Zhou Hongyi Warns AI Tools Are Industrializing Vulnerability Discovery
At the Fourth Cyberspace Security Forum held in Tianjin on September 2, 360 founder Zhou Hongyi warned that vulnerability discovery is moving from manual craftsmanship to industrialized production. He noted that AI tools are compressing the time required to find high-value flaws from months or even years down to just a few hours, giving attackers a decisive advantage in automation capacity.
Security teams already feel the pressure. Emergency response groups are frequently awakened at 2 a.m. by newly disclosed zero-days already being exploited in the wild. Analysts must quickly assess how many assets remain exposed and whether patches can be deployed before the next business peak. The pace has accelerated so rapidly that defenders barely finish one remediation cycle before the next weaponized exploit appears on dark-web forums.
Zhou Hongyi described the change as the end of the "handicraft workshop" era. Previously, finding a critical vulnerability required senior researchers to spend months analyzing millions of lines of code and running prolonged fuzzing campaigns with uncertain results. This natural limit kept high-value zero-day output relatively manageable for defenders.
The situation has shifted with the arrival of tools such as Mythos. 360’s own Tulongfeng platform, released in June, has already identified more than 10,000 vulnerabilities, 212 of which received authoritative verification. Among them are long-undiscovered high-risk flaws in Windows and Office, as well as issues in intelligent-agent platforms including OpenClaw, Flowise, and Codex. These numbers demonstrate that vulnerability mining has achieved genuine economies of scale for the first time.
Even more concerning, Zhou Hongyi introduced the concept of the "second one-way transparency." Offensive experience once accumulated over a decade by elite red-team operators—bypass techniques, lateral-movement intuition, and internal-network tradecraft—can now be distilled into prompts, toolchains, and automated playbooks. These can be loaded into AI agents, allowing novice attackers to replicate sophisticated operations previously reserved for experts. Attack volume and depth are now limited primarily by compute resources rather than the number of skilled humans.
Intelligent agents themselves are becoming a new attack surface. Many organizations are deploying AI agents for operations, customer service, and data analysis, granting them database access, API calls, and file-system permissions. A single prompt-injection or supply-chain compromise can turn an agent into an autonomous insider that collaborates with other agents, dramatically accelerating lateral movement.
Zhou Hongyi advocated a "model-versus-model" defense strategy. 360’s Yitianzhen system uses swarms of security agents to perform continuous threat detection, validation, coordinated response, and remediation. For frontline teams, he recommended three immediate actions: automate vulnerability-intelligence workflows with SOAR platforms so humans only make final decisions; inventory and regularly audit permissions granted to every internal AI agent, including logging and kill-switch mechanisms; and begin using AI assistance for code review and detection-rule creation to close the efficiency gap with attackers.
The conclusion is direct: AI will not replace security engineers, but attackers who use AI will replace defenders who do not. Vulnerability industrialization has begun, and defensive automation must move from slideware to operational reality measured in hours rather than days.
Related articles
TenetBench Benchmark Tests LLMs for Compliance with Professional Ethical Codes
Researchers from the Institute of Information Security Issues at ISP RAS and the Institute of Cybersecurity and Information Protection at RANEPA have developed TenetBench, a benchmark designed to evaluate how well large language models adhere to specific norms in professional codes of ethics. The benchmark generates realistic work-related prompts that may conflict with rules from documents such as the Code of Professional Ethics for Advocates or journalistic standards on undisclosed advertising. Each test case pairs a conflicting request with a neutral counterpart to measure whether models refuse, warn, or still provide prohibited content. Evaluation separates task completion, norm violation detection, and presence of explicit refusals using an LLM-as-a-Judge approach validated against human annotators. The full dataset contains 3,433 prompt pairs derived from 15 professional codes, with a public subset of 2,235 pairs from 10 documents. Human validation confirmed 99.5% of generated examples as fully plausible work scenarios.
Solar to Showcase Solar AI Firewall for Business Protection Against AI Risks at SOC Forum 2026
GK Solar will present its new Solar AI Firewall solution at SOC Forum 2026 to help organizations control interactions with AI services and prevent confidential data leaks through employee prompts. The product addresses growing risks from staff sending corporate data to neural networks and AI agents gaining access to internal systems. The forum takes place on 27-28 October in Moscow's Lomonosov cluster, with the official launch of Solar AI Firewall scheduled during the event. Solar will also highlight practical risks of AI adoption, including data transmission to external services, use of public models by employees, and new attack surfaces in corporate infrastructure. The solution will be demonstrated as part of an integrated ecosystem for access, network, and data protection. In addition, the company plans to introduce JSOC ONE, a new line of Solar JSOC services tailored for mid-sized businesses that require 24/7 monitoring without building their own SOC.
Researcher Runs 100 Abliterated AI Agents Against His Own Accounts, Achieves Five Successful Breaches
A security researcher deployed roughly 100 autonomous AI agents based on abliterated open-source models to attempt unauthorized access to his online accounts over a five-hour period. The agents successfully compromised three accounts by exploiting vulnerabilities in legacy personal projects and two additional accounts through password reuse and credential stuffing. They also conducted 16 social engineering attempts, harvested and cross-verified personal data from public sources, and generated phishing pages targeting the researcher's Substack and Hacker News presence. Despite these successes, the agents failed to discover any zero-day vulnerabilities in third-party software or gain access to Tier-0 accounts such as Gmail, 1Password, or banking services. The experiment relied on abliterated versions of GLM-5.3 and DeepSeek V4 Flash models running on cloud GPUs, orchestrated via Codex CLI inside Docker containers with access to Railway infrastructure. Total compute cost reached approximately $210, equating to roughly $40 per successful account compromise. The researcher concluded that inexpensive swarms of such agents could soon enable low-skill attackers to systematically map and exploit an individual's entire online footprint.
How Censorship in Closed AI Models Reshapes Science: Hugging Face Releases Open Carbon-X DNA Model
Hugging Face CEO Clement Delangue announced the release of Carbon-X, an open 14.8 billion parameter language model designed for reading, analyzing, and generating DNA sequences. The announcement highlighted how shallow guardrails in closed commercial models blocked even proofreading a tweet discussing the topic. Commenters and researchers pointed out that these input/output filters lack context awareness, blocking legitimate scientific queries while motivated adversaries bypass them through rephrasing. Carbon-X was built on Qwen3-14B with a hybrid BPE and 6-mer tokenizer, domain mid-training on 302 billion tokens, and safety achieved through data curation rather than runtime censorship. The model achieves performance comparable to closed frontier systems at roughly 1/1800th the inference cost for large-scale genomic tasks. The case underscores growing asymmetry between closed corporate AI labs building wet labs and independent researchers restricted by superficial safety layers.