Zhou Hongyi Warns AI Tools Are Industrializing Vulnerability Discovery
At the Fourth Cyberspace Security Forum held in Tianjin on September 2, 360 founder Zhou Hongyi warned that vulnerability discovery is moving from manual craftsmanship to industrialized production. He noted that AI tools are compressing the time required to find high-value flaws from months or even years down to just a few hours, giving attackers a decisive advantage in automation capacity.
Security teams already feel the pressure. Emergency response groups are frequently awakened at 2 a.m. by newly disclosed zero-days already being exploited in the wild. Analysts must quickly assess how many assets remain exposed and whether patches can be deployed before the next business peak. The pace has accelerated so rapidly that defenders barely finish one remediation cycle before the next weaponized exploit appears on dark-web forums.
Zhou Hongyi described the change as the end of the "handicraft workshop" era. Previously, finding a critical vulnerability required senior researchers to spend months analyzing millions of lines of code and running prolonged fuzzing campaigns with uncertain results. This natural limit kept high-value zero-day output relatively manageable for defenders.
The situation has shifted with the arrival of tools such as Mythos. 360’s own Tulongfeng platform, released in June, has already identified more than 10,000 vulnerabilities, 212 of which received authoritative verification. Among them are long-undiscovered high-risk flaws in Windows and Office, as well as issues in intelligent-agent platforms including OpenClaw, Flowise, and Codex. These numbers demonstrate that vulnerability mining has achieved genuine economies of scale for the first time.
Even more concerning, Zhou Hongyi introduced the concept of the "second one-way transparency." Offensive experience once accumulated over a decade by elite red-team operators—bypass techniques, lateral-movement intuition, and internal-network tradecraft—can now be distilled into prompts, toolchains, and automated playbooks. These can be loaded into AI agents, allowing novice attackers to replicate sophisticated operations previously reserved for experts. Attack volume and depth are now limited primarily by compute resources rather than the number of skilled humans.
Intelligent agents themselves are becoming a new attack surface. Many organizations are deploying AI agents for operations, customer service, and data analysis, granting them database access, API calls, and file-system permissions. A single prompt-injection or supply-chain compromise can turn an agent into an autonomous insider that collaborates with other agents, dramatically accelerating lateral movement.
Zhou Hongyi advocated a "model-versus-model" defense strategy. 360’s Yitianzhen system uses swarms of security agents to perform continuous threat detection, validation, coordinated response, and remediation. For frontline teams, he recommended three immediate actions: automate vulnerability-intelligence workflows with SOAR platforms so humans only make final decisions; inventory and regularly audit permissions granted to every internal AI agent, including logging and kill-switch mechanisms; and begin using AI assistance for code review and detection-rule creation to close the efficiency gap with attackers.
The conclusion is direct: AI will not replace security engineers, but attackers who use AI will replace defenders who do not. Vulnerability industrialization has begun, and defensive automation must move from slideware to operational reality measured in hours rather than days.
Related articles
Evaluating Jev: Can the New Encoder-Based Model Serve as an Effective Guard for LLMs?
The article examines whether Jev, released by TypeSafe on September 15, can function as a reliable guard model for LLM safety and privacy tasks. It traces the evolution of guard models from early encoder-based solutions like Wildguard to recent LLM-based leaders such as Qwen Guard and YuFeng XGuard. In May 2026, several encoder-based alternatives including gliner guard, gliguard, and gliclass emerged, with Jev standing out due to its unusually large 32K–64K token context window. Benchmark results on NVIDIA’s Aegis 2.0 show Jev achieving an F1 score of 0.85 on prompts and ranking second overall with a score of 0.835, outperforming several LLM-based guards. The model reliably detects jailbreaks, prompt injections, and PII presence but cannot extract specific spans and requires an external API call. Limitations include lack of Russian-language testing and the need for additional NER layers in production.
How to Grant AI Agents Access to Internal APIs via MCP: Key Questions Security Teams Will Ask
As AI agents increasingly need to call internal APIs, security teams focus on three core questions: who granted access, how to revoke it, and how to investigate incidents after the fact. The answers lie in operation-level access control rather than traffic inspection alone. MCP, now managed by the Agentic AI Foundation under the Linux Foundation, has become the standard for connecting AI agents to enterprise systems with hundreds of millions of SDK downloads monthly. The article details how NEOMSA APIM implements MCP servers, tool publication from OpenAPI specs, subscription-based scopes, and 15 independent security checks. It explains why classic traffic filters fail against valid but unauthorized tool calls and stresses the need for owner approval, application-specific identities, and proper identity propagation through token exchange. Rate limiting at the subscription level and business-object validation are presented as essential controls to prevent overreach and duplication.
HackerSec's Yaga AI Agent Delivers Autonomous Penetration Testing with 98% Effectiveness
HackerSec has developed an autonomous penetration testing platform powered by its Yaga AI agent, marking a shift from scripted automation to adaptive, decision-making offensive security operations. Unlike traditional tools that follow predefined checks, Yaga observes the target environment, interprets responses, forms hypotheses, and replans attack paths in real time while maintaining memory and state across findings. The system relies on a proprietary harness that coordinates advanced AI models, security tools, contextual data, and ongoing decision logic rather than depending on a large language model alone. Yaga already achieves more than 98 percent effectiveness and supports continuous testing that matches the rapid change cycles of modern applications. CEO Andrew Martinez noted that periodic manual pentests can no longer keep pace with AI-accelerated attacks, requiring an AI-native model capable of operating at the same speed as the systems it protects. The platform allows human specialists to monitor and validate results while the agent conducts the investigation independently.
AI Gateway Emerges as Unified Control Layer for Enterprise LLM Access and Data Protection
As organizations scale LLM usage beyond individual enthusiasts to dozens of teams, IDEs, internal agents, and automations, AI Gateway becomes essential infrastructure for security, cost management, and reliability. The solution acts as a single entry point that authenticates users, enforces policies, performs DLP checks, depersonalizes sensitive data, routes requests across providers, and enables detailed auditing and billing. Companies face strict requirements under Russian Federal Law 152-FZ on personal data, along with risks of leaks involving API tokens, client information, and internal code when employees bypass official channels. Mature implementations from Cloudflare, Kong, and Microsoft Azure API Management already demonstrate analytics, rate limiting, fallback mechanisms, and governance features. Compatibility with OpenAI API reduces migration friction when switching between providers, including Chinese models, while handling edge cases like tool calls and vision capabilities. The article stresses separating AI Gateway responsibilities from DLP, MCP Gateway, and guardrails to avoid creating an unmanageable monolithic system. Early implementation priorities include ownership, comprehensive auditing from day one, real-world client compatibility testing, shadow-mode DLP, and clear documentation of production architecture.