AI Agent Automated Vulnerability Discovery: A Complete SRC Workflow Guide

Vulnerability discovery is undergoing an efficiency revolution. The old model—security engineers manually browsing sites, capturing packets, analyzing, and writing reports—is now being deeply reshaped by AI agents. According to hands-on experience shared by a Bilibili creator, someone submitted over 14,000 vulnerabilities in a single year with the help of AI agents, whereas the traditional approach typically yields only dozens to a hundred in the same timeframe. Behind this gap is not AI replacing security personnel, but AI agents taking over repetitive work so that humans can focus on decision-making and verification.

Why Traditional SRC Vulnerability Discovery Is Inefficient

Traditional vulnerability discovery follows a widely used "universal three-step method": Step one, fully visit the target site to understand its functional structure, tech stack, and data interfaces, covering all flows such as registration, login, payment, and refunds. Step two, capture and analyze every access path, parameter, and request process, identify potential risk points, tamper with parameters, and submit them to the target site to determine whether a vulnerability exists. Step three, verify the vulnerability and write a report, which must include four elements: URL, reproduction steps, impact assessment, and remediation recommendations.

All three steps rely on manual effort, and efficiency is strongly correlated with experience—the more experienced, the more efficient; beginners face high trial-and-error costs due to lack of hands-on accumulation. As for tools, Nmap, Telnet, NC, Burp Suite, and others can assist with scanning, but the results they produce require human judgment to determine authenticity. For example, if port 22 or port 3306 is found open, whether this is a real vulnerability or just normal configuration depends entirely on the security professional's experience to verify.

The learning barrier is not in the knowledge itself, but in how much experience is accumulated and how much time is invested. This is why many beginners still cannot enter an effective vulnerability-hunting state after completing courses.

SRC (Security Response Center) is a vulnerability intake and reward mechanism established by enterprises or platforms. White-hat researchers submit discovered vulnerabilities through SRC platforms, and vendors grant points, bounties, or recognition upon confirmation. The SRC model centralizes previously scattered vulnerability reports into a unified channel, giving enterprises access to external security talent while providing researchers with a compliant monetization path. For vulnerability hunters, SRC efficiency directly determines income—how many valid vulnerabilities can be submitted in the same amount of time is the core metric of productivity. Therefore, when AI agents increase vulnerability output per unit time by two orders of magnitude, the impact on the SRC ecosystem is structural.

What Changed in the Three-Step Method with AI

With AI introduced, every stage of vulnerability discovery has been redefined.

Information gathering stage: AI can first "sweep" the target. It automatically visits the web server, identifies the backend architecture, frontend form, authentication method, database type and access method, inventories functional modules and routing entry points, marks the business meaning and parameter forms of each entry, and ultimately outputs a structured asset list. Security personnel only need to review—no need to collect manually from scratch. According to the Bilibili creator's analysis, this step makes "understanding the target" highly efficient.

Analysis and filtering stage: AI performs intelligent analysis and false-positive filtering. Faced with massive scan results, AI provides testing ideas, explains unfamiliar code, filters out most false positives, and focuses on truly high-risk and medium-risk issues. Humans only deeply test valuable problems, directly discarding low-risk or invalid results to avoid wasting time on screening.

Report generation stage: AI can invoke security tools, execute commands, analyze results, and automatically generate a draft based on the four elements of a vulnerability report. But it must be emphasized: AI generates only a draft. Before final submission, humans must review the validity of URLs, the accuracy of reproduction steps, and the correctness of impact assessments. Submitting AI reports directly could risk being blacklisted by the platform.

Information gathering stage: AI can first "sweep" the target. It automatically visits the web server, identifies the backend architecture, frontend form, authentication method, database type and access method, inventories functional modules and routing entry points, marks the business meaning and parameter forms of each entry, and ultimately outputs a structured asset list. Security personnel only need to review—no need to collect manually from scratch. According to the Bilibili creator's analysis, this step makes "understanding the target" highly efficient.

Key Insight: AI Agents Are Not Chatbots

There is a core distinction that is easily overlooked: the AI that can truly participate in vulnerability hunting is not a one-question-one-answer chat tool on a webpage, but an AI Agent capable of executing tools, making continuous judgments, and autonomously orchestrating steps.

The difference between the two is enormous. Chat-based AI can only answer questions and cannot operate security tools; AI Agents can read project files, analyze code logic, identify security issues, execute probing or testing commands, and even invoke security tools to complete penetration testing. According to the creator, Codex, Claude, Workbody, Trade, OpenClaw^Ad, and various Agent frameworks all fall into this category.

Understanding this is important: if you only use chat AI to assist with vulnerability hunting, the efficiency gain is limited; only by introducing Agents that can autonomously execute tasks can you truly transform your workflow.

The essential difference between AI Agents and chat-based AI lies in whether they possess "tool calling" and "task orchestration" capabilities. Chat-based AI can only provide one-off answers based on existing knowledge and cannot read local files, execute commands, or operate external software. AI Agents, through mechanisms such as function calling, code execution sandboxes, and browser automation, enable large models to continuously observe the environment, make decisions, invoke tools, and then adjust the next action based on returned results, forming a "perception—decision—execution" loop. In penetration testing scenarios, this means Agents can autonomously complete continuous steps such as port probing, parameter fuzzing, and result comparison, while chat AI can only offer suggestions. Understanding this distinction is essential to understanding why Agents can increase vulnerability-hunting efficiency by a hundredfold.

The Core Value and Boundaries of AI Agent Vulnerability Hunting

The core value brought by AI Agents can be summarized in three points. First, lowering the learning barrier. Cybersecurity itself is a comprehensive discipline with many tools and a steep learning curve, and the trial-and-error cost for beginners is high. AI Agents deeply participate in information gathering, data analysis, and command execution, with humans only responsible for decision-making and verification, greatly reducing the difficulty of getting started. Second, significantly improved efficiency. The leap from dozens of vulnerabilities a year to over 14,000 a year relies on Agents taking over repetitive processes. Third, allowing people to focus on high-value stages. Security personnel are freed from tedious tool operations and result screening, focusing on vulnerability verification and report quality control.

But the boundaries are equally clear. AI Agents do not replace humans in vulnerability hunting; rather, they make work that originally depended on long-term experience accumulation actionable. The final decision-making power remains in human hands—whether a vulnerability truly exists, whether the reproduction is accurate, and whether the impact is real all require human confirmation. AI handles efficiency; humans handle quality control. This is the reasonable positioning of AI-assisted vulnerability discovery at the current stage.

False positives and false negatives are a pair of core concepts in vulnerability discovery. False positives refer to scanners or tools reporting vulnerabilities that do not actually exist; false negatives refer to real vulnerabilities not being detected. Traditional tools often have high false-positive rates, requiring security personnel to manually verify each one, consuming large amounts of time on eliminating false positives. The value of AI in the analysis and filtering stage is precisely to use its understanding of code logic, response characteristics, and context to filter out clearly impossible alerts, allowing human attention to focus on truly high-risk issues. What needs vigilance is that AI may also introduce new false positives—it may misjudge normal configuration as a vulnerability or exaggerate impact in draft reports. Therefore, manual review is not only a compliance requirement but also a necessary step to control false positives and maintain researcher credibility.

One-line Summary

AI Agents take over repetitive work, letting people focus on decisions and verification, boosting vulnerability discovery efficiency a hundredfold.

Paragraph Summary

The article explores how AI Agents are transforming vulnerability discovery. Traditional SRC hunting relies on a manual three-step method—information gathering, packet analysis, and report writing—with efficiency strongly tied to experience and high barriers for beginners. With AI, information gathering can automatically inventory assets, the analysis stage can filter false positives and focus on high-risk issues, and the report stage can generate drafts based on four elements. But the key distinction is: the AI that can truly participate in hunting is an AI Agent capable of executing tools and making continuous judgments, not a one-question-one-answer chat AI. Some security professionals have submitted over 14,000 vulnerabilities in a year with Agents, far exceeding the dozens to a hundred from traditional methods. The core positioning is that AI handles efficiency and humans handle quality control, with manual review required before final submission to verify vulnerability authenticity.