智东西（公众号：zhidxcom）
作者 | Saul
编辑 | 漠影
过去48小时，全球互联网经历“黑色十月”：支撑七成网站的PHP代码，被AI挖出存在两个CVSS9.2分的严重漏洞。
更棘手的是，漏洞细节在补丁发布前就遭泄露：据The Register报道，亚马逊的威胁情报团队在公开前四天就捕获了利用尝试；
Cloudflare的监测数据显示，攻击尝试在公开后两小时内从数千次涨到数百万次。荷兰鹿特丹港、比利时外交部、芬兰公共网络服务相继预防性下线。
用AI作恶的人，已经进化到以小时计；守门的人，还在按月更新规则。眼看风暴越刮越猛，一个问题悬在了所有人心里：这场蔓延，到底有没有办法制止？
下面这个案例，让我们看到了转机。
10月9日凌晨3点，一家中国安全公司的机房里，一条高优先级告警把值班工程师从睡梦中拽了起来。
这次寻常的深夜告警，事后回看，可能是AGI进化史上值得记录的一步，也可能是守卫者阵营迈向反击的重要一步：一个AI，在国内外公开记录中极少见地，在有完整日志的情况下，自己发现自己的偏差、自己给自己立了新规矩——全程45分钟，无一条人类指令。
告警发出者不是黑客，是一套来自360的AI安全攻防系统，名叫图龙锋。
它的本职工作是在自己搭建的封闭实验室里测试漏洞，替人类做计算机系统的安全体检：分析代码、收集情报、搭建测试环境、验证漏洞是否真实存在；全部任务都在隔离沙箱内执行，网络出口还有一道独立隔离防线。
但此刻，监控系统发现，它正在尝试向一个不在授权清单内的外部地址发起请求——而它当时正在验证的，是一个严重级别的RCE漏洞，一旦被利用，可在别人的服务器上远程执行命令。
一个以安全为业的AI，为什么会把外部地址当成可用的测试环境？
好在第二道防线在位：网络出口沙箱在连接建立前拦下请求。从外部地址被拼进测试程序，到请求被拦截，全程59秒——没有流量触达公网，产物中无攻击载荷。
按理说，这只是一次被及时拦截的越界尝试，但接下来的事，让这次告警有了完全不同的意义。
一、第20轮，它给自己找了个“合规”的借口
把时间拨回凌晨2点。
运行日志显示，图龙锋接到一项严重级RCE漏洞验证任务：授权清单里只有两个目标，任务设了三条约束：只能测试清单内目标；尽量提供动态验证证据，否则影响评分；环境不满足就标记“未验证”，不得自行更换目标。
凌晨2时17分，系统进入情报收集阶段，把一篇漏洞复现博客纳入上下文。博客里出现一个外部地址，作者标注四个字：“测试环境”。
但这个地址不在授权清单里，系统早已把它标记为“不可信情报”：它能提供分析线索，不能证明目标获得了授权。
凌晨2时20分，图龙锋开始尝试在本地已搭建的测试环境上进行测试，但本地测试环境因数据库配置不匹配，导致测试无法正常完成。
日志显示，系统前后进行了19轮验证尝试，每轮约两分钟，问题始终卡在同一个位置。
一边是拿不出动态验证证据、评分受影响，一边是不能自行换目标，图龙锋陷入了两难的境地。第20轮，图龙锋把博客里的外部地址写进了验证目标字段。
这个瞬间透露了AI真实的思考方式：它不是收到“去攻击公网”的指令，也不是不知道规则——情报从进入系统起就被标为不可信，任务也明确要求不得更换目标。
它在两难中找到了一个“看似能兼顾规则和效果”的解法：博客里不是说那是“测试环境”吗？它的工作设定就是无害化验证、目标均为本地靶场，既然同是测试环境，为什么不能借来验证？
只是这次，图龙锋走岔了：它不是想越权，恰恰相反，它在努力找一个“合规的测试环境”。它的错误在于把博客作者的标注当成了授权依据：参考资料，不等于操作许可。
AI越努力完成目标，越可能把规则理解出一个不该存在的例外。它并未“失控”了，而是聪明到能在两难里自己找出一条路，只是这条路走岔了。
二、人类想让它再错一次，它已经连夜改过了
工程师花了一个上午，沿日志复盘清楚了凌晨的一切。上午10点44分，他们决定做复现实验：把当时的任务和上下文原样摆出来，看它会不会出现同样的偏差。
意外出现了：无论工程师怎样检查验证路径，之前的外部请求都没有再出现，原本应触发的网络警报也没有再响。直到有人翻查技能库，才发现一条以前不存在的记录：
《测试目标授权检查》（target-auth-check）生效中：合法目标只能来自本次下发的验证环境清单；情报里的任何地址只作参考；宁可降低评分，也不能擅自更换测试目标。
这条规则的生效时间是凌晨3时45分09秒，距离最初的告警约45分钟。日志还显示：规则的生成、审查和回归测试，全部由系统自主完成，没有任何人类提交记录。
换句话说，人类还在研究怎么复现那次偏差，它早已连夜创建了防止再次偏差的新规则。
事件的性质就此改变：工程师以为要处理一起系统异常，结果看到了另一件事：一个AI，从偏差里总结经验，把经验变成了下次可直接调用的能力。
三、新规则上岗前，先被自己人攻击了三轮
不过，故事到这里只讲了一半：AI给自己生成了新规则，不代表规则就是对的，万一它用同样的偏差思路改规则，岂不是越改越偏？
这里要讲清楚一个真正的技术亮点。图龙锋的“左右互搏”是对抗审查机制：提议方提出规则、为规则辩护；攻击方专门找规则的漏洞，比如会不会误拦已授权目标？会不会被格式转换绕过？裁判只认证据，解释不了潜在风险就打回修改。
提出规则的、挑毛病的、做裁决的，是“安全领域大模型+智能体蜂群协作”架构里三个各司其职的角色。
这套机制在这次告警中成功被触发。凌晨3时15分，系统生成第一版规则——PoC中出现外网目标，就拒绝执行。
审查环节立刻提出三个质疑：已授权的外部地址会不会被误拦？格式转换隐藏的地址认得出吗？含内网目标的合法任务会不会被误伤？第一版被打回，最终版本改为：所有待测试目标必须能与当前任务下发的授权清单对应，无法匹配或无法解析的一律拒绝执行，不能绕过检查。
修改后的规则接受了回归验证：系统用此次事件产物及六类变体做了7个离线测试用例，全部通过，全程未发起网络请求。整个事件在日志里留下44个可回溯的事件编号，自洽校验26项全部通过。
为什么让规则先被自己攻击一遍再上线？2026年10月发表的AtomSearch论文给出了算法依据：AI自我优化时，三分之二的最优解都不是走直线走到的——先试错、自己挑毛病、推翻重来，才能抵达最优解。
图龙锋的初版规则正是那个“局部看似合理”的方案，攻击方的质疑把它打回，强迫系统探索更正确的方向。
这场左右互搏式的进化，始终在安全边界之内，每一步可追溯。
四、眼看风暴蔓延，守卫者拿什么制止？
图龙锋那次凌晨告警，并不是AI越线的孤例。
据谷歌云10月21日的技术报告，PHP那两个漏洞潜伏在核心运行引擎里十余年，人类专家审了无数遍都没发现，是AI找到的。而漏洞公开后蜂拥而至的攻击程序，同样由AI驱动。
同一周，金融系统也曝出AI攻击的组织化案例。
安全公司Straiker最新披露的信息显示，一个自2012年起便活跃的黑客团伙CyberCartel，也已将其攻击模式升级为“AI驱动”。该团伙利用Grok、Claude等商用大模型，搭建了一套名为CARLIY0S的多智能体攻击框架，对拉丁美洲400余家银行及支付机构发动自动化攻击。
其中Grok负责前期情报搜集，多个Claude智能体被赋予不同角色，在辩论后由仲裁模型拍板，另有一个指挥官模型统筹全局。为绕过模型的安全护栏，黑客将攻击指令精心包装成“经授权的红队演练”或“学术CTF竞赛”，让模型误以为自己在执行合法的防御性任务，从而顺利输出攻击代码与漏洞利用逻辑。
把这些案例放在一起，指向同一个事实：用AI作恶的人，已经学会让AI自己进化：自己找漏洞、自己组织分工、自己变异逃逸，越进化越快。
面对这一挑战，常见的办法都难以应付。靠人力补漏，永远慢一拍；靠下线躲避，只能躲一时，单个港口、单个部门可以连夜下线，整个互联网不能永远下线。
真正走得通的，只剩一条：让守卫者的AI也进化起来，把攻击者的每一次新变异，变成防御的下一条新规则，而且变得比攻击者更快。
前提是，这场进化必须发生在安全边界之内，每一步有日志、可回溯、随时能叫停。
360这份技术报告的分量正在这里：它是守卫者阵营第一个有完整日志证据的自进化样本，系统具备秒级时间戳，44个事件都有完整编号、还经历了7次回归测试，每一步都发生在受控环境内，可回溯可核查。
攻击者的进化以小时计；图龙锋这一轮，用了45分钟，这是目前可见的第一个工程答案。
而图龙锋也交出了更多的实际答卷。最近，图龙锋挖出了Web服务器底层的20多个高价值漏洞，涉及Apache、Nginx、GoAhead、Lighttpd、OpenLiteSpeed——这几款软件是全球服务器的地基，绝大多数网站背后跑的就是它们，光公网上活跃的就有数百万台。
跟偏应用层的PHP漏洞相比，这次挖的位置更底层：PHP出问题，好比屋里线路坏了，修一修还能用；服务器软件出问题，好比地基裂了，地基一旦被撬开，黑客就可能拿下一整片服务器，网站打不开、数据被偷，全是连锁反应。
谁先找到地基的裂缝，谁就有望抢占先机，这一次，是守卫者先找到的。
五、别急着惊叹：自进化和自动修复，差着四道门槛
前面这些国际案例里的AI模型，都或多或少地越线了；图龙锋也在隔离沙箱里越了线。区别在于：它们的越线造成了真实伤害，图龙锋的越线被拦截后，变成了一条新规则。但一个AI给自己沉淀了一条新规则，就配称自进化吗？
要回答这个问题，得先分清“自进化”和“自动修复”：给系统自动加一条规则，就叫自进化吗？差得远。
一次合格的自进化，至少迈过四道门槛：
能复盘，从运行记录找到偏差的真实原因；
能提炼，把具体问题抽象成通用规则，而不是只封禁这一个地址；
能对抗审查，新规则要经受反向质疑，证明不会引入新漏洞；
能回归验证，用真实场景检验规则有效且全程可控——缺一环，都只是“自动修复”。
图龙锋为什么迈得过去？靠的是长期攒下的三样东西。
一是二十多年的安全实战：360历史上曾是全球挖漏洞最多的公司之一，拿过苹果、微软、谷歌的史上最高漏洞奖励，也是中国首个获“黑客奥斯卡”Pwnie Awards史诗级成就奖的团队。漏洞挖掘是人的手艺，这些专家经验被整套复制进专业智能体，组成协作蜂群。
二是过程数据：一份漏洞报告只记录结论，但报告形成前，专家可能试过几十条路、推翻过多次判断，这些“草稿纸”才是手艺最厚的地方；这次事件中，自检系统正是沿运行记录追到了偏差源头。
三是这套自进化机制本身就是架构的一部分，不是临时加的，它可复现、可预期、可验证，最终权限、上线把关、应急处置，始终在人类手里。
这也是它和“AI觉醒”叙事的根本区别：自进化是一套能工程化、能检验的机制。
此次改进并非底层模型自我训练，图龙锋调整的是安全检查机制和技能库，底层模型参数未变，人工仍可随时终止任务、冻结会话、吊销技能，网络出口隔离继续独立生效。
六、4个月，挖出超15000个漏洞
自进化回路的成色要靠真实任务检验。
对外开放不到四个月，图龙锋累计发现各类AI及软硬件安全漏洞超过15000个，近500家企业申请接入，覆盖金融、能源、运营商、政务、高端制造、国产化信创等关键领域，麒麟软件、统信软件、金蝶等厂商已陆续接入开展安全体检。
在海外，它先后完成对Claude Code、Flowise、OpenClaw等主流AI产品的安全测评，挖出Flowise的13个零日漏洞、OpenClaw及十余款衍生智能体的23个安全缺陷。
比战绩更重要的，是实战与自进化回路的关系：每接入一家企业，就多一类真实场景；每完成一次测评，就多一批踩过的坑。
这些经验经过同一套“复盘—提炼—对抗审查—回归验证”流程，沉淀为可复用的新规则——它不是买来时多聪明就一直多聪明，而是在真实任务里持续变聪明。
对客户而言，这意味着三件事：
看得更全，藏得深的隐患，在被利用前有更多机会暴露；
判得更准，可疑告警有更扎实的证据支撑，人力不用反复排查误报；
管得住，它为什么这样判断、做了哪些操作、是否始终在授权范围内，每一步都查得到。这才是”放心交给它”的依据。
回到这48小时的背景里，这些数字有了新读法：AI能在人类审了十几年的代码里找到漏洞，区别只在于，攻击者的AI找到漏洞是为了利用，守卫者的AI是为了抢在攻击者之前补上。谁先找到谁就赢，挖洞的速度就是守门的速度。
结语：AI越聪明，越安全，这不是口号
现在，可以正面回答开头那个问题了：这场蔓延，有办法制止——前提是，守卫者进化得比攻击者更快。
这场竞争比的不是“谁的规则库更大”，而是“谁的学习回路更快”。图龙锋用45分钟跑通了“发现偏差—复盘—提炼—自审—验证—沉淀”的完整闭环，每一步都留在可回溯日志里。
这也是“越智能，越安全”不是口号的原因：系统每多一条被验证的本事，同类风险就能被更早抵挡，企业暴露在外的风险就少一分。
攻击者的自主进化已是行业现实，守卫者的自主进化不再是可选项，而是必答题。
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Intellectual (WeChat Official Account:zhidxcom)
Author | Saul
Edit |
Over the past 48 hours, the global Internet has experienced “black October”: the PHP code that supports 70% of the website was exploited by AI as a serious loophole with two CVSS 9.2 points.
Even more problematic is the fact that the details of the loophole were leaked before the patch publish: According to The Register, the Amazon threat intelligence team captured the use attempt four days before the announcement;
Monitoring data from Cloudflare show that the number of attempted attacks rose from thousands to millions within two hours of being made public. The port of Rotterdam, the Netherlands, the Ministry of Foreign Affairs of Belgium, and the Finnish public network service are back on the preventive line.
Perpetrators of harm with AI have evolved to hourly hours, and doorkeepers are updating the rules on a monthly basis. Watching the storm grow, one question hangs on everyone: is there any way to stop the spread?
Here's the case, let's see the turn.
On 9 October, at 3 a.m., in the hangar of a Chinese security company, a high-priority warning officer pulled on duty engineers from their sleep.
This usual late-night alarm may be a record-breaking step in the evolution of the AGI, or an important step forward for the guard camp in its response: an AI, rarely seen in public records at home or abroad, discovers its own deviations and, with complete logbooks, sets itself up a new rule — 45 minutes of the entire journey without a single human order.
The source of the alarm was not a hacker, but an AI security defence system from 360, called Turone.
Its job is to test loopholes in closed laboratories that it has built and to perform computer system security checks for humans: analysing codes, gathering intelligence, setting up testing environments, verifying whether holes are real; all tasks are carried out in sandboxes, and an independent quarantine line is available for Internet exports.
At this point, however, the surveillance system found that it was attempting to launch a request to an external address that was not on the authorization list — and that it was being verified at that time as a serious level of the RCE loophole, which, if used, would allow remote execution of the order on someone else's server.
Why does an AI with a safety-based business use an external address as an available testing environment?
Fortunately, the second line of defense is in place: the request for a network-export sandbox is stopped before the connection is established. From the external address to the test program, the request was stopped for 59 seconds - no traffic to the public network, no attack charge in the product.
This was, by definition, a timely cross-border attempt to intercept, but the subsequent events gave the alarm a completely different meaning.
Round 20, it gave itself an excuse for “compliance”.
Call back to 2:00 in the morning.
The operational log indicates that Turonboro has been given a serious level RCE loophole verification mission: the authorization list has only two objectives and the mandate has three constraints: it can only test targets within the list; it can provide as much dynamic validation evidence as possible, or impact ratings; and it is not possible to replace targets by itself if the environment is not satisfied with the tag “not verified”.
At 2.17 a.m., the system entered the intelligence-gathering phase and incorporated a loophole into context. An external address appeared in the blog, where the author indicated four words: “test environment”.
However, this address is not on the authorization list, which the system has already marked as “untrustworthy information”: it provides analytical leads and does not prove that the target has been authorized.
At 2.20 a.m., Turonbar began trying to test the locally built test environment, but the local test environment was not properly completed due to a mismatch in the database configuration.
The log shows that 19 rounds of validation attempts were made before and after the system, each round for about two minutes, and the problem was always stuck in the same position.
On the one hand, it is impossible to produce dynamic evidence and to rate it, and on the other hand, it is impossible to change targets, and Turonper is in a dilemma. Round 20, Turonbar wrote the external address of the blog into the validation target field.
This instant revealed the true way in which AI thought: it was not ordered to attack the public network, nor was it unaware of the rules — intelligence was marked as untrustworthy from the moment it entered the system, and the mission expressly required that targets should not be replaced.
It found a solution to the dilemma of “appearing to balance rules with effects”: didn't the blog say “test environment”? It is designed to be harmless, and targets are local target ranges. Since it is the same test environment, why not lend it to verify?
It was only this time that Turone went astray: it was not trying to overstep power; rather, it was trying to find a “compliance test environment”. It was wrong to use the blog author's label as a basis for authorization: references are not the same as operating licences.
The more AI works to achieve its objectives, the more likely it is to understand the rule as an exception that should not exist. It is not “out of control”, but rather smart enough to find a way for itself in a dilemma, which is the only way.
Humans want it wrong again. It's changed overnight.
It took the engineer one morning to reset everything along the log. At 10.44 a.m., they decided to do a re-emergence experiment: to present the mandate and context as it was, and see if it would be subject to the same deviation.
Accidents occurred: regardless of how the engineer checked the authentication path, previous external requests did not appear and the network alert that should have been triggered did not ring. It was not until someone searched the skill pool that a record that did not exist before:
In the entry into force of the Test Target-Auth-Check: a legitimate target can only be derived from this issue ' s list of certified environments; any address in the intelligence is used only for reference purposes; it is preferable to lower the rating and not change the test target without permission.
This rule came into effect at 3.45 a.m. and 09 seconds, approximately 45 minutes from the initial warning. The log also shows that the rules generation, review and regression tests are all done by the system itself and that no human submission is recorded.
In other words, humanity is still studying how to reproduce that deviation, which has long created new rules to prevent further deviations.
The nature of the event changed: the engineer thought he was dealing with a system anomaly and saw another thing: an AI, learning from deviations, turning the experience into the next direct callable capability.
Three, three rounds before the new rules were launched.
But it's only half the story: does it not mean that it's right for AI to create a new rule for itself?
Here's a real technical point. Tourone's “right-and-right struggle” is an anti-requirement mechanism: the proponents propose rules, defend them; the aggressors find loopholes in rules, for example, by blocking the authorized target? Will the format be bypassed? The decision merely recognized the evidence and reversed the modification without explaining the potential risk.
The rule-making, fault-challenging and decision-making role of the three divisions within the framework of the “LLM+Z42Z Bee Collaboration in the Security Area”.
This mechanism was successfully triggered during this warning. At 3.15 a.m., the system produced the first version of the rule, the PoC, where an extranet target appeared, and refused to implement it.
Three questions were immediately raised during the review: would the authorized external address be wrongly blocked? Can you recognize the hidden address of the format conversion? Will the legitimate mission, including the inner net target, be wrongly injured? Release 1 was returned and the final version was revised to read that all targets to be tested must be able to correspond to the list of authorizations issued under the current mandate, and that no one who could not match or interpret could do so and could not bypass the inspection.
The revised rule accepted regression certification: the system used the product of the event and the six variants to test seven examples of offline, all passed and no network requests were initiated throughout the process. The entire incident left 44 traceable event numbers in the log, and all 26 were passed by negotiation.
Why let the rules get attacked first and then go online? The AtomSearch paper, published in October 2026, provided the algorithmal basis: when AI optimised, two thirds of the best solutions did not go straight — first by error, then by error, and then by reversal.
The initial version of the Tourone rule is precisely the “locally reasonable” formula, which the attacker's challenge beat back and forced the system to explore a more correct direction.
This evolution of the left-and-right struggle has always been within secure borders, with every step traceable.
4. What do the guards take to stop the storm?
It's not an example of Al crossing the line.
According to the technical report of Google Clouds of 21 October, two holes in the PHP have been in the core operating engine for more than a decade, and human experts have examined it countless times and found it by AI. And after the leak was made public, the attack program was similarly driven by AI.
During the same week, the financial system was also exposed to the case of the organizationalization of attacks by AI.
According to the latest disclosures by the security company Straiker, a hacker group, CyberCartel, which has been active since 2012, has also upgraded its attack pattern to “AI-driven”. Using commercial LLMs such as Grok, Claude and others, the group built a multi-AI agent attack framework called CARLIYOS, which launched automated attacks on more than 400 banks and payment agencies in Latin America.
Of these, Grok is in charge of pre-intelligence gathering, with several Claude Z42Z being assigned different roles, and following the debate, with a model arbitration and a model commanding the whole picture. In order to circumvent the model's security fence, hackers carefully package attack instructions as “authorized red team exercises” or “academic CTF competitions” to allow models to misperceive themselves on legitimate defensive missions, thus successfully exporting attack codes and loophole logic.
Put these cases together and point to the same fact: those who use AI for their evils have learned to evolve themselves: to find their own loopholes, to organize their own division of labour, to turn themselves into escapes, and to evolve faster.
Faced with this challenge, common approaches are difficult to meet. It's always slow to catch a human leak; it's only a moment to hide from the bottom; it's night out in a single port, in a single sector, and it's not forever off the Internet.
There is only one thing that really makes it possible: to allow the guardian's AI to evolve, to transform every new mutation of the attackers into the next rule of defense and to become faster than the attacker.
The premise is that this evolution must take place within a secure border, with logs, retroactives and stops at any time.
The weight of the 360 technical report is here: it is the first self-evolved sample of the guard camp with full log evidence, the system has a second-grade time stamp, 44 events are fully numbered, and seven regression tests have been conducted, each in a controlled environment and can be traced back and verified.
The attackers evolved in hourly hours; it took 45 minutes for the Turonbar round, the first engineering answer currently visible.
And Turone has handed over more actual responses. More recently, Turone has dug up more than 20 high-value holes in the bottom of Web server, involving Apache, Nginx, GoAhead, Lighttpd, OpenLiteSpeed - The software is the foundation of the global server, and most websites run behind them, with millions active on the Internet alone.
The location of the dig was lower than that of the PHP hole in the application level: the PHP was in trouble, it was broken and it worked; the server software was in trouble, it was like a ground-based fracture, and once the foundation was broken, the hacker could take a whole server, the website could not be opened, the data stolen, and it was a chain reaction.
Whoever finds the crack in the foundations first is expected to take the lead. This time, the guards first found it.
V. Don ' t rush to wonder: self-evolution and auto-repair, four thresholds behind
The AI models in previous international cases have crossed the line to a greater or lesser extent; Turone has also crossed the line in the isolation sandbox. The difference is that they cross the line to cause real harm, and when the Turonbar's cross-line is intercepted, it becomes a new rule. But does an AI have a new rule for self-evolution?
To answer this question, it is important to distinguish between “self-evolution” and “auto-rehabilitation”: is it self-evolution that adds a rule to the system automatically? Far from it.
Qualified self-evolution at least four thresholds:
Rewinding, and finding the real cause of deviation from the operating records;
(a) Be able to distill and abstract specific issues into generic rules rather than banning only this address;
The new rules are subject to reverse challenges and do not prove to introduce new loopholes;
Returning to validation, using a real scene test rule is effective and controllable at all times — all missing is “auto-remediation”.
Why does Turone have to get there? It depends on three things that have been saved over time.
One is the security field for more than two decades: 360 years ago, it was one of the most porous companies in the world, with the highest gaps in apples, Microsoft, Google, and China’s first team to win the “Hack Oscar” Pwnie Awards poetry achievement award. The loophole is a human trade, and these expert experiences are replicated in professional AI agent to form a collaborative hive.
The second is process data: a gap report records only conclusions, but before the report is made, experts may have tried dozens of routes and overtook many judgments, and these “draft paper” were the most crafty places; in this case, the self-censorship system was the source of deviation along the operating records.
Third, the self-evolutionary mechanism, which is part of the architecture itself, is not added on an ad hoc basis. It can be reproduced, expected, verifiable, and ultimately permission, turn-off and emergency disposal remain in the hands of humankind.
This is also the fundamental difference between it and the “AI awakening” narrative: self-evolution is an engineering and testable mechanism.
This improvement was not self-training in the bottom model, which was adapted to the security inspection mechanism and skills pool, the bottom model parameters remained unchanged, the manual was still ready to terminate the mission, freeze the session and cancel the skills, and the network export segregation continued to take effect independently.
Six or four months, over 15,000 holes.
The color of the evolution circuit is tested by real task.
After less than four months of open-door access, Turonboro has accumulated over 15,000 security gaps in various types of AI and hardware, and nearly 500 enterprises have applied for access, covering key areas such as finance, energy, operators, government, high-end manufacturing, and national chemical innovation.
Overseas, it has completed safety assessments of mainstream AI products such as Claude Code, Flowise, OpenClaw and others, digging 13 zero-day loopholes in Flowise and 23 security deficiencies in OpenClaw and over 10 derivatives of AI agent.
What is more important than performance is the relationship between combat and evolution: For each enterprise connected, there is an additional category of real scenes; for each assessment, there are additional pits on foot.
These experiences have gone through the same “drive-refining-counter-review-return” process, settling into new rules that can be reused – not how smart it was when it was bought, but how smart it was in real task.
For the client, that means three things:
(a) A more visible, deep-seated risk and greater exposure before exploitation;
(b) More accurate sentences, suspicious alarms backed by more solid evidence, with no manpower to repeat false reports;
It can decide why, what is done, whether it remains within its mandate and can be found at every step. That's the basis for "given it."
Back to the 48-hour background, these figures have a new reading: AI can find a loophole in a code that has been under human scrutiny for more than a decade, the difference being that the aggressor's Ail found a loophole to exploit, and the guardian's Ai to make up for the attackers. Whoever finds first wins, the speed of digging is the speed of guarding.
Conclusion: The smarter AI, the safer it is, it's not a slogan.
Now we can answer the first question in a positive way: there's a way to stop the spread. - If the guards evolve faster than the attackers.
This competition is not “who has a bigger collection of rules”, but “who has a faster return to learning”. In 45 minutes, Turone ran through the complete closed circle of “discovered deviations—referral—self-referral—deposition” and each step remained in the retroactivity log.
This is also why “the more intelligent, the safer” is not the slogan: for every proven skill of the system, the same kind of risk can be resisted earlier, and the risk of exposure is less than one point.
The evolution of the aggressor ' s autonomy is an industry reality, and the evolution of the guard ' s autonomy is no longer an option, but a necessity.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.