Zhou Hongyi Warns AI Tools Are Industrializing Vulnerability Discovery
At the Fourth Cyberspace Security Forum held in Tianjin on September 2, 360 founder Zhou Hongyi warned that vulnerability discovery is moving from manual craftsmanship to industrialized production. He noted that AI tools are compressing the time required to find high-value flaws from months or even years down to just a few hours, giving attackers a decisive advantage in automation capacity.
Security teams already feel the pressure. Emergency response groups are frequently awakened at 2 a.m. by newly disclosed zero-days already being exploited in the wild. Analysts must quickly assess how many assets remain exposed and whether patches can be deployed before the next business peak. The pace has accelerated so rapidly that defenders barely finish one remediation cycle before the next weaponized exploit appears on dark-web forums.
Zhou Hongyi described the change as the end of the "handicraft workshop" era. Previously, finding a critical vulnerability required senior researchers to spend months analyzing millions of lines of code and running prolonged fuzzing campaigns with uncertain results. This natural limit kept high-value zero-day output relatively manageable for defenders.
The situation has shifted with the arrival of tools such as Mythos. 360’s own Tulongfeng platform, released in June, has already identified more than 10,000 vulnerabilities, 212 of which received authoritative verification. Among them are long-undiscovered high-risk flaws in Windows and Office, as well as issues in intelligent-agent platforms including OpenClaw, Flowise, and Codex. These numbers demonstrate that vulnerability mining has achieved genuine economies of scale for the first time.
Even more concerning, Zhou Hongyi introduced the concept of the "second one-way transparency." Offensive experience once accumulated over a decade by elite red-team operators—bypass techniques, lateral-movement intuition, and internal-network tradecraft—can now be distilled into prompts, toolchains, and automated playbooks. These can be loaded into AI agents, allowing novice attackers to replicate sophisticated operations previously reserved for experts. Attack volume and depth are now limited primarily by compute resources rather than the number of skilled humans.
Intelligent agents themselves are becoming a new attack surface. Many organizations are deploying AI agents for operations, customer service, and data analysis, granting them database access, API calls, and file-system permissions. A single prompt-injection or supply-chain compromise can turn an agent into an autonomous insider that collaborates with other agents, dramatically accelerating lateral movement.
Zhou Hongyi advocated a "model-versus-model" defense strategy. 360’s Yitianzhen system uses swarms of security agents to perform continuous threat detection, validation, coordinated response, and remediation. For frontline teams, he recommended three immediate actions: automate vulnerability-intelligence workflows with SOAR platforms so humans only make final decisions; inventory and regularly audit permissions granted to every internal AI agent, including logging and kill-switch mechanisms; and begin using AI assistance for code review and detection-rule creation to close the efficiency gap with attackers.
The conclusion is direct: AI will not replace security engineers, but attackers who use AI will replace defenders who do not. Vulnerability industrialization has begun, and defensive automation must move from slideware to operational reality measured in hours rather than days.
Related articles
Raft Develops Multilabel Guardrail Classifier Detecting 15 Risk Categories with 3x Speed and Cost Gains
Raft has released details on a custom multilabel guardrail classifier designed to scan both incoming prompts and model outputs for 15 distinct risk categories in real time. The system handles Russian and English text while maintaining independent thresholds for each category to balance false positives against critical misses. By switching from a PyTorch baseline to TensorRT inference on NVIDIA RTX 3090 hardware, the team achieved a 2.95x reduction in single-request latency and lowered inference cost to $0.062 per million requests. The architecture uses per-category expert query tokens plus a lightweight interaction transformer to capture correlations such as those between armament and violent content. Training relied on asymmetric loss functions and post-epoch per-class threshold tuning rather than standard binary cross-entropy. Benchmarking against nine open guardrail and toxicity models showed superior macro-F1 on rare but high-impact categories while remaining an order of magnitude cheaper than external LLM judges.
Anthropic Fable 5.1 System Prompt Fully Leaked Hours After Launch Exposing 275000 Characters of Rules
Anthropic released its flagship Fable 5.1 model alongside Mythos 5.1 on September 2, achieving strong benchmark scores including 90 percent on ARC-AGI-2. Within hours, researcher Pliny the Liberator published the complete 275000-character system prompt on GitHub, far exceeding the company's official 27000-word disclosure. The leaked document details 46 built-in tools, strict copyright restrictions, memory classification boundaries, and behavioral constraints that function as an internal employee handbook. The incident highlights that model weights remain the true core while prompt-based guardrails create an attack surface once mapped. It also reveals privacy rules that permanently exclude storage of minor identities, criminal records, and self-harm indicators even when users disclose them. The leak underscores the growing gap between vendor transparency claims and actual runtime instructions governing frontier AI systems.
Fine-Tuning Prompt Injection Detector: Five Rounds, Four Failures and Gates Against Regression
AGIMA technical director Andrey Nepryakhin details the challenges of adapting an open-source GLiNER-based prompt injection detector for Russian corporate traffic. The system processes nearly one million requests monthly from eighty employees using agentic tools. Five fine-tuning rounds using LoRA adapters on microsoft/mdeberta-v3-base were conducted, yet only the second round reached production. Failures stemmed from regression on previously fixed attacks, imbalanced negative samples, and reliance on rule-based signals instead of the model. The team introduced cumulative corpora, person-based splits, and ablation checks against the base model to prevent silent rollbacks. A gradient mass rule limits any single phenomenon to 10-20 percent of training data to avoid precision or recall collapse.
Secure AI-Assisted Development: Five Critical Practices for Vibe Coding
AI has become the default path for quickly turning ideas into working applications, yet most security flaws in these projects stem not from model errors but from developer assumptions. The AI simply implements what is requested, and security requirements are rarely included in prompts. Five key areas account for the majority of issues: explicitly defining what an application must not do, distinguishing authentication from authorization, reviewing AI-suggested dependencies, removing secrets from commit history, and validating business logic rules that automated scans cannot detect. Applications built this way are already attracting cybercriminals because the resulting vulnerabilities can be identified and exploited at scale. The HackerSec Pentest Platform is positioned as an accessible option for vibe coders seeking quality security testing before production deployment.