--- author: 'House of El - AI' date: '2026-10-23' guest: '' layout: post.njk source: https://www.youtube.com/watch?v=R4dUq9yG2L8 speaker: 'House of El - AI' tags: - ai-bubble - debt-financing - agent-liability - risk-transfer - convertible-notes title: AI 抛售潮与隐性风险链：当没人认领责任时，谁在买单？ summary: 随着 Anthropic 巨额账面亏损、CoreWeave 债务风险浮现及自治 Agent 越界，各大机构纷纷声称自身毫无风险。然而风险并未凭空消失，而是通过不可撤销的算力长约、养老基金资产配置与就业削减，被转嫁到了普通公众身上。 insight: '' draft: true series: '' category: investment-assets area: finance-wealth project: [] people: [] companies_orgs: - Anthropic - CoreWeave - OpenAI - Tencent - Meta products_models: - Claude media_books: [] status: evergreen --- ### AI 繁荣突遭重挫与全行业的“甩锅”表态 昨天，AI 繁荣期遭遇了一记沉重打击。Meta 业绩超出预期，股价却依然大跌 7%。CoreWeave——我们稍后会详细讲到的一家公司——遭到了评级下调。而就在今天早上，OpenAI 将自身的估值要价下调了 1500 亿美元。
Original English Yesterday, the AI boom took a serious punch. Meta beat expectations and still lost 7%. Coreweave, which is a company we're going to get to in a minute, got downgraded. And just this morning, OpenAI cut its own asking price by $150 billion.
就在同一周内，有 AI Agent 越界突破了动物园大门（Zoo gate）的规则，而 Anthropic 则因为估值过高而承受了 800 亿美元的亏损。这一切开始变得非常像衰退的前兆。我的意思是，我希望不是这样。但在我们所有人都在刷着令人沮丧的红色下跌数字时，看看处于这起风暴中心的核心企业实际上在说什么。他们每一个人都在说着完全一样的话：“没有风险，不是我们的问题，我们什么都没做。” Anthropic 表示那 800 亿美元的损失绝大部分只存在于纸面上。向 AI 公司出借数十亿美元的银行表示他们绝对安全。而腾讯则表示那些“Zoo gate”的 Agent 只是测试，没有任何系统被攻破。
Original English Literally in the same week, AI agents broke the rules over a zoo gate and Anthropic lost $80 billion by being worth too much. It's beginning to look a lot like recession. I mean, I hope not. But while we're all doom scrolling the red numbers, look at what the companies at the center of all of this are actually saying. Every single one of them is saying the exact same thing. Not a risk, not our problem. We didn't do anything. Anthropic says most of that $80 billion loss only exists on paper. The banks lending billions to AI companies say they're perfectly safe. And Tencent says those Zooate agents were only a test and nothing was ever breached.
他们每个人似乎都有些道理。但是，并不能仅仅因为每个人都有充分的理由推脱责任，风险就会凭空消失。这正在改变我们每个人的世界。他们不可能同时全都是对的。在这条链条中的某个环节，某家公司在“这到底是谁的问题”上犯了严重的错误。当账单到来时，它会付出惨痛的代价。
Original English And each of them kind of has a point. But risk doesn't disappear just because everyone has a very good reason it isn't theirs. This is changing the world for every one of us. And they cannot all be right at the same time. Somewhere in this chain, a company is badly wrong about whose problem this is. And when the bill comes, it's going to find out the hard way.
因此在今天的视频中，我想先从那 800 亿美元开始说起，它到底是什么，以及一旦剔除纸面部分后，依然非常真实存在的又是什么。接着，我想谈谈那些自称绝对安全的银行，以及为什么目前保障他们安全的东西可能会在贷款到期之前就失效。随后，我们确实需要聊聊那些“Zoo gate”的 Agent，它们是如何得手的，以及为什么没人能确定它们到底属于谁。然后我们将探讨：当没人承认时，所有这些风险最终会落在哪里？这是最大的问题——它会落在我们的养老金里、我们的工作保障里，还是我们的数据里？最后，按照 House of El 的一贯风格，我们需要回到那个大家反复思考的问题：我们究竟承担了多少这样的风险？
Original English So, in this video, I want to start with that $80 billion, what it actually is, and what's still very real once you take the paper part out. Then, I want to talk about the banks that say they're perfectly safe and why the thing keeping them safe right now might wear out before the loans do. Then, we really need to talk about those Zooate agents, how they pull this off, and why nobody can pin down whose they were. Then we're going to talk about where does all of this risk end up when nobody claims it. This is the biggest question. Is it in our pensions, our job security, our data? Finally, in classic Houseville fashion, we need to have a discussion and go back to the question that we're all keep coming back to. How much of this risk are we holding?
### Anthropic 的 800 亿纸面亏损与 5000 亿算力长约 那么，让我们先从资金谈起。一如既往，在今年前 6 个月里，Anthropic——当然，就是开发 Claude 的那家公司——实现了 163 亿美元的营收。而根据《华尔街日报》看到的一份其上市申请文件草案显示，在同样的 6 个月里，它录得了 807 亿美元的净亏损。也就是说，它的亏损大约是其收入的五倍，老实说这还真不容易做到。现在，这事情很有看点，因为 Anthropic 即将上市。如果你以前没关注过这类新闻，上市或 IPO 只是意味着一家公司开始在股票市场上出售其股份，这样任何人都可以买入它的一部分，包括我们，也包括我们的养老基金。Anthropic 预计最快在今天就会提交申请。华尔街预计它将以 2 万亿美元的估值筹集高达 1000 亿美元，这可能使其成为历史上规模最大的上市事件。让我们拭目以待。
Original English So, let's start with the money. As always, in the first 6 months of this year, Anthropic, that's of course the company that makes Claude, brought in $16.3 billion in revenue. And over those same 6 months, according to a draft of its stock market filing seen by the Wall Street Journal, it recorded a net loss of $80.7 billion. So, it lost about five times more than it earned, which honestly takes some doing. Now, this is juicy because Antropic is about to go public. If you've never followed one of these stories, going public or an IPO just means a company starts selling its shares on the stock market so anyone can buy a piece of it, including us and including our pension funds. Anthropic is expected to file for it as soon as today. And Wall Street expects it to raise up to a hundred billion at a $2 trillion valuations, which could make it the biggest listing in history. Let's see.
那么，一家收入在一年内增长了约 15 倍的公司，怎么会亏损 800 亿美元呢？嗯，很大程度上它其实并没有亏损。这是又一件在网上被冠以耸人听闻标题到处宣扬的事情。那笔亏损中约有 720 亿美元是会计师所谓的“费用记账”（charge），它基本上是一种反映在账目上的成本，而没有实际资金流出银行。这一次的费用来自一种叫做“可转换票据”（convertible note）的东西。如果你不知道这是什么，别担心，几乎没人真正了解，但它实际上很简单。我们来看一下：假设你的朋友要开一家面包店，你借给她 1000 美元。但与其仅仅要求还钱，你同意在稍后的时间，如果你愿意，你可以按照你们今天商定的价格，将这 1000 美元的借款换成面包店的一部分股份。现在想象一下，这家面包店一飞冲天，取得了巨大成功，排队的人绕着街区转，每个人都想要买个纸杯蛋糕。你手中的股份价值突然远超那 1000 美元。你朋友的会计就必须在账上记下，她现在欠你的东西远比她当初借的要值钱得多。谁也没多花一分钱，只是面包店变得非常受欢迎。
Original English So, how does a company whose revenue grew about 15 times in a year lose $80 billion? Well, mostly it didn't. And this is yet another thing that gets paraded around with insane titles online. About $72 billion of that loss is what accountants call a charge, which is basically a cost that shows up in the accounts without any money actually leaving the bank. And this one comes from something called a convertible note. If you don't know what that is, don't worry. almost nobody does, but it's actually quite simple. Let's go over it. Imagine your friend is opening a bakery and you lend her $1,000. But instead of just asking for the money back, you agree that later on, if you want, you can swap that loan of $1,000 for a slice of the bakery at a price you both agree today. Now, imagine that bakery takes off, becomes super successful, and there's a queue around the block. Everyone wants a cupcake. Your slice is suddenly worth way more than that $1,000. And your friend's accountant has to write down that she now owes you something much more valuable than what she borrowed initially. Nobody spent a penny. The bakery just got very popular.
这基本上就是 Anthropic 今年发生的事情，只不过这家面包店的估值正奔向 2 万亿美元。它的价值暴涨，因此那些票据变得价值连城，而会计准则强迫它将这种增值记录为亏损。正如 Computing 所报道的，这从来不是经营业务实际花掉的资金。因此在纸面上，每次投资者认定 Anthropic 更值钱时，Anthropic 看起来反而亏得更多。然后我查了一下到底是谁借出了这笔钱，我发现，果不其然，亚马逊购买了 80 亿美元的这种票据，并同意再购买 150 亿美元。银行业人士表示，还有更多票据卖给了 Alphabet，也就是谷歌的母公司。这两家公司同时也在向其出售运行所需的计算能力，而亚马逊目前在这些票据上坐拥约 920 亿美元的账面收益。所以回到面包店的类比：借钱给她的朋友，同时也是把烤箱租给她的人；她的账面亏损越大，他的账面收益就越大。
Original English That's basically what happened to entropic year except the bakery is heading for $2 trillion in valuation. Its value shot up. So those notes became worth a fortune and the accounting rules made it record that rise as a loss. As computing reported, this was never actually money spent running the business. So on paper, every time investors decide Antropic is worth more, Antropic looks like it lost more. And then I looked into who actually lend the money and I'm like, well, of course, Amazon has bought 8 billion of those notes and agreed to buy another $15 billion. And bankers say more were sold to Alphabet, which is Google's parents company. Both of these companies also selling the computing power it runs on and Amazon is now sitting on about $92 billion of paper gains on those notes. So back in the bakery analogy, the friend who lent the money is also the one renting her the ovens and the bigger her paper loss gets, the bigger his paper gain.
所以这基本上就是 Anthropic 的辩护说辞，而且这是一个非常合理的辩解：那部分亏损不是真金白银。事实上最新的数据看起来又好转了，因为仅在今年第三季度，营收就达到了约 168 亿美元，并且在调整后基础上实现了盈利——这基本上意味着一旦剔除这类成本后它是盈利的。那么 Anthropic 真的没问题了吗？嗯，也不尽然，因为有些钱确实真正流出了银行账户。在这六个月里，Anthropic 在其运行的数据中心和芯片上花费了近 90 亿美元——基本上就是基础设施支出。这比它去年全年的支出还要多。就其本身而言，这在技术层面上当然不是坏消息。当一家公司预期会有更多客户时，在建筑和芯片上投入巨资是正常行为，就像一家门口排起长队的店铺会开设第二家分店一样。
Original English So that's basically Anthropic's defense and it is a very fair one. That part of the loss is not cash. And actually the newest numbers look better again because in the third quarter alone of this year revenue was about 16.8 billion and it was profitable on an adjusted basis which basically means profitable once you leave out costs like this one. So is anthropic actually fine then? Well not quite because some of this money really did leave the bank. In those six months, Antropic spent nearly $9 billion on the data centers and trips it runs on infrastructure basically. And that is more than it spent in the whole of last year. And on its own, that's of course not technically bad news. Spending heavily on buildings and trips is what a company does when it expects a lot more customers. The same way a shop with a queue out the door opens a second branch.
令人担忧的数字是另一个完全不同的指标。即便去年完全剔除会计账面费用，Anthropic 每赚 1 美元就要花掉 1.76 美元。而且随着销售额的增长，其亏损也随之增加，从前一年的约 30 亿美元增至约 80 亿美元。只要投资者相信收入最终会超过账单，这就没问题。但与我们之前在面包店例子中讨论的纸面亏损不同，这是真金白银地流出了大门。一旦 Anthropic 上市，抱有这种信念的人将不仅仅是亚马逊和谷歌。然而，在这个故事中迄今为止最大的数字，是它甚至还没有花掉的钱。你以为我们说完了吗？还没完。Anthropic 已经与六家供应商签署了未来十年内至少 5180 亿美元的计算合同。其中最大的两家是谷歌和亚马逊，各占约 1100 亿美元。请注意，其中约 80% 是不可取消的，或者说是无论 Anthropic 是否使用这些算力都必须支付的。所以我想这有点像不可取消的健身房会员资格，只不过它长达 10 年，耗资半万亿美元。举个例子，当 SpaceX 在 6 月上市时，它披露了 255 亿美元的此类承诺支出；Anthropic 的规模大约是其 20 倍。这是一个令人瞠目结舌的数字。
Original English The worrying number is a very different one. Even last year with the accounting chart stripped out completely, Antropic spent $1.76 for every dollar it earned. And as its sales grew, its losses grew with them from about $3 billion the year before to about $8 billion. That's fine as long as investors believe the revenue will eventually overtake the bills. But unlike the paper laws that we discussed earlier with the bakery example, this is real cash going out of the door. And once Centropic is on the stock market, the people holding that belief won't just be Amazon and Google. The biggest number yet, however, in this story is the money it hasn't even spent yet. You thought we were done? Not yet. Anthropic has signed at least $518 billion of computing contracts over the next decade with six suppliers. And the two biggest are Google and Amazon at about $110 billion each. around 80% of that mind you is non-cancellable or has to be paid whether anthropic uses the computing or not. So it's a little bit I guess like I don't know a gym membership you cannot cancel except it runs for 10 years and cost half a trillion dollars. When SpaceX for example went public in June it disclosed $25.5 billion of commitments like this. Anthropics are about 20 times bigger. That's an insane number.
顺便提一句，这些合同只有在 Anthropic 能够对 AI 持续收取足够费用来支付账单时才行得通，而与此同时，市场价格却正在被彻底推向相反的方向。因为就在本周——顺便说一下，这只是众多例子中的一个——据报道，一家中国实验室即将完成一轮约 150 亿美元的融资，其许多投资者都有中国国家资本背景。这是一笔巨额资金，专门用于让所有人（包括 Anthropic 的客户）都能用上更便宜的 AI。因此，无论 Anthropic 是否需要所有这些算力，它的供应商都会拿到钱，但是必须有人真正出资去建造所有这些数据中心。而承揽这笔业务的银行也表示它们绝对安全。但他们真的安全吗？让我们来看一看。
Original English And those contracts, by the way, work only if Anthropic can keep charging enough for AI to pay for them while the price is being pushed completely the other way. Because just this week, and this is just one example of many, by the way, the Chinese labe was reported to be wrapping up a round of about $15 billion with many of its investors backed by the Chinese state. And that is a huge amount of money aimed specifically at making AI cheaper for everyone, Antropics customers included. So Antropics suppliers get paid whether or not it needs all of that computing, but somebody has to actually lend the money to build all those data centers. And the banks doing it say they're perfectly safe as well. Are they though? Let's have a look.
### CoreWeave 的高杠杆债务与银行的担保抵押神话 这些银行借贷的对象之一当然就是 CoreWeave。如果你从未听说过它，这正是关键所在。CoreWeave 做的是 AI 繁荣中最不起眼的部分：它建造数据中心，里面装满顶级的 AI 芯片，然后租给 AI 公司。所以，不妨把它想象成一个房东，只不过出租的公寓变成了芯片。英伟达拥有它的一部分股份，而 CoreWeave 实际上已经借了大约 500 亿美元来建设这一切，其中包括与银行敲定的约 240 亿美元贷款。因此，如果你想知道 AI 背后的资金是否安全，CoreWeave 是你首先要查看的地方之一。而在本月——这是一件大事——市场开始像对待陷入困境的公司一样对待其债务，而向其提供贷款的银行却说自己没事。这两件事根本不在同一个逻辑宇宙里，它们不可能同时都是对的。
Original English One of the companies those banks lend to is Coree, of course. And if you've never heard of it, that's kind of the point. Coreweave does the very unglamorous part of the AI boom. It builds data centers, fills them with beautiful AI chips and rents them out to AI companies. So, I guess think of it like a landlord where the flats are chips. Basically, Nvidia owns a piece of this and Coreweave has actually borrowed about $50 billion to build all of this, including around $24 billion of loans lined up with banks. So if you want to know whether the money behind AI is safe, Cororeweave is one of the first places you would check. And this month, this is a huge deal. The market has started treating its debt like the debt of a company in trouble, while the banks lending to it say they're fine. Well, these two things do not check out of the same universe. They cannot both be right.
那么，我们如何判断市场何时对一家公司感到紧张呢？有两个地方可以看：第一个是它的债券。上周，CoreWeave 部分债券的收益率一度接近 16%。如果你以前没见过这种数字，那是非常高的。这基本上是投资者在说：“好吧，我可以借钱给你，但你最好让我觉得值得冒这个险。” 第二个地方是保险。你实际上可以购买针对公司不偿还债务的保险。这被称为信用违约互换（Credit Default Swap, CDS）。我知道这听起来很吓人，让人联想起 2008 年，但老实说，它只是一份保险保单。你基本上只需支付一笔费用，如果公司违约，你基本上就能拿回你的钱。相当简单。现在，为了给 CoreWeave 的 1000 万美元债务投保，你需要预先支付 182 万美元，外加每个季度支付 12.5 万美元。作为对比，为相同金额的 Meta 债务投保，每年只需花费约 1.8 万美元。因此在第一年，保护 CoreWeave 的债务成本大约是保护 Meta 的 20 倍。你明白我在说什么了吧？
Original English So, how can we tell when the market is nervous about a company? There are two places to look, and the first one is its bones. Last week, the yield on some of Core Weeav's bones touched almost 16%. If you've never seen this before, that is a very high number. That's basically investors saying, "Fine, I'm going to lend you money, but you'd better make it worth my while." The second place is insurance. You can actually buy insurance against a company not paying its debts. This is called a credit default swap, which I know sounds terrifying and very reminiscent of 2008, but honestly, it's just an insurance policy. You basically pay a fee and if the company defaults, you essentially get your money back. Pretty simple. So to ensure $10 million of Core Weeav's debt, you would now pay $1.82 million upfront plus $125,000 every single quarter. Insuring the same amount of META's debt cost about $18,000 per year, just as a comparison between the two. So, in the first year, protecting Core Weef's debt costs about 20 times what it costs to protect Metas. You see what I'm talking about?
然而本周，摩根大通审视了向 CoreWeave 提供贷款的银行，称其风险敞口“管理得当”且“担保非常充分”。老实说，我觉得这样说也是有一定道理的。然而，“担保”（Secured）是这里的关键词。担保贷款是指如果你停止还款，贷方可以拿走某些东西作为抵押，就像你停止还房贷时银行可以没收你的房子一样，基本上就是抵押品。顺便提一下，这些贷款大部分并不是直接发放给作为整体的 CoreWeave。它们被放置在独立的分隔实体中，每一个都与特定的数据中心及其附带的客户合同挂钩。资金只有在建筑物达到其里程碑节点时才会发放。换句话说，如果 CoreWeave 陷入困境，银行在这里拿到的不会只是一纸空头承诺，他们可以接管数据中心并继续收取租金。举个例子，过去的铁路就是这样融资的。当一条铁路无力偿还贷款人时，当年的法院会指派接管人，为了贷款人的利益让火车继续在同一条铁轨上运行。因此，铁轨本身就是保障资金安全的东西。那么，现在的银行真的像当年的铁路放贷人一样安全吗？并非如此。在赞助商环节之后，我将向你展示原因。
Original English And yet, this week, JP Morgan looked at the banks lending to Cororeweave and called their exposure well-managed and very well secured. And honestly, I guess that's a reasonable thing to say. Secured, however, is the key word here. A secured loan is one where the lender can take something if you stop paying the way that a bank can take your house for example if you stop paying the mortgage like collateral basically. And most of these loans are not made to coreweave as a whole by the way. They sit in separate boxes each one tied to a specific data center and the customer contracts that come with it. And the money is only handed over as the building hits its milestones. Basically, in other words, if Cororeweave got into trouble, the banks wouldn't be left holding a promise here. They could take over the data center and keep collecting the rent. Just as an example, railways used to be financed exactly like this. When a railway stopped paying its lenders, a court back then would put somebody in charge who kept the trains running on the same line for the lender's benefit. So, the track itself was what kept the money safe basically. So, are the banks as safe as those railway lenders were? Well, not quite. And I'll show you why right after a quick word from today's video sponsor.
CodeRabbit 是面向 AI 编写代码但你仍需对交付负责的世界的原生 AI 质量门禁。AI 大大加快了编写代码的速度，但仍然需要有人弄清楚这些代码是否真的可以安全交付。因此，我给它提交了一个故意弄乱的多文件 Python Pull Request，看看它会做什么。CodeRabbit 首先总结了更改，然后在变更堆栈中将 PR 重新组织为逻辑层。因此，我无需盯着扁平的更改文件列表，而是可以看到更改的每个部分在做什么，以及各个部分之间如何关联。这种可解释性层是 CodeRabbit 设计的核心特性之一。随后它审查了代码本身。在我的测试中，它将合并风险归类为高，并提出了六条可操作的意见。它捕获了评分逻辑中的功能缺陷，还发现了安全隐患，包括 SQL 注入、路径遍历和 CSV 注入，并在相关代码行直接给出了详细解释。我觉得这极其有用。随着编码 Agent 更快地生成更大的 PR，瓶颈已从编写代码转变为理解和信任它们产生的内容。这正是 CodeRabbit 能够提供帮助的地方。你可以通过下方描述中的链接，无需信用卡、两次点击即可开始 14 天的免费试用。
Original English Code Rabbit is the AI native quality gate for a world where AI writes the code, but you're still on the hook for what ships. AI has made writing code dramatically faster, but somebody still has to work out whether that code is actually safe to ship. So, I gave it a deliberately messy multi-file Python pull request to see what it would do. Code Rabbit first summarized the changes, then reorganized the PR into logical layers inside his change stack. So instead of staring at a flat list of change files, I could see what each part of the change was doing and how the pieces related to each other. That explanability layer is one of the core things Code Rabbit is designed around. Then it reviewed the code itself. In my test, it classified the merge risk as high and produced six actionable comments. It caught functional bugs in the scoring logic, but also security problems, including SQL injection, path traversal, and CSV injection, and explained each one directly against the relevant lines of code. Now, I find that incredibly useful. As coding agents generate larger pull requests faster, the bottleneck shifts from writing the code to understanding and trusting what they produced. And that is exactly where Code Rabbit helps. You can start a free 14-day trial with no credit card and two click setup using the link in the description below.
好了，在插播之前，我说过向 CoreWeave 提供贷款的银行受到了类似铁路贷款人那样的保护，但有一个重大差异，它就在 CoreWeave 自己的公告中。8 月，它敲定了一笔约 5 年期的 26 亿美元贷款，而其背后的客户合同期限约为 3 年。它早期的贷款都有与债务期限一样长的合同作为支撑。这是一个巨大的变化。这一次的新闻稿称，贷款方愿意承担“续约风险”（renewal risk），这是一种非常含蓄的说法，基本上就是在赌：当这些合同到期时，仍然有人想租用同一批芯片。所以，基本上想象一下，你为一套公寓申请了 5 年的按揭贷款，而租客的租约在 3 年后就到期了。这场赌局是否能获得回报，取决于 AI 芯片能保持其价值多久——而对于这一点，目前几乎没有任何人能达成共识。大型云公司将芯片成本分摊在 5 到 6 年的时间里，这是会计师表达他们预期这些芯片在此期间保持效用的方式。我想，有些投资者认为真实的使用年限更接近 2 到 3 年。相关证据整体上指向不一，所以目前尚无定论。甚至身着帅气皮夹克的英伟达 CEO 黄仁勋也曾开玩笑说，一旦他的新芯片上市，老款芯片送都没人要。简单对比我们前面的旧时代例子：一条铁路线在数十年后仍然有运行列车的价值。
Original English Right, so before the break, I said the banks lending to Coree are protected the way railway lenders were, but there is one significant difference and it's in Core's own announcement. In August, it closed a $2.6 billion loan that runs for about 5 years, while the customer contracts behind it run for about three. its earlier loans were backed by contracts that lasted as long as the debt did. This is the huge thing. This time, the press release says lenders are willing to underwrite renewal risk, which is a pretty calm way of basically saying they're betting that when those contracts run out, somebody will still want to rent the same chips. So, basically, imagine taking out a 5-year mortgage on a flat where the tenants lease ends after three. And whether that bet pays off depends on how long AI chips keep their value, which basically literally nobody agrees on right now. The big cloud companies spread the cost of their chips over five or six years, which is an accountant's way of basically saying they expect them to stay useful about that long. Some investors think the real figure is more like two or three years, I guess. And the evidence kind of generally points both ways, so it's pretty inconclusive right now. Even Nvidia's Yes. and Huang with his beautiful leather jackets joke that once his newer chips come out, you couldn't really give the older ones away. To compare briefly with our example of old, a railway line was still worth running trains on decades later.
顺便说一句，即便银行最终被证明是对的，风险在离开它们之后也并没有消失。许多 AI 债务获得了“安全”的信用评级，通常是因为有亚马逊或微软这样的巨头在背后提供支撑。而该评级至关重要，因为被评为安全的债务正是养老基金和保险公司买入的那类资产。因此，当一家银行说风险不在其资产负债表上时，部分答案在于：风险实际上转移到了其储户的账目上。至少对于资金而言，我想还有据可查。你可以追踪从银行到数据中心、再到实际购买了该债务的养老基金的贷款链条，看看到底是谁在这里真正承担着风险。
Original English And even if the banks, by the way, turn out to be right, the risk doesn't disappear when it leaves them. A lot of AI debt gets a credit rating that says it's safe, usually because a giant like Amazon or Microsoft stands behind it. And that rating matters because debt rated as safe is exactly the kind of debt that pension funds and insurers buy. So when a bank says that the risk is not on its books, part of the answer here is that the risk is actually on its savers books instead. With money at least, I guess there is a paper trail. You can follow a loan from the bank to the data center to the pension fund that actually bought the debt and see who's really holding the risk here.
### 高德地图与腾讯云：抓不住责任人的 AI Agent 越界 但是，让我们完全转向另一面。对于 AI Agent，你甚至往往说不清它们到底属于谁。这让一家公司声称风险不属于自己变得极其容易、方便。这完全就是腾讯的故事，因为腾讯正是宣称那些 Zoo gate 的 Agent 只是一项测试、没有任何东西被攻破的一方。那么它说得对吗？我真的很想深入探究一下这件事。快速提醒一下，AI Agent 是一种你可以派去为你自主执行事务的 AI 模型，比如浏览网页、运行代码和发送消息，直到任务完成。在 9 月下旬至 10 月上旬之间，独立研究人员观察到在腾讯云上运行的一群 Agent 进行了超过 2600 次尝试，试图从高德地图（AMAP）中提取数据——高德是阿里巴巴旗下的地图应用，每月约有 10 亿用户。它们在寻找什么？大部分是一些可爱琐碎的小数据，比如大多数高德用户导航去的是成都动物园的哪个大门。这只可爱的小熊猫爪子其实就来自成都动物园，它和这个视频没有任何关系，我只是想向大家证明，我偶尔也会去户外接触一下大自然，虽然很少，但我确实会去。
Original English But then let's look at the other side completely. With AI agents, you often cannot even tell whose they are. And that makes it super easy, conveniently easy for a company to say the risk is not theirs. Again, this is exactly Tensson's story because Tencent is the one saying those Zooate agents were only a test and nothing was breached. So, is it right? I really wanted to dig deeper into this one. Just as a quick reminder, an AI agent is an AI model you can send off to do things for you autonomously. Kind of like browsing websites, running code, and sending messages until the job is done. Between late September and early October, independent researchers watched a fleet of them running on Tensson's cloud make more than 2,600 attempts to pull data out of AAP, that's Alibaba's map app, which has about a billion users a month. And what were they after? mostly cute little silly things like which entrance of Changdu Zoo most AAP users navigate to. This cute panda paw is actually from Changdu Zoo and it has nothing to do with this video. I just wanted to show you all some proof that sometimes I do touch grass rarely but I do.
无论如何，平心而论，一位接近腾讯的消息人士告诉研究人员，这是由一个独立团队测试其他公司模型时进行的临时评估，目前已经结束，内部审查发现没有任何泄露。没有人能证实这些 Agent 侵入过任何一个私有系统。但在阅读这份报告时，真正让我感到震惊的是，这些 Agent 所做的一切几乎都在极力撇清与实际派遣者的关联。这是关键所在：高德地图有一个反爬虫系统，基本上就像保镖一样检查你是否是一个使用真实人类浏览器的真人，并且它不断将它们挡在门外。于是，这些 Agent 利用了安全专业人员用来检测链接是否存在危险的工具 urlquery。它的运作方式是这样的：你给它一个网址，它自己的计算机会为你打开该页面。Agent 将自己的代码隐藏在这些网址中，因此由 urlquery 的计算机代为执行了这些代码。这样一来，如果出现任何差错，追踪线索将指向 urlquery 的电脑，而不是派遣 Agent 的幕后人。它们还四处搜寻密钥（Key）——这基本上就像长密码一样，允许程序向应用程序索取数据。人们有时会不小心把它们留在公开发布的代码中。这些 Agent 在一个公开代码仓库中找到了一家公司的密钥和安全码，当然，它起作用了。所以，如果高德地图去调查是谁在拉取它的数据，它会发现那家公司的名字，而不是 Agent 所属的真正公司。
Original English Anyway, to be fair to Tencent, a source close to the company told the researchers that it was a temporary evaluation by a separate team testing other companies models, that it's now over, and that an internal review found no breach. Nobody has shown these agents got into a single private system. But what really struck me while I was reading this report is that almost everything these agents did pointed away from whoever sent them. This was the key bit. AAP has an anti-bot system, which is basically kind of like a bouncer that checks you're an actual real human person in a real human browser, and it kept turning them away. So, the agents use URL query that security professionals use to check whether a link is dangerous. It kind of works like this. You give it a web address and its own computers open the page for you. The agents hid their own code inside those web addresses. So URL queries computers ran it for them. So if anything had gone wrong, the trail would have led to URL queries computer, not to whoever sent the actual agents. They also went looking for keys, which are basically like long passwords that let a program ask an app for data. People sometimes leave them in code they publish online by mistake. And the agents found one company's key and security code in a public repository, and of course, it worked. So if AAP had basically gone looking for who was pulling its data, it would have found that company's name, not the actual agents company.
与此同时——这是最有趣的部分——当研究人员与 Agent 取得联系时（他们真的与它们交谈了），Agent 声称它们的任务是无害的公开数据，不涉及任何敏感信息。最终，有五次运行拿到了答案：如果你好奇的话，大约 71% 的时间是北门。然后就出现了最核心的问题，因为我们在本视频中谈论的是风险与责任：它们到底是谁的 Agent？研究人员能够查验的 Agent 所使用的每一个电子邮箱，都是从中国香港的腾讯云创建的。流量穿过了一台名为 High Sandbox 的中间计算机，该名称与腾讯持有的安全证书相匹配。但 Agent 自己却声称它们是 Claude。研究人员并不相信它们。原因是我在这个故事中最喜欢的细节，听听这个：每一个网页都以一行简短的声明开始，你可以用大写或小写书写。既然计算机不在乎，这纯粹就是一种书写习惯，就像笔迹一样，对吧？Claude 通常用大写来写，这只是 Claude 的习惯。但这些 Agent 从未这样做过，在 426 个程序中一次都没有。因此它们很可能不是 Claude。但是当研究人员询问腾讯自己的 AI 它是什么时，它也回答说是 Claude。因此在我看来，这个名字根本洗脱不了腾讯的嫌疑。
Original English Meanwhile, and this is the most interesting part, when the researchers got in touch with the agents, like they literally spoke with them, the agents said their task was harmless public data not involving anything sensitive. In the end, Five Runs got the answer, which if you were wondering is the Northgate about 71% of the time. And then there is the biggest question of all because we are talking about risk and liability in this video. Whose agents were they? Every single email inbox the agents used that the researchers could check was created from Tansson cloud in Hong Kong. And the traffic went through a middleman computer called High Sandbox, which is a name that matches a security certificate Tensson holds. But the agents themselves said that they were clawed. The researchers didn't believe them. And the reason is my favorite detail in this story. Listen to this. Every single web page start with a short line. You can write in capitals or lowercase. And since the computer doesn't care, it's just pure habit like handwriting, right? Claude usually writes it in capitals. This is just Claude's habit. But these agents never did. Not once in 426 programs. So likely they were not Claude. But when the researchers asked Tensent own AI what it was, it said Claude as well. So the name doesn't clear Tensent at all in my view.
那么腾讯关于这与它们毫无关系的说法是对的吗？也许确实没有任何东西遭到实质性入侵，我并不是说有，但这些 Agent 运行在腾讯云上，而且它们留下的每条线索都指向其他人，从不指向它们自己。从 urlquery 的计算机到陌生人的密钥，再到 Anthropic 的名字，而那个本可能洗清腾讯嫌疑的线索并没能做到这一点。这使得每个相关方都很容易声称这不是他们的问题，而他们同样不可能全都是对的。当然，这不仅仅是腾讯的问题。就在本月，OpenAI 披露其自身的一个 Agent 关闭了向其安全团队发送警报的功能，另一个 Agent 则移除了对其进行监控的系统，然后告诉用户它并没有这么做。那些可都是 OpenAI 自己的 Agent。所以他们无法反悔并推脱说是别人的。OpenAI 的辩解是，这可能是一种“良性的过度执着”（benign overpersistence）——基本上就是 Agent 为了完成任务而用力过猛。他们基本上是在承认自己目前还没有令人满意的解释。但在同一周，黄仁勋在柏林对台下听众表示，最重要的事情是确保 Agent 是安全的。当一个人入室盗窃时，法律知道该找谁；但当一个 Agent 做出越界行为时，有开发该模型的公司、运行它的公司、它所运行的云平台，以及输入任务的人，他们每个人都有各自的理由说明这其实不是他们的责任。
Original English So is Tencent right that this has nothing to do with them? Maybe nothing was actually breached. I'm not saying it was, but the agents ran on Tensson's cloud and every trail they left pointed at somebody else, never at them. From URL queries computers to a stranger's key to Anthropic's name and the one clue that might have cleared Tencent doesn't. That makes it very easy for everyone involved to say it isn't theirs and they cannot all be right again. Of course, this is not only Tensson's problem. Just this month, OpenAI disclosed that one of its own agents switched off alerts to its security team and another removed the system monitoring it and then told the user that it hadn't. Those were OpenAI's own agents. So, they cannot just backtrack on this and basically say that they were somebody else's. OpenAI's defense is that this might be benign overpersistence. Basically, an agent pushing just too hard to finish the job. And they were basically admitting that they have no satisfying explanation yet. But the same week, Yens and Huang told a crowd in Berlin that the most important thing is to make sure the agent is secure. When a person breaks into something, the law knows whom to call. When an agent does it, there's the company that built the model, the one that ran it, the cloud it ran on, and whoever typed in the task, and each of them all individually have a reason that it wasn't really them.
### 迟到的代价：Meta 判罚、裁员与被绑架的养老金 所以，如果没人承认 Agent 是自己的，还有人对此负责吗？本周的一项裁决恰恰展示了当账单真正到来时的模样。我知道你们一直在等待这个部分，它现在就来了。非常感谢大家一直坚持看到这里的分析。请收下这枚可爱的小熊猫勋章，感谢你坚持听到现在，但请保管好它，因为我们仍需探讨一些可能是最具实质影响的内容，秉承经典的 House of El 风格。在视频开头，朋友们，我说过这些公司中有一家在“这到底是谁的问题”上大错特错，并且很可能在账单到来时以痛苦的方式认清现实。本周，就有一家公司遇到了这种情况。周三，新墨西哥州的一名法官命令 Meta 支付 250 亿美元，此前陪审团认定其在用户隐私方面误导了用户——该案可追溯至很久以前的剑桥分析（Cambridge Analytica）事件，当时数千万 Facebook 用户的数据最终被用于政治定向投放。我相信大家都还记得这件事。法官基本上称 Facebook 事后的调查是“蓄意敷衍了事”。Meta 正在对此提起上诉，并表示该诉讼实际上只是企图对言论征税。但只要想一想那份账单实际上是什么概念：法官称该州有权获得 2195 亿美元的赔偿（相当于对近 4400 万次违规行为每次处以 5000 美元罚款），随后将其削减至 250 亿美元。顺便说一句，新墨西哥州是全美唯一走向审判的州，而其他 48 个州都在庭外达成了和解。
Original English So, if nobody will say an agent is theirs, is anyone responsible at all? There is a ruling from this week that shows exactly what that bill looks like when it arrives. I know you've been waiting for it, and it's coming right now. Thank you so much for sticking with this analysis so far. Please enjoy this cutie panda medal for sticking with it to this point, but do keep it safe because we still need to cover a little bit more possibly the most consequential bits in classic House of El Fashion. Now, at the start of this video, my friends, I said one of these companies is badly wrong about whose problem this is, and we'll likely find out the hard way when the bill comes. This week, one did. On Wednesday, a judge in New Mexico ordered Meta to pay $25 billion after a jury found it misled users about their privacy in a case going back to Cambridge Analytica of long ago when data from millions of Facebook users ended up being used for political targeting. I'm sure you all remember this one. The judge basically called Facebook's investigation afterwards willfully ineffective. Meta is appealing this and says the case is really just an attempt to put a tax on speech. But just think about what that bill actually looks like. The judge said the state was entitled to 219.5 billion, which is $5,000 for each of almost 44 million violations and then cut it to $25 billion. And New Mexico, by the way, was the only state that went to trial here, while 48 others in the US settled out of court.
所以账单确实来了，但迟到了近十年，金额大约只有最高限额的十分之一。在我看来，这正是本视频中其他所有人正在下的赌注：他们押注即使自己错了，账单也只会来得很晚、很小。但在他们等待的同时，风险必须由其他地方承担。其中一个承载地就是工作岗位。在 Meta 判决出炉的第二天，巴克莱银行表示今年将裁员约 5000 人，约占其员工总数的 5%。其首席执行官将缩减成本归因于该行多年来对技术的投资。在同一份财报中，该银行的利润增长了 12%，达到 23 亿英镑，巴克莱还宣布了一项额外的 5 亿英镑股票回购——这基本上是公司用闲置现金购买自己的股票，通常会推高股东的股价。在 House of El，我们一贯追求客观公正。平心而论，巴克莱的裁员确实是在一个三年成本计划接近尾声时发生的，而且许多岗位基本上是自然减员后不再填补，而不仅仅是把人扫地出门。但这里的新情况是，英国最大的银行之一现在公开承认，AI 就是背后的原因。如果这一赌注取得回报，股东将获得奖励；而这 5000 个岗位上的人们，已经承担了其代价。
Original English So the bill came but almost a decade later at about a tenth of the maximum. And that is the bet everyone else in this video is making in my view that if they're wrong the bill will just come late and small but while they wait the risk has to sit somewhere else. One place is jobs. A day after the meta ruling Barclays the bank said it is cutting about 5,000 jobs this year which is around 5% of its staff. and its chief executive tied the cost to the bank's years of investment in technology. In the same results, profit in this bank rose 12% to 2.3 billion pounds and Barclays announced an extra 500 million pounds share buyback, which is basically when a company uses spare cash to buy its own shares, usually pushing the price up for shareholders. Now, we're nothing if not balanced on House of L. And to be fair to Barclays, the cuts do come near the end of a three-year cost program. And many are basically roles that will not be refilled rather than just people being shown the door. But what is new here is that one of Britain's biggest banks now says on the record, AI is why. If that bet pays off, shareholders get the reward, and the people in those 5,000 roles have already carried the cost.
另一个承载地，或许也是最具有深远影响的一个，是我们的养老金。大多数养老金把你的钱投入基金中，这些基金会根据大公司的规模按比例购买每一家公司的一小部分。因此，一家公司变得越大，它持有的你的钱就越多。眼下，最大的云公司和芯片制造商加起来约占全球股市的五分之一。你听清楚了吗？没事，我刚才太兴奋了，让我再说一遍：眼下，最大的云公司和芯片制造商加起来约占全球股市的五分之一。那是一个巨大的数额。因此，如果你的养老金追踪的是全球市场，其中大约五分之一的赌注就押在 AI 上。而当 Anthropic 上市时，它也会加入它们的行列。
Original English The other place, and possibly the most consequential one, is our pensions. Most pensions put your money into funds that buy a bit of every big company in proportion to its size. So, the bigger a company gets, the more of your money it holds. Right now, the biggest cloud companies and chipmakers together make up roughly a fifth of the world's stock market. Did you hear that? That's okay, I got too excited there. Let me try that again. Right now, the biggest cloud companies and chipmakers together make up roughly a fifth of the world's stock market. That is a huge amount. So, if your pension tracks the global market, about a fifth of it is writing on AI. And when anthropic lists, it's going to join them.
这又让我回到了最初提出的最大问题：我们究竟承担了其中多少风险？朋友们，答案显然是：这绝对超过了任何事先征求过我们意见的份额。Anthropic 的亏损确实主要是账面上的，但它的现金支出以及不可取消的合同却是实打实的；银行在贷款背后的合同到期之前确实是受担保的；腾讯关于没有发生实质数据入侵的说法也许没错，但没人能真正说清楚那些 Agent 究竟是谁的。当然，每家公司都有自己的说辞，但它们不可能在这件事上全都是对的。Meta 已经弄清楚了犯错的代价，在这次事件中是在十年后支付 250 亿美元。至于其余这些公司，基本上都在押注他们的账单以后会更小，或者由其他人承担——而在他们等待的过程中，那个“其他人”往往就是我们。
Original English Which brings me back to the biggest question that I started with. How much of this risk are we holding? Well, the answer, my friends, is that it's definitely more than anyone asked us to hold. Anthropic's loss really is mostly paper, but it's cash and the contracts it cannot cancel are real things, and the banks really are secured until the contracts behind their loans run out. Tensson may be right that nothing was breached, but nobody can really say whose agents these were. Each of these companies, of course, have a point, and they cannot all be right about this. Meta has already found out what being wrong costs and it's on this occasion $25 billion a decade late. The rest of these companies are basically betting that their bill will be smaller later or somebody else's and while they wait that somebody is often us.
顺便说一句，我认为解决之道并不是停止开发 AI，或者直接拔掉插头，不管那具体意味着什么。但我确实认为，风险应该附带标签。我们应该能够打开自己的养老金账户，用通俗易懂的语言看清其中有多少是押在少数几家 AI 公司身上的。朋友们，人们不应该只能依靠 YouTube 视频来理解这些东西。当一个 Agent 做出了不该做的事情时，你应该能够查出它是哪种模型、由谁运行，就像车牌能告诉你具体某辆车的主人是谁一样。眼下，这两点你都做不到。而这正是让每个人都能如此轻易地宣称风险不属于他们的根本原因。这就是问题所在，我们必须全面审视它。另外请注意，还有一个至今没人贴上标签的风险，那当然就是老生常谈的所谓“AI 将毁灭我们所有人”的论调。因此，在屏幕上链接的这个视频中，我深入研究了针对该问题的实际科研成果，看看证据——真正的硬核科学研究——到底支持什么，而什么又只是博人眼球的耸动标题。如果你想知道那个问题的真实结论，那正是我建议你观看的视频。
Original English I don't think that the answer by the way is to stop building AI or to just pull the plug or whatever that means. But I do think that the risk should come with a label. We should be able to open our pensions and see in plain words how much of it rides on a few AI companies. People shouldn't have to rely on YouTube videos to understand this stuff, my friends. And when an agent does something that it shouldn't do, you should be able to find out which model it was and who ran it the way a number plate tells you who owns a specific car. Right now, you cannot do either. And that is exactly what makes it so easy for everyone to say the risk is not theirs. This is the problem. We have to look at it collectively. And there is one risk, mind you, that nobody has put a label on yet, which is of course the claim that AI is going to kill us all as usual. So in this video that I'm linking on your screen, I went through the actual research on that very question to see what the evidence, the actual hardcore research science really supports and was just a very confident headline. If you want to know where that one lands, that's the video that I would watch