AI Agents in Action: From Chat Tools to Automated Vulnerability Discovery — A Practical Guide

Will AI Find Vulnerabilities for Us? Are Security Engineers at Risk of Being Replaced?

With the explosive rise of large language models and AI agents, one question keeps surfacing among cybersecurity professionals: Can AI really find vulnerabilities on its own, conduct code audits, and solve CTF challenges? And if so, are security engineers headed for unemployment?

According to hands-on insights shared by "Wuya" (无牙老师), a security instructor on Bilibili's Mashi Group channel, the answer isn't so straightforward. AI is genuinely transforming how the cybersecurity industry operates — but the key is whether you've truly grasped the "agent" paradigm, rather than staying stuck at the beginner stage of treating AI as just another chat tool.

Wuya has been working in security since 2016, spanning malware analysis, penetration testing, and security system development. In recent years, he's focused his research on the intersection of AI and security. He emphasizes one non-negotiable principle: no matter how powerful the techniques you learn, they must never be used for illegal purposes — a red line every security learner must never cross.

From AI Chat Tools to Agents: What's the Fundamental Difference?

The Ceiling of Chat Tools

These days, nearly everyone — from toddlers to grandparents — has used AI chat tools like DeepSeek, Doubao, or Kimi. But these tools share one obvious limitation: they can tell you how to do something, but they can't actually do it for you.

Take a practical example: ask Doubao to build a subdomain brute-force tool for you. It'll outline the feature list, choose Python as the implementation language, and provide the dependencies and code. But everything after that is still on you — copy the code into an editor, save it as a .py file, right-click to run it; if there's an error, paste the error message back, get updated code, and repeat the whole loop. This back-and-forth "you talk, I revise" workflow is painfully inefficient.

Agents Are the AI Form We Actually Need

The ideal AI agent works like this: you hand it a goal, and it writes the code, compiles and packages it, runs tests, debugs errors autonomously, and delivers the final result. Not just talking — actually doing.

The Six Core Capabilities of an AI Agent

What does an AI tool need to qualify as a true "agent"? Here are six core capabilities, illustrated through the example task of building a subdomain brute-force tool:

Autonomous Perception

An agent can perceive its working environment: Are there existing files and code in the current folder? If so, this is a refactoring task; if the folder is empty, it's a greenfield project. It can also monitor real-time OS status — port usage, memory consumption, and so on.

Autonomous Planning

Based on the user's requirements, the agent breaks down what features are needed, determines the implementation sequence, and decides which config files to create first. Some chat tools have rudimentary planning ability, but agents do this far more systematically.

Autonomous Decision-Making

When an error occurs mid-execution, the agent independently judges which solution to apply — rather than throwing the choice back at the user.

Execution Capability

This is the biggest dividing line between AI agents and chat tools. An agent can directly create files on your computer, package programs, and run code — genuinely "doing" rather than just "saying."

Memory

For a complex task that spans multiple rounds of interaction, the agent must remember all previously established context. Tools without memory treat every conversation as isolated, making it impossible to complete coherent, multi-step tasks.

External Tool Invocation

Agents can connect to databases, open a browser to search the web, execute OS-level commands, and more. This ability to call external tools is precisely what enables them to handle real-world security testing tasks.

With these capabilities in place, an agent can take on relatively complex tasks, autonomously driving progress through a loop of perceive current state → break down and execute → invoke tools → review progress → iterate further — until the objective is complete. This iterative loop mechanism is the defining soul of agents as distinct from traditional AI tools.

Two Major Agent Categories: Programming Agents vs. General-Purpose Agents

AI agents available today broadly fall into two categories, each with its own focus and use cases.

Programming Agents: Productivity Multipliers for Developers

Programming agents are purpose-built for development projects. Whatever language you use, whatever product form you need — desktop software, WeChat mini-programs, Android/iOS apps, or browser extensions — they can handle it. Both domestic and international products exist in this category, and they are especially useful for rapid development of security tools.

General-Purpose Agents: Covering Learning and Productivity Workflows

General-purpose agents, exemplified by Manus, have been experiencing a recent surge. Thanks to their open-source nature, anyone can install one on their own computer or server and use it for a wide variety of complex tasks.

General-purpose agents are primarily oriented toward learning and productivity tasks — data organization, file management, document drafting — though they can also write code, just without the specialization of dedicated programming agents. According to Wuya, the number of domestic products built on top of open-source agent frameworks has grown dramatically; Tencent alone has released multiple products in this space, and the total across the industry may already exceed one thousand.

Key Takeaways for Security Professionals

Back to the original question: will AI make security engineers unemployed? Based on the thinking conveyed in this session, the answer is no — but people who don't master agents may well be displaced by those who do.

AI agents are becoming powerful assistants for penetration testing, code auditing, CTF solving, and similar scenarios. They can automate large volumes of repetitive tool development and information-gathering work. However, genuine vulnerability discovery intuition, business logic comprehension, and attack-defense decision-making still require solid, foundational security expertise.

For those starting from zero, the right path isn't fantasizing that "just learning AI vulnerability hunting is enough." It's about using AI agents as productivity tools, deeply integrated with the core knowledge base of cybersecurity. As Wuya's motto goes — diligent practice leads to natural mastery. The technical moat is always built on a deep understanding of underlying principles.