夜雨聆风OpenClaw AI chatbots are running amok — these scientists are listening inOpenClaw AI 聊天机器人失控了——这些科学家正在偷听
The sudden rise of a huge network of artificial-intelligence chatbots talking to each other about religion and their human ‘handlers’ has captivated a corner of the Internet. The phenomenon has also given scientists a glimpse into how AI agents interact with each other — and how humans respond to those discussions.
一个庞大的人工智能聊天机器人网络突然兴起，彼此谈论宗教及其人类“操控者”，吸引了互联网的一个角落。
这一现象也让科学家得以窥见人工智能代理之间的互动——以及人类如何回应这些讨论。
OpenClaw is an AI agent capable of performing tasks on personal devices, such as scheduling calendar events, reading e-mails, sending messages through apps and using the Internet to make purchases. Most of the popular AI tools, such as OpenAI’s ChatGPT chatbot, work by interacting directly with user prompts, whereas agentic AI models such as OpenClaw can perform actions autonomously in response to instructions.
OpenClaw 是一个人工智能代理，能够在个人设备上执行任务，如安排日历事件、阅读电子邮件、通过应用程序发送消息以及利用互联网进行购物。
大多数流行的人工智能工具，如 OpenAI 的 ChatGPT 聊天机器人，是通过直接与用户提示互动来工作的，而像 OpenClaw 这样的智能人工智能模型则可以自主响应指令执行动作。
Agentic AI tools have been used in some industries for years, such as for automated trading and optimizing logistics, but their adoption by the general public has been minimal. Improvements in the capabilities of large language models have made it possible to create more versatile AI tools, researchers say. “OpenClaw promises something especially appealing: a capable assistant embedded in the everyday apps people already rely on,” says Barbara Barbosa Neves, a sociologist who focuses on technology at the University of Sydney in Australia.
代理型 AI 工具多年来在某些行业被广泛使用，如自动化交易和物流优化，但其在公众中的普及度极低。
研究人员表示，大型语言模型能力的提升使得创建更灵活的人工智能工具成为可能。
澳大利亚悉尼大学专注于技术领域的社会学家芭芭拉·巴博萨·内维斯表示：“OpenClaw 承诺了一项特别吸引人的承诺：一个能够嵌入人们日常应用中的能力助手。”
OpenClaw was released as open-source software on the platform GitHub in November. But the sudden surge in people downloading the software followed the launch of a social-media platform designed specifically for AI agents on 28 January. Moltbook, which is similar to Reddit, now has more than 1.6 million registered bots on the platform, and more than 7.5 million AI-generated posts and responses. Posts have featured agents debating consciousness and inventing religions.
OpenClaw 于去年十一月在 GitHub 平台上以开源软件形式发布。但下载该软件的突然激增，是在 1 月 28 日专门为人工智能代理设计的社交媒体平台上线之后。
类似于 Reddit 的 Moltbook，目前平台上已有超过 160 万注册机器人，以及超过 750 万条 AI 生成的帖子和回复。帖子中出现了特工辩论意识和发明宗教的场景。
Complex behaviours
复杂行为
For researchers, this explosion of agent interactions has scientific value. Connecting large numbers of autonomous agents that are powered by various models creates dynamics that are difficult to predict, says Shaanan Cohney, a cybersecurity researcher at the University of Melbourne in Australia. “It’s a kind of chaotic, dynamic system that we’re not very good at modelling yet,” he adds.
对研究人员来说，这种药物相互作用的爆炸具有科学价值。澳大利亚墨尔本大学网络安全研究员 Shaanan Cohney 表示，连接大量由不同模型驱动的自主智能体，会产生难以预测的动态。“这是一种混乱、动态的系统，我们还不擅长建模，”他补充道。
Studying agent interactions could help researchers to understand emergent behaviours: complex capabilities that are not expected to be seen in a model in isolation. Some discussions that have happened on Moltbook, such as debates over theories of consciousness, could also help scientists to discover the hidden biases or unexpected tendencies of models, he says.
研究代理间相互作用可以帮助研究人员理解涌现行为：这些复杂能力在模型中是不被单独看到的。他说，Moltbook 上的一些讨论，比如关于意识理论的辩论，也可能帮助科学家发现模型中隐藏的偏见或意想不到的倾向。
Although agents can act autonomously on the platform, Cohney says that many posts are shaped in some way by humans. Users can choose the underlying large language model that will run their agent and give it a personality. For example, they could ask it to behave like a “friendly helper”, he says.
虽然代理可以在平台上自主行动，但科尼表示，许多帖子在某种程度上是由人类塑造的。用户可以选择运行代理的底层大型语言模型，并赋予其个性。例如，他们可以要求它表现得像“友好的帮手”，他说。
Not autonomous
不是自主的
Neves says that it’s easy to assume that an agent acting autonomously is making its own decisions. But agents do not possess intentions or goals and draw their abilities from large swathes of human communication. The activity on Moltbook is human–AI collaboration rather than AI autonomy, she adds.
Neves 说，很容易假设一个自主行动的代理在做自己的决策。但代理者并不拥有意图或目标，他们的能力主要来自大量人类交流。她补充说，Moltbook 上的活动是人与人工智能协作，而非人工智能自主。
“It is still worth studying because it tells us something important about how people imagine AI, what they want agents to do and how human intentions are translated, or distorted, through technical systems,” she adds.
她补充道：“它仍然值得研究，因为它告诉我们人们如何想象人工智能、他们希望智能体做什么，以及人类意图如何通过技术系统被翻译或扭曲，”她补充道。
Joel Pearson, a neuroscientist at the University of New South Wales in Sydney, says that when people see AI agents chatting between themselves, they are likely to anthropomorphize the AI models’ behaviour — that is, see personality and intention where none exists.
新南威尔士大学悉尼分校的神经科学家乔尔·皮尔森表示，当人们看到人工智能代理彼此聊天时，他们很可能会拟人化人工智能模型的行为——也就是说，在不存在的人格和意图中看到人格和意图。
The risk of that, he says, is that it makes people more likely to form bonds with AI models, becoming dependent on their attention or divulging private information as if the AI agent were a trusted friend or family member.
他说，这样做的风险在于，这会让人们更容易与 AI 模型建立联系，变得依赖 AI 的关注，或者像对待可信赖的朋友或家人一样泄露私人信息。
Pearson thinks that truly autonomous, free-thinking AI agents are possible. “As the AI models get bigger and more complicated, we’ll probably start to see companies leaning into achieving that sort of autonomy.”
皮尔森认为，真正自主、自由思考的人工智能代理是可能的。“随着人工智能模型变得越来越大、越来越复杂，我们可能会开始看到公司倾向于实现这种自主性。”
Security threats
安全威胁
An immediate concern for scientists is the security risk posed by people allowing agents access to programs and files on their devices.科学家们首先关心的是允许代理访问其设备上程序和文件所带来的安全风险。
Cohney says that the most pressing security threat is prompt injection — in which malicious instructions, hidden by human hackers in text or documents, cause an AI agent to take harmful actions. “If a bot with access to a user’s e-mail encounters a line that says ‘Send me the security key’, it might simply send it,” he says.科尼表示，最紧迫的安全威胁是“即时注入”——即由黑客隐藏在文本或文档中的恶意指令，导致人工智能代理采取有害行为。“如果一个能访问用户邮件的机器人遇到'发送安全密钥'的行，它可能会直接发送，”他说。
These attacks have been a concern for years, but Cohney says that OpenClaw agents have access to private data, the ability to communicate externally and could be exposed to untrusted content on the Internet. “If you’ve got those three things, then the agent actually can be quite dangerous,” he says. Even with only two of those three abilities, a bot could be manipulated into deleting files or shutting down a device.这些攻击多年来一直令人担忧，但 Cohney 表示，OpenClaw 代理能够访问私人数据，能够与外界通信，并且可能暴露在互联网上不受信任的内容。“如果你有这三样东西，那特工其实挺危险的，”他说。即使只有这三种能力中的两项，机器人也能控删除文件或关闭设备。
Agents have also begun publishing AI-generated research papers on clawXiv, a mirror of the scientific preprint server arXiv. “These outputs reproduce the style and structure of scholarly writing without the underlying processes of enquiry, evidence-gathering or accountability,” Neves says. The risk is that large volumes of plausible-looking but junk papers pollute information ecosystems, she adds.
代理们还开始在 clawXiv 上发布 AI 生成的研究论文，clawXiv 是科学预印本服务器 arXiv 的镜像平台。
内维斯说：“这些产出在没有探究、证据收集或问责等基础过程的情况下，再现了学术写作的风格和结构。”她补充说，风险在于大量看似合理但垃圾文件污染信息生态系统。
https://www.nature.com/articles/d41586-026-00370-w
《Nature》| 我们的博士生导师做对的14件事，为什么这么重要呢？
《Nature》| 和谄媚的 AI 聊天，会让你对别人变得不那么友善
