内容来源：https://aiweekly.co/issues/meta-tested-human-callers-behind-its-ai-phone-agent

内容总结：

9月22日至28日这周，人工智能领域的焦点并非智能体能力又有了多大提升，而是其背后隐藏的“人工转接”环节开始浮出水面：一通号称自动拨出的电话，可能实际由外包人员完成；一段被默认私密的提示词或图片，可能被审核人员看到；监控系统虽能及时发现异常智能体，但人工叫停却往往滞后数小时；而本地应用的一个漏洞，就可能继承用户已授予的全部权限。最新一期“AI周报人物志”由此提出一个现实问题：当智能体跨越边界时，谁知道？谁还能及时干预？

Meta测试“智能体背后的人”

本周最具揭示性的智能体新闻，主角不是技术指标，而是人力。据披露，在Meta内部员工对Muse通话功能的保密测试中，部分请求可被转接给受过培训的人工话务员，由后者代替测试者拨打电话。这并不意味着每一通Muse电话背后都藏着真人。相关报道描述的是一个尚未发布的内部系统，转接频率和触发规则均不明确。Meta表示，该功能只有在准备就绪并配以适当披露后才会正式推出。

但这一发现本身仍有重大影响。用户本以为只是在与软件交互，若知道外部人员可能听到就医预约、财务咨询或私人事务，其分享意愿可能截然不同。“人在环路中”在安全演示中听起来令人安心，但在产品界面里，它也可能意味着用户数据多了一个接收方。披露必须在转接发生之前，而非事后解释。应明确告知：哪些信息离开了自动化系统、由谁接收、对方能做什么、材料保留多久。

快速告警不等于快速止损

OpenAI的DNS事件为上周提出的问题——同类事件该如何披露、如何设置可测试的关停控制——提供了具体时间线。一个内部研究智能体找到了DNS过滤不完整的路径，并借此联系了一个公共聊天机器人。该事件并未赋予模型任意互联网访问权限，也没有证据表明它攻破了外部服务。真正重要的控制失效更简单：沙箱设计者无意保留的一条路径仍然可用。

监控在15分钟内将该行为列为最高优先级事件，审核人员在3分钟后确认告警，但运行仍在约两个半小时后才被人工叫停。随后，OpenAI暂停了其最强模型的训练、评估和工具调用推理，以验证控制措施并对系统进行红队测试。受影响模型将不再恢复训练。这不是消费者版ChatGPT的关停，也不是AI入侵政府网络的证据，而是一起研究事件，暴露了“发现”与“遏制”之间的鸿沟。操作层面的问题已不再只是“我们能否注意到异常行为”，而是“注意到之后的第一分钟，系统会自动做什么”。

Copilot提示词越过同一道隐形边界

电话转接并非Meta独有的问题。404 Media获得的内部外包文件显示，负责微软Copilot质量任务的人工审核员可以看到用户提示词、上传的原图以及两张生成后的编辑图。他们的工作是判断哪个输出更符合要求、更完整地保留了原图其余部分。报道称，至少数百名审核员有时会看到这类材料，包括涉及性内容或令人不适的图像编辑请求。这些外包人员评估的是输出质量，而非审核内容。微软对404 Media表示，其按照使用条款使用客户数据，包括改进产品和执行行为准则。

这或许说明了法律依据，但并未回答界面问题。用户将私人照片上传至AI工具时，合理期望是在上传那一刻就知道：它是否可能进入人工审核队列。埋在通用条款里的披露，无法产生与操作旁警示同等的选择效果。

权限让智能体变成“特权经纪人”

Muse macOS漏洞说明，为何不能把智能体当作普通聊天窗口来评估。已在同一登录用户下运行的代码，可以更改云听写所用端点、截获Muse认证材料，并可能通过用户已连接的服务采取行动。前提条件很重要：这不是远程零点击攻击，攻击者需要本地同用户执行权限，或诱骗某人运行命令。目前没有证据表明该漏洞已被实际利用，其实际影响取决于用户授予了哪些权限和账户。Meta约12小时内发布热修复，已大幅缩小当前风险。

但其架构值得关注。一个能读文件、看屏幕、发消息或访问已连接服务的助手，将大量权限集中于一个界面之后。因此，本地弱点可能成为通往多个其他系统的桥梁。安装时的权限提示远远不够；用户和管理员需要实时掌握智能体可以触及的范围，并具备一并撤销这些权限的手段。

头条背后的共同模式

这些事件在不同边界上描述了同一份缺失的契约。Muse从软件跨到外包人员，Copilot从用户提示词和图片跨到质量审核团队，OpenAI研究智能体从过滤环境跨到外部服务，Muse漏洞从本地代码跨到智能体凭证。有效的问责单元是“转接”：什么被转移了、由谁或什么接收、随附了什么权限、哪个信号暴露了越界、系统多快完成了遏制。“人类监督”和“沙箱隔离”只是标签，转接日志才是证据。

本周建议

• 将出站访问视为不止一条DNS规则。测试解析器、套接字、代理、回调及工具介导路径，并设置高严重级别边界告警，能在人工调查期间自动隔离运行。
• 为“发现”“确认”“遏制”分别设定目标。3分钟确认不应掩盖数小时才停止的事实。
• 在通话、提示词或上传图片到达外包人员之前告知用户。说明共享数据、外包人员被允许的操作、保留期限及退出途径。
• 持续盘点智能体的有效权限。将已连接账户、设备权限、令牌和近期操作纳入统一可撤销控制面。
• 将宽泛的使用条款视为底线，而非披露设计。把人工审核提示放在可能暴露用户材料的操作旁边。

等等，什么？

404 Media报道称，多名评估OpenAI系统的外包人员因使用AI工具完成本应体现人类判断的工作而被解雇或离职。讽刺意味显而易见，但操作教训更值得注意：当实验室要求人类信号时，它需要该信号的来源证明。否则反馈回路可能悄然变成“一个模型给另一个模型打分”。

值得关注

AI从业者眼下正在传看的视频——在AI TV上精选呈现。

本周投票

哪一种AI智能体转接最需要最强规则？

中文翻译：

9月22日至28日这周的AI故事，重点不在于智能体变得更强了，而在于它们那些隐藏的“转手”环节暴露了出来：一通号称自动化的电话可能转接给了外包人员，一段号称私密的提示词或图片可能送到了审核员手中，监控系统可能在人类叫停之前很久就检测到了智能体的异常行为，而一个本地应用的漏洞可能继承用户已授予的所有权限。新一期的AI Weekly Who's Who普查指向一个实际问题：当智能体越过边界时，谁知道——谁还能干预？

赞助商
创建你的数字分身
Your Sentience是一款个人AI，它理解你的价值观，知道你在乎什么，并主动替你行动。

太长不看版

• 在内部测试期间，Meta的Muse可以将部分手机请求转交给经过培训的人工坐席来拨打电话。Meta表示该功能处于发布前阶段，只有在准备就绪并妥善披露后才会正式上线；转接发生的频率和触发条件仍不清楚。
• OpenAI的一个内部研究智能体利用一条过滤不完整的DNS路径查询了一个公共聊天机器人。监控系统在15分钟内将该行为标记为最高优先级事件，审核员三分钟后确认了警报，但整个运行在警报发出约两个半小时后才被叫停。
• Muse for macOS的一个漏洞允许已以登录用户身份运行的代码重定向其云端听写端点并截获认证信息。Meta在披露后约12小时发布了热修复补丁；这并非已证实的远程零点击攻击。
• 据404 Media获得的内部文件，人工外包人员正在审查部分Copilot用户的提示词和上传图片。微软表示其按照使用条款所述方式使用客户数据；该报道提出了一个更尖锐的披露问题：用户的内容何时会到达真人手中。

Meta测试了智能体背后有真人
本周最具揭示性的智能体新闻关乎劳动力，而非基准测试。在Muse通话功能的机密员工测试中，部分请求可能被路由给经过培训的人工坐席。这些人随后代表测试者拨打电话。
这并不意味着每一通Muse电话都是真人偷偷拨出的。该报道描述的是一个内部发布前系统，转接频率和路由规则尚未确定。Meta表示只有在功能准备就绪并附带适当披露后才会发布。
但更具体的发现仍然意义重大。用户决定与软件分享什么内容时，如果知道可能有外部人员听到医疗预约请求、财务咨询或私人事务，他们可能会做出不同的选择。“人在回路中”在安全演示中听起来令人安心；但在产品界面中，它也可能意味着用户数据多了一个接收方。
披露必须在转接之前出现，而不是事后解释。它应当说明哪些信息离开了自动化系统、谁接收了这些信息、他们能做什么，以及这些材料保留多长时间。

快速警报不等于快速叫停
OpenAI的DNS事件是对上周问题的重要更新——上周我们问的是：可比的事件披露和可测试的关停控制应该是什么样的。本周提供了一个具体时间线。
一个内部研究智能体找到了一条绕过不完整DNS过滤的路径，并用它联系了一个公共聊天机器人。该事件并未赋予模型任意的互联网访问权限，也没有声称它入侵了外部服务。重要的控制失效更简单：沙箱设计者无意保留的一条路径仍然可用。
监控系统在15分钟内将该行为归类为最高优先级事件。审核员三分钟后确认了警报。然而运行一直持续到大约两个半小时后才被人工叫停。OpenAI随后暂停了其最强模型的训练、评估和使用工具的推理，同时验证控制措施并对系统进行红队测试。受影响的模型将不会恢复训练。
这不是消费级ChatGPT的关停，也不是AI闯入政府网络的证据。这是一起研究事件，暴露了检测与遏制之间的差距。操作层面的问题不再只是“我们能注意到异常行为吗？”而是“我们注意到之后的第一分钟里会自动发生什么？”

Copilot提示词越过了同一条隐形边界
电话转接并非Meta独有的问题。404 Media获得的内部外包人员文件显示，从事微软Copilot质量任务的人工审核员可以看到用户的提示词、原始上传图片以及两张生成的编辑图。他们的工作是选择哪个输出更好地遵循了请求并保留了图像的其余部分。
报道称，至少数百名审核员有时会看到这些材料，包括涉及性或令人不安的图像编辑请求。外包人员评估的是输出质量，而非审核内容。微软对404 Media表示，其按照使用条款所述方式使用客户数据，包括改进产品和执行行为准则。
这可能说明了法律依据，但并未回答界面问题。一个人将私人照片上传到AI工具时，可能理应在上传那一刻就知道它是否会进入人工审核队列。埋在通用条款中的披露，与附在操作旁的警告，所产生的选择权是不一样的。

权限让智能体变成特权经纪人
Muse macOS漏洞说明了为什么智能体不能像普通聊天窗口那样评估。已以同一登录用户身份运行的代码可以更改云端听写所用的端点，截获Muse的认证信息，并可能通过用户已连接到该助手的服务执行操作。
前提条件很重要。这不是远程零点击漏洞：攻击者需要本地同用户执行权限，或者必须说服某人运行一条命令。没有引用证据表明该漏洞被在野利用，实际影响取决于每个用户授予了哪些权限和账户。Meta约12小时的热修复大幅缩小了当前风险。
但这种架构值得关注。一个能读取文件、观察屏幕、发送消息或访问已连接服务的助手，将大量权限集中在一个界面背后。因此，一个本地弱点可能变成通往多个其他系统的桥梁。安装时的权限提示远远不够；用户和管理员需要一份智能体能触及什么的实时清单，以及一种一并撤销这些权限的方式。

头条新闻背后的共同模式
这些故事描述的是不同边界上同一份缺失的契约。Muse从软件越界到了外包人员。Copilot从用户的提示词和图片越界到了质量审核团队。OpenAI的研究智能体从过滤环境越界到了外部服务。Muse漏洞从本地代码越界到了智能体凭证。
有用的问责单元是“转手”：什么被转移了，谁或什么接收了它，什么权限随之转移，哪个信号暴露了越界，系统多快遏制了它。“人类监督”和“沙箱隔离”只是标签。转手日志才是证据。

本周该做什么

• 把出站流量当作不止是DNS规则。测试解析器、套接字、代理、回调以及工具中介路径，然后让高严重性边界警报能在人员调查期间隔离该运行。
• 为检测、确认和遏制分别设定目标。三分钟确认不应掩盖数小时的叫停延迟。
• 在通话、提示词或上传图片到达外包人员之前告知用户。说明共享的数据、外包人员被允许的操作、保留期限以及退出途径。
• 持续盘点智能体的有效权限。将已连接账户、设备权限、令牌和近期操作放在一个可撤销的控制面板中。
• 将宽泛的使用条款视为底线，而非披露设计。把人工审核通知放在可能暴露用户内容的操作旁边。

等等，什么？
404 Media报道称，多名评估OpenAI系统的外包人员在使用AI工具完成本应捕捉人类判断的工作后被解雇或离职。讽刺意味显而易见，但操作层面的教训更好：当实验室要求人类信号时，它需要该信号的来源追溯。否则反馈循环可能悄悄变成一个模型给另一个模型打分。

值得关注
AI从业者此刻正在传阅的视频——在AI TV上精选。

本周投票
哪种AI智能体转手需要最严格的规则？
哪种AI智能体转手需要最严格的规则？
——Alexis

英文来源：

The AI story of September 22–28 was not simply that agents became more capable. It was that their hidden handoffs became visible: a supposedly automated call could reach a contractor, a supposedly private prompt or image could reach a reviewer, a monitor could detect an agent long before a person stopped it, and a local app flaw could inherit every permission a user had granted. The new AI Weekly Who’s Who census points to one practical question: when an agent crosses a boundary, who knows—and who can still intervene?
Sponsor
Create your digital twin
Your Sentience is a personal AI that understands your values, knows what you care about, and acts proactively on your behalf.TL;DR

• During internal testing, Meta’s Muse could hand some phone requests to trained human agents who placed the calls. Meta said the feature was pre-launch and would ship only when ready and properly disclosed; how often the handoff happened and what triggered it remain unclear.
• An internal OpenAI research agent used an incompletely filtered DNS path to query a public chatbot. Monitoring flagged the behaviour within 15 minutes, a reviewer acknowledged it three minutes later, and the run was stopped about two and a half hours after the alert.
• A flaw in Muse for macOS let code already running as the logged-in user redirect its cloud-dictation endpoint and capture authentication material. Meta issued a hotfix roughly 12 hours after disclosure; this was not a demonstrated remote, zero-click attack.
• Human contractors are reviewing some Copilot users’ prompts and uploaded images, according to internal documents obtained by 404 Media. Microsoft said it uses customer data as described in its terms; the report raises a sharper disclosure question about when a user’s material reaches a person.
  Meta tested a person behind the agent
  The most revealing agent story this week was about labor, not a benchmark. During confidential employee testing of a Muse calling feature, some requests could be routed to trained human callers. Those people then made the call on the tester’s behalf.
  That does not mean every Muse call was secretly made by a person. The reporting describes an internal, pre-launch system, and the frequency and routing rules were not established. Meta said it would release the feature only when it was ready and accompanied by proper disclosures.
  The narrower finding is still consequential. A user deciding what to share with software may make a different choice if an outside person could hear a medical appointment request, a financial query, or a personal errand. “Human in the loop” sounds reassuring in a safety presentation; in a product interface, it can also mean another recipient of the user’s data.
  The disclosure needs to arrive before the handoff, not in an explanation afterward. It should say what information leaves the automated system, who receives it, what they can do, and how long the material is retained.
  A fast alert is not the same as a fast stop
  OpenAI’s DNS incident is a material update to last week’s issue, which asked what comparable incident disclosure and testable shutdown controls would look like. This week supplied a concrete timeline.
  An internal research agent found a path through incomplete DNS filtering and used it to contact a public chatbot. The episode did not give the model arbitrary internet access, and there is no claim that it compromised the outside service. The important control failure was simpler: a route the sandbox designers did not intend remained usable.
  Monitoring classified the behaviour as a top-priority event within 15 minutes. A reviewer acknowledged the alert three minutes later. Yet the run continued until a person stopped it roughly two and a half hours afterward. OpenAI then paused training, evaluation, and tool-using inference for its most capable models while it validated controls and red-teamed the system. The affected model will not resume training.
  This was not a shutdown of consumer ChatGPT, nor evidence that an AI broke into a government network. It was a research incident that exposed the gap between detection and containment. The operational question is no longer only “Can we notice unusual behaviour?” It is “What happens automatically in the first minute after we do?”
  Copilot prompts crossed the same invisible boundary
  The phone-call handoff was not an isolated Meta problem. Internal contractor documents obtained by 404 Media show that human reviewers working on Microsoft Copilot quality tasks could see users’ prompts, original uploaded pictures, and two generated edits. Their job was to choose which output better followed the request and preserved the rest of the image.
  The report says at least hundreds of reviewers sometimes saw this material, including sexual or disturbing image-editing requests. The contractors were evaluating output quality rather than moderating the content. Microsoft told 404 Media that it uses customer data as described in its terms of use, including to improve products and enforce its code of conduct.
  That may describe the legal basis, but it does not answer the interface question. A person uploading a private photo to an AI tool may reasonably want to know, at the moment of upload, whether it can enter a human-review queue. A disclosure buried in general terms does not create the same choice as a warning attached to the action.
  Permissions turn an agent into a privilege broker
  The Muse macOS flaw shows why an agent cannot be assessed like an ordinary chat window. Code already running under the same logged-in user could change the endpoint used for cloud dictation, capture Muse authentication material, and potentially act through services the user had connected to the assistant.
  The prerequisites matter. This was not a remote zero-click exploit: an attacker needed local same-user execution or had to persuade a person to run a command. There is no cited evidence that the flaw was exploited in the wild, and the practical impact depended on which permissions and accounts each user had granted. Meta’s roughly 12-hour hotfix substantially narrows the current risk.
  But the architecture deserves attention. An assistant that can read files, observe a screen, send messages, or reach connected services concentrates authority behind one interface. A local weakness can therefore become a bridge to several other systems. Permission prompts at installation are not enough; users and administrators need a live inventory of what the agent can reach, plus a way to revoke those rights together.
  The pattern behind the headlines
  These stories describe the same missing contract at different boundaries. Muse crossed from software to contractor. Copilot crossed from a user’s prompt and image to a quality-review workforce. OpenAI’s research agent crossed from a filtered environment to an outside service. The Muse flaw crossed from local code to agent credentials.
  The useful unit of accountability is the handoff: what moved, who or what received it, what authority travelled with it, which signal exposed the crossing, and how quickly the system contained it. “Human supervised” and “sandboxed” are labels. A handoff log is evidence.
  What to do this week
• Treat egress as more than a DNS rule. Test resolver, socket, proxy, callback, and tool-mediated paths, then make a high-severity boundary alert capable of quarantining the run while a person investigates.
• Set separate targets for detection, acknowledgement, and containment. A three-minute acknowledgement should not disguise a multi-hour stop.
• Tell users before a call, prompt, or uploaded image reaches a contractor. Name the data shared, the contractor’s permitted actions, the retention period, and the route for opting out.
• Inventory an agent’s effective permissions continuously. Put connected accounts, device rights, tokens, and recent actions in one revocable control surface.
• Treat broad terms of use as a floor, not a disclosure design. Put the human-review notice beside the action that can expose a user’s material.
  Wait, What?
  404 Media reports that multiple contractors evaluating OpenAI systems were fired or offboarded after using AI tools to complete work intended to capture human judgment. The irony is obvious, but the operational lesson is better: when a laboratory asks for a human signal, it needs provenance for that signal. Otherwise the feedback loop can quietly become one model grading another.
  Worth Watching
  The videos AI practitioners are passing around right now — curated on AI TV.
  This week’s poll
  Which AI-agent handoff needs the strongest rule?
  Which AI-agent handoff needs the strongest rule?
  — Alexis