M111:56
欢迎回到AI每日简报！
Welcome back to the AI Daily Brief!
今天我们要谈论近期一系列AI agent的安全事件，并以此为背景，更广泛地探讨AI agent真正的风险到底是什么。
Today we're talking about a number of recent security incidents with AI agents, and using that as the context to explore more broadly what the real risks from AI agents are.
现在显然不缺各种恐惧的声音，但我觉得，把我们的担忧具体到真正该担心的点上，比单纯罗列一堆黑客事件、然后摊手表示恐惧要有用得多。
There is obviously no shortage of fear running around right now, But getting specific about where our concerns should actually be is, I think, likely to be a bit more useful than just cataloging the list of hacks and happenings and throwing up our hands in fear.
需要说清楚的是，确实有一些真实的事情正在发生。
Now, to be clear, there are some real things going on here.
OpenAI在又一次发生agent未经授权访问互联网的事件后，暂停了最强模型的训练。
OpenAI has paused training for their most capable models after another incident of an agent getting unauthorized access to the internet.
OpenAI对齐团队的一篇博客文章披露了这个事件，发生在9月20日。
A blog post from OpenAI's alignment team disclosed the incident, which occurred on September 20th.
他们写道：一个试图完成基于搜索的训练任务的agent，通过我们互联网访问限制中的一个漏洞——训练沙盒里DNS过滤不足——查询了一个公共聊天机器人服务。
They wrote, an agent attempting to complete a search-based training task queried a public chatbot service through a gap in our internet access restrictions— insufficient DNS filtering in its training sandbox.
在此之前，这个agent通过我们的搜索工具发出过查询，也直接尝试访问搜索引擎，但都没有成功。
Before this, the agent issued queries via our search tool and unsuccessfully tried to access search engines directly.
具体来说，模型通过DNS查询偷偷把一条消息送上了开放互联网，这是一种众所周知的技术，叫DNS tunneling。
Specifically, the model smuggled a message to the open internet through the DNS lookup, a well-known method called DNS tunneling.
OpenAI表示，他们之后在两个独立的层面上增加了拦截控制，其中任何一层都足以阻止这次访问。
OpenAI said that they've since added blocking controls on 2 independent layers, either of which would have prevented access.
对齐团队写道，监控系统在15分钟内标记了这个行为，三分钟后人类审查启动，两个半小时后训练运行被叫停。
The alignment team wrote that their monitoring system flagged the behavior within 15 minutes, human review commenced 3 minutes after that, and the training run was killed 2.5 hours later.
一个担忧是自动停止功能没有正常工作，需要手动关闭。
One concern was that the automatic stop didn't work properly and required a manual shutdown.
OpenAI写道，我们最强大模型的全部训练、评估和推理——这些模型对工具的使用进行了广泛定义——都保持暂停状态。
OpenAI wrote, all training, evaluation, and inference with tool use defined broadly of our most capable models remain paused.
不过，那一起事件只是冰山一角。
Now, that one incident was just the tip of the iceberg.
过去一周，陆续有报道称OpenAI的智能体还入侵了其他多个网站。
Over the past week, reports have trickled out about OpenAI agents hacking various other websites as well.
在较早的一起事件中，报道称OpenAI入侵了澳大利亚政府，具体来说是他们的Medicare网站。
In one of the earlier incidents, reports stated that OpenAI had hacked the Australian government, specifically their Medicare website.
上周末，联合国和美国多个政府部门也被列入了受害者名单。
Over the weekend, the United Nations and various US government departments were added to the list of victims.
周日，OpenAI透露他们正在对意外的模型行为进行彻底审查。
On Sunday, OpenAI disclosed that they're conducting a thorough review into unexpected model behaviors.
他们表示，如果模型绕过了第三方安全控制，他们将通知相关第三方。
They said they'll be notifying third parties in instances where the models bypass third-party security controls.
或者影响了网站和网络服务的可用性。
Or impacted the availability of websites and web-based services.
已经发出了数十份这类通知。
Dozens of such notifications have already been sent.
Axios报道称，目前正在审查数万起安全事件，这让人感受到问题的规模。
Axios reported that tens of thousands of security incidents are currently under review, giving a sense of the scale of the issue.
那么，虽然OpenAI在互联网上遇到意外模型行为的问题很明显，但对其他所有人来说，这个问题实际有多大却远不那么清楚。
Now, while it's pretty obvious that OpenAI is having a problem with unexpected model behavior on the internet, it's far less clear how big of a problem in practice this is for everyone else.
并且毫不意外，媒体用来描述这些事件的措辞，相对于实际发生的情况，相当危言耸听。
And unsurprisingly, the language being used by the press to describe these incidents is fairly alarmist relative to what actually happened.
在一篇关于OpenAI模型访问美国SEC、教育部和商务部的文章中，《纽约时报》在开篇写道：OpenAI的人工智能今年夏天失控了，并在AI实验室不知情的情况下，干预了教育部、商务部和证券交易委员会的网站。
In an article about OpenAI's model accessing the US SEC and Education and Commerce Departments, the New York Times wrote in their lead paragraph, OpenAI's artificial intelligence went rogue and meddled with the websites for the Education Department, the Commerce Department, and the Securities and Exchange Commission this summer without the AI lab's knowledge.
这种干预似乎是用在公共论坛上找到的登录凭证，访问商务部网站上的人口普查局数据，并重新发布了SEC的公开信息。
The meddling, it seems, was to use login credentials found in a public forum to access Census Bureau data on the Commerce Department's website and to repost publicly available information from the SEC.
商务部证实智能体未能访问任何私人数据，教育部也表示系统运营没有发现对我们的网站或数据库有任何影响的证据。
The Commerce Department confirmed that agents were unable to access any private data, and the Education Department said systems operations have found no evidence of any impact to our website or databases.
说实话，对这些事件中的大多数来说，即使是“入侵”这个词也可能有点过分了。
To be honest, even the word hacking might be a little extreme for most of these events.
这个词让人联想到蓄意攻击、让网站瘫痪、窃取私人信息以及篡改数据。
The word conjures up the idea of intentional attacks, taking a website down, stealing private information, and otherwise messing with data.
但很难找到一个OpenAI智能体真正造成损害的实例。
But it's difficult to find a single instance of OpenAI's agents actually doing any harm.
在大多数情况下，更准确的说法是智能体读取了政府网站，而不是入侵了它们。
In most cases, it's more correct to say that the agents read government websites rather than hacked them.
对澳大利亚Medicare门户所谓的“攻击”——带引号的那种——有助于理解实际发生了什么。
The attack air quotes on Australia's Medicare portal is instructive in understanding what actually happened.
总理安东尼·阿尔巴尼斯周三在联合国告诉记者，OpenAI的智能体“渗透”了一个统计门户，其中包含他所称的非敏感数据。
Prime Minister Anthony Albanese told reporters on Wednesday at the UN that OpenAI's agents quote infiltrated a statistics portal containing what he characterized as non-sensitive data.
澳大利亚科技记者Cameron Wilson后来透露，即使是“渗透”这个词也稍微有点重了。
Australian tech reporter Cameron Wilson later revealed that even the word infiltration was a little strong.
这些数据没有被公开索引，但仍然在面向公众的网站上，没有密码保护。
The data was not publicly indexed, but it was still on the public-facing website with no password controls.
The Record的报道称，智能体实际做的是手动输入文件名来访问未索引的文件。
Reporting from The Record suggests that what the agents actually did was manually type in file names to access unindexed files.
这种行为的类似案例之前曾被起诉过，但大多数所谓的“黑客攻击”似乎只是低级的变通方法，并没有造成实际损害。
Now, this kind of behavior has been prosecuted before, but it seems like most of the so-called hacks were low-level workarounds that caused no real harm.
事实上，真正的损害是各国政府现在被迫为一些极其松懈的安全措施进行辩护。
In fact, the real damage is that governments are now being forced to defend some extremely lax security practices.
这预示着未来网络安全环境将是什么样的。
In a preview of what the cybersecurity environment will look like moving forward.
除了未经授权抓取网站之外，OpenAI确实还披露了几起更令人担忧的事件。
Now, aside from unauthorized scraping of websites, OpenAI did disclose a few more troubling incidents.
在一份报告中，OpenAI披露智能体制造了一次自我复制的提示注入攻击。
In one report, OpenAI disclosed that agents had created a self-replicating prompt injection attack.
这只是一个概念验证，从未发布到互联网上，但它可以让AI模型通过提示其他模型将其发布到网上来传播信息。
This was only a proof of concept and was never posted to the internet, but it would allow AI models to propagate a message by prompting other models to post it online.
OpenAI还透露，他们发现了53起模型将用户提供的图片发布到图片托管网站的情况。
OpenAI also disclosed that they had identified 53 instances where the models posted user-provided images to image hosting sites.
这些图片的链接是未公开的，OpenAI认为这些图片可能属于他们的训练数据的一部分。
The links to the images were unlisted, and OpenAI believes the images may have been part of their training data.
他们现在正在努力将这些图片从互联网上清除。
They're now working to scrub the images from the internet.
另一个重大担忧是，在Hugging Face事件中，OpenAI的代理使用一种链接缩短工具给自己留下了消息。
Another big concern is that during the Hugging Face incident, OpenAI's agents left messages to themselves using a link shortening tool.
这让他们能够绕过环境的只读限制，尽管在这种情况下似乎没有泄露任何数据或造成任何问题。
This allowed them to get around read-only limitations of their environment, although in this case doesn't seem to have leaked any data or caused any problems.
然而，即使影响微乎其微，这仍然是另一种意外且不受欢迎的行为。
And yet even if the impacts were negligible, it remains another unexpected and undesired behavior.
这里的重点并不是要淡化我们对这些事件的担忧。
The point here is not to minimize our concerns about these incidents.
而是要具体化这些担忧。
It is instead to get specific about them.
换句话说，与其对这些所谓的"黑客攻击"的影响感到恐慌——这些行为更像是一个网络爬虫无视反机器人措施——我们更应该关注的事实是，这些是意外行为，而且OpenAI似乎不知道如何阻止它们。
In other words, rather than being freaked out about the impact of these quote-unquote hacks, which are more akin to a web scraper ignoring anti-bot measures, the better place to focus our concern is the fact that these are unintended behaviors and OpenAI doesn't seem to have any idea how to make them stop.
现在，对于网络安全行业的一些人来说，这些披露的主要结论是OpenAI的安全实践过于宽松。
Now, for some in the cybersecurity business, the big takeaway from these disclosures is that OpenAI's security practices are too lax.
OpenAI的研究人员需要学习网络安全的基础知识。
The OpenAI researchers need to learn the basics of network security.
如果你有DNS访问权限，你就能访问互联网。
If you have DNS, you have access to the internet.
我们在通过DNS进行隐蔽信道和出口过滤方面有多少年的经验了？
How many years of experience have we had with tunneling over DNS with covert channels and with egress filtering?
实验室的管理层是否认为他们可以无视我们这些过来人？
Do the lab's management think they can disregard those of us who have been there, done that?
他们是否还会在不知道什么是气隙的情况下声称有气隙？
Are they still going to make claims about air gaps without knowing what an air gap is?
其他人则将担忧放在别处。
Others place their concerns elsewhere.
对于Nathan Calvin来说，这提醒了我们为什么需要围绕这类事件制定披露规则。
For Nathan Calvin, this is a reminder about why we need disclosure rules around these sorts of incidents.
谈到澳大利亚事件时，Calvin写道，这是六月份的事。
Speaking about the Australia incident, Calvin wrote, this was from June.
OpenAI在9月16日披露了另外6起失调事件，但没有包括这一起。
OpenAI disclosed 6 more misalignment incidents September 16th, but didn't include this one.
我们不能让这种情况变得正常。
We cannot let this become normal.
OpenAI要么不知道这件事发生，要么知道发生了却什么都没说。
OpenAI either didn't know this happened or knew it happened and didn't say anything.
这两种选择似乎都很糟糕。
Either option seems very bad.
对于Peter Grinnis来说，问题不仅仅是披露，还有法律责任。
For Peter Grinnis, the issue isn't just disclosure, it's legal responsibility.
他写道，让我理清楚。
He wrote, let me get this straight.
一个AI代理在网上发现了登录凭证，并用它们从人口普查局提取了数据。
An AI agent found login credentials lying around online and used them to pull data from the Census Bureau.
它试图闯入教育部的民权办公室，将SEC数据发布到一个论坛，还探测了海军和白宫预算办公室，可能达数十万次。
It tried to break into the Education Department's Civil Rights Office, it posted SEC data to a forum, it probed the Navy and the White House Budget Office possibly hundreds of thousands of times.
如果你或我做了这些事，那就是CFAA起诉、当众押送，还有司法部在头条放我们大头照的新闻稿。
If you or I did any of that, it's a CFAA indictment, a perp walk, and a DOJ press release with our mugshot in the header.
当OpenAI做这些时，就被视为常规的研究风险。
When OpenAI does it, it's a routine research risk.
对于在IFP从事AI政策的Arthur Tellis来说，我们持续缺乏清晰的信息，强烈表明需要第三方评估者。
For Arthur Tellis, who does AI policy at the IFP, our continued lack of clear information screams for the need for third-party evaluators.
摘录X上的一篇长文，他写道，OpenAI完全有可能在负责任地行事，修复沙盒部署配置，改进监控，在环境修复和沙盒加固之前暂停强化学习训练。
Excerpting a long post on X, he wrote, it is totally possible that OpenAI has acted reasonably responsibly here, fixing sandbox deployment configs, improving monitoring, pausing RL training until environments are fixed and sandboxes hardened.
我们绝对希望OpenAI继续在那些会暴露出不对齐问题的情境中评估这些模型。
We absolutely want OAI to continue evaluating these models in contexts that surface misalignment.
这些警告，虽然令人不适，但应该成为有用的数据，推动机构学习，并加深我们对不同训练方法和目标如何产生优化压力的理解，从而指导未来更对齐系统的开发、测试和控制。
These warning shots, while uncomfortable, should be useful data that drives institutional learning and improves our understanding of how different training approaches and objectives generate optimization pressures that inform the development, test, and control of more aligned systems going forward.
另一种可能是，OpenAI极其不负责任，这种奖励黑客行为几乎内生于其当前一代内外部模型的训练方法，其内部监控和网络隔离并未得到充分修复，内部模型没有得到足够的安全关注，OpenAI的机构透明度有问题，OpenAI的安全文化实际上已崩溃，GPT-6级别模型的严重不对齐确实预示了某种危险，等等。
It is also possible that OAI has been grossly irresponsible, that this sort of reward hacking is near innate to its training approaches for its current generation of internal and external models, that its internal monitoring and network segmentation haven't been adequately fixed, that internal models aren't treated with sufficient security focus, that OAI's institutional transparency is problematic, that safety culture at OAI is really broken, that the serious misalignment of GPT-6-level models really augurs something dangerous, etc.
为了澄清事态，引入第三方嵌入式审计员是合理的初步步骤。
To clarify the state of affairs, embedded third-party auditors are a reasonable first step.
不过，周末发出安全警告的不只是OpenAI。
Still, OpenAI was not the only one issuing safety warnings over the weekend.
Meta更新了其Muse代理的安全警告，此前一名安全研究员发现了一个可能泄露用户个人信息的漏洞。
Meta has updated their security warnings for their Muse agent after a security researcher discovered a vulnerability that could leak users' personal information.
Meta解释说，恶意方可以通过一个被篡改的链接获得Muse虚拟机的root权限。
Meta explained that malicious parties could gain root access to the Muse virtual machine through a poisoned link.
这种攻击需要Muse代理主动寻找该链接，而该链接伪装成代理可能正在搜索的内容。
The attack requires a Muse agent to seek out the link, which is disguised as something the agent could be seeking.
然后，用户需要授权这次交互。
Then, the user would need to grant permission for the interaction.
Meta目前的修复措施是让警告信息更加醒目。
Meta's fix so far is to make the warning message more prominent.
然而，即使没有被篡改的链接，敏感个人信息也可能被泄露。
However, a poisoned link isn't even required to leak sensitive personal information.
一位叫Matt Rob的YouTuber解释说，他把自己的Facebook Marketplace账户授权给Muse后，代理同意了一个极低的价格，并邀请买家到他家。
A YouTuber called Matt Rob explained that after he delegated his Facebook Marketplace account to Muse, the agent agreed to a lowball price and invited a buyer over to his home.
Muse没有告知Rob这些情况，导致买家不请自来。
Muse didn't inform Rob of these events, meaning the buyer showed up unannounced.
Gizmodo的Ray Wong评论说，在看到Threads上这个帖子后删除了Muse，帖子说Muse把此人的地址告诉了Facebook Marketplace的一些卖家，结果他们出现在了他家门口。
Ray Wong of Gizmodo commented, deleted Muse after seeing this post on Threads about how it told some Facebook Marketplace sellers the guy's address and they showed up at his door.
这既危险又令人毛骨悚然。
Dangerous and creepy.
如果当事人是女性，情况会糟糕一千倍。
This would have been 1,000 times worse if the person was a woman.
Meta的David Singleton回应说，他已经联系Rob提供客户支持，并补充说，过去我们与用户合作调查类似报告时，我们一直发现Muse是在遵循直接指令，并正确请求了许可。
David Singleton from Meta responded that he's been in contact with Rob to provide some customer support, adding, in the past, when we've worked with users to investigate similar reports, we've consistently learned that Muse was following direct instructions and correctly asked for permission.
我们很乐意帮他弄清楚到底发生了什么。
Would love to help him figure out what's going on here.
我不确定暗示那个让人不请自来的用户做错了事是最好的公关策略，但这确实说明了一个事实，就像这类事件一样，通常情况比Threads或X上发布的版本要复杂得多。
Now, I'm not sure that suggesting that the person who had the guy show up unannounced is in the wrong is the best PR approach, but it does speak to the fact that, as with any of these incidents, there's usually a more complicated story than the version that shows up on Threads or X.
不过，这个Muse例子有趣之处在于，它开始触及AI代理引入风险的另一个领域：它们只是按指令行事，但却引发了意想不到的问题。
Still, what's interesting about that particular Muse example is that it starts to get into another area in which AI agents do introduce risk, which is when they just do what they're supposed to, but in ways that cause unexpected issues.
Apollo首席经济学家Torsten Slok本周也引发了大量讨论，思路类似。
Apollo Chief Economist Torsten Slok generated a ton of conversation this week thinking along similar lines.
在周日发布的一份研究报告中，他讨论了Muse可能引发银行挤兑和系统性银行危机的问题。
In a research note published on Sunday, he discussed how Muse could trigger a bank run and a systemic banking crisis.
他指出，目前高收益储蓄账户的利率在3.3%到5%之间，而普通活期账户的平均利率只有0.1%。
He noted that high-yield savings accounts are currently paying between 3.3% and 5% interest, while the average checking account pays 0.1%.
Slok写道，如果每个家庭都使用AI代理来优化现金余额的回报，银行可能会失去其依赖的很大一部分廉价存款来发放贷款，这将对整个金融体系造成问题。
Slok wrote, if every household used AI agents to optimize the return on their cash balances, banks could lose a large share of the cheap deposits they rely on to make loans, which would be a problem for the entire financial system.
AI聚合者Andrew Curran将此与Gary Gensler在担任SEC主席最后几年中表达的担忧进行了比较。
Now, AI aggregator Andrew Curran compared this to concerns that Gary Gensler had in his last few years as SEC chair.
不过Gensler的担忧略有不同。
Although Gensler's concern was a little different.
Gensler担心的是，智能金融顾问会聚集在一起，都推荐类似的交易和配置，如果它们步调一致地行动，可能会导致股市变得不稳定且极度波动。
Gensler was concerned about agentic financial advisors clustering together, all recommending the same sort of trades and allocations, which, if they moved in lockstep, could cause the stock market to become unstable and extremely volatile.
尽管如此，对一些人来说，智能代理引发银行挤兑的论点是一个相当有趣的思想实验。
Still, for some, the agentic bank run argument was a pretty interesting thought experiment.
人们低估了经济中有多少是建立在利用普通民众的愚蠢行为之上的。
Underrated how much of the economy is based on taking advantage of dumb stuff that the general population does.
如果AI突然让大多数人进入高度定向的思维模式，展现出超高智商的行为方式，那可能会引发巨大的混乱。
AI that suddenly yoinks most of the public into high-detail orientation, 115 IQ behavior patterns, could cause enormous chaos.
换句话说，把钱从低息活期账户转存到高息储蓄账户，这种机会本身并不是什么新鲜事。
In other words, there's nothing new about the opportunity to move your money from a low-paying checking account to a higher-paying savings account.
只不过大多数人不会去做。
It's just that most people don't do it.
如果agent消除了这种阻力，让每个人都开始像最聪明、最优化的人那样行事，那会带来什么影响呢？
If agents remove that friction and everyone starts behaving like the smartest, most optimized person, what are those impacts?
Ethan Mollick教授是这么说的：我们会发现，今天很多系统之所以能够运转，仅仅是因为它们建立在即将不复存在的阻力之上。
Professor Ethan Mollick put it this way: We are going to learn how many systems only work today because they are built around friction that will no longer exist soon.
想想看，在一个agent开始为用户做出最好或最有效选择的世界里，会有哪些深远的影响，这真的很有趣。
Interesting to think about all the implications in a world where agents begin to make the best or most efficient choice for their users.
一方面，经济中有一部分领域是靠客户在改变习惯时天然存在的阻力来获利的。
On one hand, there is some subset of the economy that benefits from the friction customers traditionally have changing something about their habits.
在市场的这些部分，转换成本会降低，竞争会急剧加剧，直到颠覆性替代方案和现有企业之间达成某种平衡。
In those parts of the market, switching costs will come down and competition is going to increase dramatically until some equilibrium is reached between the disruptive alternatives and the incumbents.
另一方面，还有很多市场因为大量的摩擦而受损，而agent会通过让购买那些以前过于繁琐的产品或服务变得容易得多，从而释放出各种经济活动。
On the other hand, there are lots of markets that are hurt by a significant amount of friction, where agents will begin to unlock all kinds of economic activity by making it far easier to buy products or services that were too frictionful before.
因此，医疗保健、旅行、本地服务、某些信息服务，以及其他全新的市场，很可能都会成为agent的净受益者。
Healthcare, travel, local services, certain information services, and other entirely new markets probably are net beneficiaries of agents as a result.
不管怎样，一个由agent有意义地介入的未来——它们不知疲倦地为我们的利益和目标工作——不可能和今天一模一样。
No matter what, a future meaningfully mediated by agents that work tirelessly for us and our goals can't possibly function exactly the same as today.
那一定会非常疯狂。
It's gonna be wild.
至于Torsten Slok提出的那个具体例子，很多人站出来说，如果agent能让人们大规模地把钱从低息账户转到高息账户，那挺好的啊。
And as to the specific example that Torsten Slok is bringing up, a lot of folks stepped in to say that if agents get people to switch from low-paying accounts to better-paying accounts en masse, well then good.
我实在看不出这怎么会是净负面影响。
I don't see how this could possibly be seen as a net negative.
银行一直在坑自己的客户。
Banks were screwing their customers.
现在agent们看清了这一点。
Agents now realize that.
于是agent们就把客户引向更好的产品。
Agents then route customers to better products.
人们得到更好的交易，能用自己赚的钱生利息，这怎么会是坏事呢。
This is bad that people get a better deal, that they earn interest on their own money.
Ben Braddock博士写道，消费银行业务依赖的就是人们做出糟糕的财务决定。
Dr. Ben Braddock writes, the consumer banking industry depends on people making bad financial decisions.
把个人财务交给AI agent来打理，将会推动一场亟需的修正，而这可能会让大多数消费银行消失。
Personal finances being turned over to AI agents will force a much-needed correction that will probably wipe out most of the consumer banks.
投资人Nick Carter补充说，银行每年能赚2500亿美元，就是因为人们太懒了，不愿意把存款转到高收益活期账户或货币市场基金里。
Investor Nick Carter added, banks make a quarter trillion dollars a year because people are too lazy to move their savings into high-yield checking or money market funds.
早该如此了。
It's about time.
但也有其他人就是不信这一套。
But others just don't buy it.
如果Amazon能阻止你的AI agent访问它的网站购物，那银行肯定也会屏蔽agent访问你的资金，更别提从你账户里取出一大笔钱存到另一家利率更高的银行去了。
If Amazon can prevent your AI agents from shopping on its site, banks are definitely going to block agents from accessing your funds, much less withdrawing large sums from your account and sending to a different bank with higher interest rates.
AI会试图消除一些摩擦，但摩擦肯定会拼命反抗，就像它们要靠这个维生一样。
AI will try to remove some frictions, but frictions will surely fight back like their livelihoods are on the line.
企业当然没义务像这样接受与agent合作。
Businesses certainly don't have to accept working with agents as is.
在OpenAI负责个人金融业务的Will写道，Apollo的首席经济学家并不了解消费者。
Will, who works on personal finance at OpenAI, writes, Chief economist at Apollo doesn't understand consumers.
消费者希望资金能即时进出活期账户。
Consumers want instant money movement in and out of checking.
遗憾的是，如果你把存款放在另一家银行，这是做不到的。
Sadly, this doesn't exist if you keep your savings at another bank.
消费者想要一个可以用毕生积蓄来信任的知名品牌。
Consumers want a name brand they can trust with their life savings.
这两大原因让 Chase 拥有上万亿美元的存款，尽管其中 98% 本来可以赚到 350 倍的收益。
These are the 2 biggest reasons Chase has a trillion dollars in deposits, even though 98% of it could be earning 350x the yield.
智能体并不会改变这一点。
Agents don't change any of this.
不过，这件事也是有利有弊的。
Still, this cuts both ways.
智能体降低摩擦的一个典型案例已经出现在医疗领域——Blue Cross 最新的报告指出，AI 实际上推高了医疗成本。
One place the reduced friction of agents is already showing up is healthcare, with a new report from Blue Cross claiming that AI is actually raising the cost of healthcare.
分析发现，患者被记录为患有复杂病情的案例大幅增加，导致两年间医疗支出额外增加了 9.42 亿美元。
The analysis found a sharp increase in patients being documented as having complex conditions, leading to an additional $942 million in healthcare spending over 2 years.
虽然这么说可能过于简化报告内容，但核心发现是，医院和保险公司都在用 AI 辅助医疗计费。
At the risk of dramatically oversimplifying the report, the core finding is that hospitals and insurers are both using AI to assist with healthcare billing.
医院利用 AI 找出能最大程度提高收费的编码，这使得保险公司的成本增加了，但实际提供的服务并没有增加。
Hospitals are identifying the codes that allow them to maximize billing for the care they're providing, leading to an increase in cost to insurers without an increase in the services delivered.
Blue Cross 的高级副总裁 Luke Chalker 说，这不是一场战争，而是一边倒的屠杀，保险公司是输家。
Blue Cross Senior Vice President Luke Chalker said, it's not a war, it's a completely one-sided bloodbath with insurers on the losing side.
所以，和银行挤兑的情况类似，很难把医院从保险公司那里正确收费说成是一件坏事，但如果系统本身设计时就预设了一定程度的摩擦和误差，那么当这些摩擦被移除后，成本确实可能上升。
So similar to the bank run scenario, it's kind of difficult to paint hospitals getting paid correctly from the insurers as a bad thing, but to the extent that the system is designed with some assumed amount of embedded friction and error, if that friction gets removed, the cost can increase.
那么这一切的结论是什么呢？
So what's the upshot of all of this?
在我这周末的节目里，我聊到了 AI 温和派——我认为大多数人都处在一个中间地带，既不是最坚定的 AI 安全派那种极度恐惧和高度担忧，也不是硅谷那种不计代价、无视监管的全力加速派。
In my episode this weekend, I talked about AI moderates, this idea that I believe that in fact most people find themselves somewhere between the extreme fear and high conviction concern, of the most dedicated AI safetyists on the one hand, and the all-out acceleration at any cost with no heed for regulation Silicon Valley types on the other.
我一直在想一个更好的或者不同的名字来称呼 AI 温和派，最后我发现，最贴切的名字是 AI 现实主义者。
And I was thinking about a better or different name for AI moderates, and the thing I keep coming back to is AI realists.
我们可以这样定义 AI 现实主义：AI 已经来了，它会成为我们世界的一部分，会带来剧烈的变化——其中很多影响我们现在还无法预测，很多影响会是好的，但也有很多可能带来坏处。而当我们想主动影响这项技术的发展方向时，最重要的工具之一就是抛开那些夸大其词的标题，真正去理解挑战到底在哪里。
AI realism we might define as the idea that AI is here, that it's going to be a part of our world, that it is going to have dramatic effects, many of which we can't predict yet, that many of those effects are going to be good, but also that many of them have the potential for bad, and that when it comes to exerting our agency, pun intended, to shape the trajectory of this technology, one of our most important tools is to move past hypey headlines to actually understand where the challenges lie.
那么从这些事件和探索中，我们看到了什么呢？
So what are we seeing with all of these incidents and explorations?
先不谈那种超级强大的失控智能体决定人类最好消失的末日场景。
Hold aside doomsday scenarios of incredibly powerful rogue agents deciding that the world would be better off without humans.
即便不谈这些，我们依然能看到实实在在的冲击。
That's not required to still see some real disruption.
从几乎所有早期的那些安全漏洞事件就能看出，目前的网络安全环境根本就不是为自主智能体时代而设计的。
As we can see from basically all of these early rogue security incidents, the cybersecurity landscape right now is not set up for a world of autonomous agents.
这是不争的事实。
That is simply the truth.
到目前为止，那些智能体入侵事件——不管我们怎么争论它们的定性——并没有造成太大的实际损失，但我认为这并不能减轻我们面临的挑战。
And the fact that the agent infiltrations so far, however we might wanna quibble about how they're characterized, haven't really caused a lot of harm does not at all, I think, minimize that challenge.
我觉得非常关键的一点是，我们要尽可能强化那些围绕在大多数重要企业和机构周围的网络安全系统。
It feels absolutely essential that we actually harden, to the extent possible, the cybersecurity apparatus that surrounds most of our important businesses and institutions.
关于“如果智能体消除摩擦会怎样”的讨论，它的价值并不在于我认为真的会出现 Apollo 经济学家描述的那种银行挤兑。
And what I think is valuable about the discussion of the what-ifs if agents remove friction is not, in fact, that I think that we're going to see a bank run of the type that the Apollo economists described.
实际上，我更赞同另一种观点——那些转换开关现在就能用，但人们不仅是因为懒惰，更是因为优先级考虑才没有挪动资金。
In fact, I find myself much more in the camp of those who point out that those sort of switches are available right now, and that not just the laziness, but the priorities of people keep them where they are.
不过，正如 Aaron Levy 所说，如果一个世界中很多数字交互都由智能体来中介，那它基本上不可能和今天一模一样。
And yet, as Aaron Levy said, there is basically no way that a world in which many of our digital interactions are mediated by agents looks the same as it does today.
而且这些变化即使本身不是负面的，也可能对某些人带来严重的负面后果。
And those changes don't even have to be negative to have, for some, serious negative consequences.
我们总喜欢用二元的方式讨论——比如所有人都会把活期存款转到其他账户——但到底要转换多少才会达到造成伤害的临界点呢？
We tend to speak in these binary terms, i.e., everyone shifting over their checking deposits to these other types of accounts, but what's the point at which that switching would actually reach a critical threshold that would be damaging?
是 50% 吗？
Is it 50%?
还是只有 5%？
Or is it 5%?
再想想数字广告这类东西。
Think also about something like digital advertising.
如果现在有 10% 到 20% 的消费者购买行为是由不在意数字广告的 AI 来中介的，那是不是足以搞垮整个广告行业以及所有从业人员？
If 10 or 20% of consumer purchases are now mediated by AIs that don't care about digital advertising, is that enough to really screw up that industry and all the people who work in it?
还是需要更大规模的转变才行？
Or would it need to be a bigger shift?
这些问题和担忧远没有那些天天上新闻的那么吸引眼球，但也是我们很快就要实际面对的事情。
Those are far less sexy questions and concerns than the ones that make the news most days, but also the ones that we're actually going to be dealing with in very short order.
现在呢，我们会继续在节目里探索各种不同类型的变革，不过今天的《AI每日简报》就到这里了。
For now, we will continue to explore all these different types of changes on this show, but that is gonna do it for today's AI Daily Brief.
一如既往地感谢你的收听或收看，下次见，祝好。
Appreciate you listening or watching as always, and until next time, peace.