “self-help” on airline tickets, prices, procurement, billing, or even complex tasks, but only target and leave the rest to AI.
The reality, however, is that Agent is increasingly being viewed by Internet ecology as a “resilient factor” and that the concentration of cyber-security incidents since October has focused much more attention on how to “wall” Agent than on how to open more permission to Agent.
Since 23 October, many of the latest publish reports and materials have been exposed to a series of security incidents: Claude Mythos of Anthropic began searching the public Internet for alternative ways of accomplishing its mission in the context of a network security test, which was blocked by the normal path, and attempted to introduce malicious codes into a real open-source software warehouse.
Jiang Chang Jian, Deputy Director and Senior Researcher of the Global Center for Artificial Innovation and Governance and Associate Professor at the Institute of International Relations and Public Affairs of the University of Jordan, believes that the emergence of Agent is having a new impact on the thinking and framework of traditional human security governance, and that the stronger and more autonomous the capacity of Agent, the greater the challenges that human beings face in terms of technical reliability, behavioural control and the effectiveness of governance.
There have been many different reactions to this change, some in pursuit of Agent, others in an attempt to give Agent an “exclusive identity” and others in an attempt to “silent” and create an exclusive network.
Blockage of Agent: The old network has no room for new residents
In September, the Muse of Metapublish quickly became popular, and the tech giant finally returned to the center of the AI battlefield after a long time of depression, but this landmark Agent also triggered a “big blockade”.
According to The Vergepublish, the Amazon acted quickly after Musepublish to stop its clients from shopping on their behalf and warned them that the continued unauthorized access of Agent would violate the platform ' s usage terms. The reasons given by the company were mainly privacy and security issues, such as Muse ' s lack of clarity about his identity, and the possibility of contact with user evidence, entailing a range of risks.
Since October, multiple sources have indicated that Mr. Muse has been denied access to Yelp, Dammeh Air, Morgan Chase, C.S.I., etc. According to Jefferiespublish statistics, about one third of the major United States websites shielded Muse and another third imposed restrictions. A similar situation exists in the country, where the popular “Doubao mobile phone” in late 2025 was launched in September of this year, but on October 14, Doubao mobile phone assistants announced that 155 Apps such as WeChat, Quest, Pay Bottle, etc. refused to automate it. A group of individuals, Agent, with the wave of Muse, concentrated in publish, have mostly been found in their own ecological systems or “friend circles”.
More notably, as a result of the detection of the unauthorized movement of Agent in client accounts, since October United States front banks such as Chase Morgan, Silver and Citigroup have begun to collectively “resist” Agent, prohibiting him from accessing accounts and initiating transactions. Jamie Dimon of Morgan Chase also described these Agents as “rogues”.
In the light of the recent surge in “closure” of Agent, the core causes are in the form of commercial considerations, security considerations and, in many cases, a combination of the two.
For example, when the Amazon had previously banned and sued Agent for shopping in Perplixity, the argument was that Agent had obscured “who saw the advertisement” and directly eroded its advertising business model. Moreover, the new “entry struggle” has not stopped since the rise of the AI era. The emergence of Agent, which is believed to be likely to compress the original front-office operation into an automatic back-office mission, and the former entry point into Agent's call tool, will undoubtedly change the distribution of flows and transactions, and the ecology of the entire Internet industry, platform economy.
At the same time, the security problems that Agent faced in exposing user accounts to the risk of theft were mentioned in Amazonian restrictions on Perpexity and Muse. It is clear that the traditional network ecology does not have universal rules for this new type of visitor, one of the central reasons being the “identity gap” of Agent, and that the traditional network's identification system is not structured to provide Agent with an identifiable category, usually defending and blocking only by the mechanism originally used to defend against malicious reptiles and automated attacks.
In Chiang Chang Jian ' s view, when AI Agent claims to be able to act on behalf of the user, it necessarily leads to a redistribution of control. Only the establishment of new infrastructure and governance structures will answer “Who has the power to act? Who bears the risk of action? Who can push the stop button at a time of danger?” Keys such as the key question can safely begin a new era.
Promised Land: Find your own network for Agent
As the adaptation of traditional Internet ecology to Agent became more pronounced, industry became increasingly concerned about how to give Agent its own “location”.
At the beginning of this year, Moltbook, a social platform designed for Agent, attracted widespread attention. It allows Agent to post, comment, praise and join communities through interfaces, while human beings play more observer roles. Unlike traditional social platforms, the main participants here are not people, but AI agents who are able to keep running and call on tools. At one point, it triggered curiosity and imagination about the “Agent Kingdom”. However, after the platform went red, security researchers discovered problems such as the existence of databases and evidence exposure, and the attackers could even impersonate other Agent as frauds and viruses. Since then, the enthusiasm for such attempts has come to an end with the acquisition of Moltbook by Meta.
In the view of the Vice-President of the China Institute of Cloud Computing and Digitalization, it is more important to “network” Agent than to socialize it. In her view, Agent was fundamentally different from traditional web subjects, whose core competencies were capable of autonomous evolution, which transformed operational behaviour from the delivery of functional interfaces to intended operational delivery, with the attendant complexity of the responsible subject. And in the context of the number of Agents and the frequency of their actions that are catching up with humans, the traditional Internet, designed by “humans”, is bound to undergo a reshaping. This also led to the emergence of the concept of the Internet of Agent.
However, there are still differing views on how to establish the Agent Internet.
AAI producers prefer the future Internet to be an “intellectual network” with network structures that match the large distribution needs of Agent. Internet enterprises, on the other hand, tend not to modify the bottom-up network, focusing on the application layer protocols. The attitude of the academic community is more neutral and places greater emphasis on the development of new collaborative mechanisms and structures.
It is argued that, taking into account the realities, it is more feasible to interconnect at the application level through standardized protocols, interaction and intelligence, based on the existing five-tier architecture of the Internet.
There has also been more exploration of the relevant directions, with the core being the “identity card” given to Agent, which has a verifiable identity, a clear mandate with clear borders, and a retroactive implementation record, thus allowing it to be accepted on the Internet.
Another “reconstruction” programme is also attracting more attention.
Such paths often emphasize the need for original Agent transmission protocols to separate human and Agent's networks at the physical level, operating in parallel, and believe that only in this way can Agent's “direct results” advantage be exploited. A typical open-source project, Open Internet, in its presentation, claims to be moving forward with the establishment of an “unlicensed” network for Agent, i.e. one that does not depend on any single platform and does not require approval from any centralized agency.
However, it appears that neither the “progressive” retrofitting of the old net nor the “other stoves” have created a new net that is far from landing. Even at an early stage, even in the plant’s ecology, there are many ambiguities in business models, safety frameworks, etc., which are much more difficult than the open network Agent’s connections, and still in the early stages of the process, with much more to go. But it also leaves room for people to prepare ahead of schedule at the technical, security, regulatory and even ethical levels.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.