[On-site] “Vulnerability Discovery Is Now a 'Token Economy' ... The Age of Bug Floods Has Arrived”
IT DAILY ·
✦ AI Summary
On the 21st local time, Kaspersky's Security Analyst Summit 2026 (SAS 2026) was held in Bali, Indonesia.
Feng Zhiniang, an associate professor and doctor at Huazhong University of Science and Technology, presented his experience researching LLM-based vulnerability discovery and explained that the vulnerability detection process has changed along with the development of LLMs.
He said that even complex zero-day vulnerabilities can now be detected by deploying more than 10,000 AI agents and investing dozens of hours, and that the key variable is token usage rather than technology.
On the 21st local time, Kaspersky's Security Analyst Summit 2026 (SAS 2026) was held in Bali, Indonesia.
At the event, Feng Zhiniang, an associate professor and doctor at Huazhong University of Science and Technology, presented his experience researching LLM-based vulnerability discovery and explained that the vulnerability detection process has changed along with the development of LLM technology.
Feng Zhiniang said that even complex zero-day vulnerabilities can now be detected by deploying more than 10,000 AI agents and investing dozens of hours. He explained that this change has happened in just the past six months, and said the key variable in vulnerability discovery is token usage, not technology.
Almost all white hat hackers now use AI for vulnerability hunting, and the field has shifted to an era in which vulnerabilities can be found with only instructions and code provided. The period over which this change took place is about 3 years.
Dr. Feng introduced a case from 2023 in which LLM-based vulnerability detection failed. Meta's open-source model codeLLaMa used tens of thousands of bugs as fine-tuning data, but even after fine-tuning, it failed to detect any truly meaningful vulnerabilities. At the time, the cause was AI's lack of understanding of the security environment context.
This problem was solved in about 2 years. The background for the solution included the release of high-performance models from OpenAI and Anthropic that can understand long contexts, as well as tools such as the Model Context Protocol (MCP).
At present, AI has reached a level where it can detect vulnerabilities and also verify the vulnerabilities it finds. Feng said that Anthropic's Claude Opus 4.6 and 4.8 versions can detect more than 200 Microsoft Windows vulnerabilities.
Feng said that even with most AI models, bug-hunting automation is almost possible. He added that state-of-the-art (SOAT, State of the Art) models can detect vulnerabilities with only user instructions. He also noted that AI is very easily analyzing previously accumulated vulnerabilities.
In line with this change, the core shift has moved from AI performance and technology to tokens. Feng described this as the 'token economy' of bug hunting. He said a plan priced at KRW 290,000 per month is insufficient for zero-day vulnerability hunting and exploit chain generation for abuse, but that this limitation could be overcome if 10,000 agents based on state-of-the-art models are operated for 88 hours.
Given this situation, the current environment was described as the 'age of the bug flood.' While AI is uncovering existing vulnerabilities on a massive scale, patching all vulnerabilities takes a long time. As a result, the accumulation of vulnerabilities is growing more severe.
While mentioning AI's potential for further development, the speaker also said AI will eventually reach its limits, and explained that the role of vulnerability research is to support AI's development so it can push beyond those limits.
Source: IT DAILY · Kim Ho-jun
Original: https://www.itdaily.kr/news/articleView.html?idxno=242349
References
This article was produced with the help of an automated content generation algorithm.
Source: IT DAILY
View originalThis article was summarized and organized by BizCrush based on the original article from IT DAILY. For exact quotations and full details, please refer to the original article.