做AI代理开发的团队，安全风险已经从模型能力转向运行时行为，360的23个漏洞案例值得你仔细研究，建议保存这条线程。
Anthropic的Mythos模型在curl代码库中发现1个真实漏洞，而中国360团队的安全代理在OpenClaw生态中独立发现23个漏洞，包括远程代码执行和提示注入绕过。这表明AI安全的核心问题已从模型能否找到漏洞，转向代理的运行时行为——代码、提示、工具、本地服务和权限在系统触及文件、打开端口或运行命令前的交互。对于构建代理的开发者，理解这些运行时风险至关重要。
In the agents era, AI security story right now is …
In the agents era, AI security story right now is not whether models can find bugs.
Anthropic’s “dangerously good” Mythos found 1 real bug in real curl codebase.
But 360’s (a security team from China) vulnerability mining agent independently found 23 flaws across the broader OpenClaw ecosystem, including critical remote code execution bugs and large-scale prompt-injection bypasses.
The real agent-security problem is runtime behavior: code, prompts, tools, local services, and permissions interacting before the system touches files, opens ports, or runs commands.
If you are building agents, this thread deserves a saved spot. 🧵↓