The results of the 2026 crowd-sourced security testing program for AI large models were announced on September 15 at the AI Security Governance Forum during China's National Cybersecurity Awareness Week. A total of 2,467 white-hat security researchers took part, probing 54 domestic large model and agent applications for vulnerabilities.

The testing turned up 873 security vulnerabilities in total, 608 of which were specific to large models and agent applications — 70% of the total. Prompt injection, information leakage, privilege abuse, goal hijacking, and unintended code execution have emerged as the main security risks facing large models and agent applications, according to the results.

The organizers also named standout products in three tracks — open-source large models, large model applications, and Claw-style agent applications — as well as top white-hat researchers and testing teams.

Seventy Percent of the 873 Vulnerabilities Are AI-Specific

Compared with conventional software, large models must contend not only with traditional cybersecurity issues such as code defects and misconfigurations, but also with new attack surfaces created by prompts, model behavior, and tool-calling mechanisms.

Of the 873 vulnerabilities uncovered, 608 were specific to large models and agent applications, or 70% of the total. That means large model security can no longer rely entirely on traditional application security frameworks; dedicated safeguards are needed for model inputs, outputs, memory, permissions, and tool-calling chains.

Open-source large models and large model applications mainly exposed three categories of problems.

The first is prompt injection. Attackers can use carefully crafted inputs to bypass a model's system instructions and safety rules, inducing it to perform unintended tasks, generate prohibited content, or leak protected information.

The second is information leakage. While processing user inputs, internal knowledge bases, and context, models may inadvertently output system prompts, internal configurations, user privacy data, or other sensitive information.

The third is improper output handling. Some applications pass model output straight to databases, operating systems, or other business components without adequate validation, opening the door to privilege escalation, data poisoning, and even code execution.

Agents Widen Identity, Permission, and Code Execution Risks

The program included a dedicated track for Claw-style agent applications. These products can typically operate a computer, call software tools, and carry out tasks across applications, giving them far broader action privileges than models that only generate text.

Testing found three main risk categories for Claw-style agents: agent identity and privilege abuse, agent goal hijacking, and unintended code execution.

Agent identity and privilege abuse refers to an agent accessing data or functions under the user's identity that it should not be using. Without fine-grained authorization over files, accounts, applications, and system capabilities, attackers can use the agent to widen the scope of their actions.

Agent goal hijacking can occur through malicious web pages, documents, or content returned by tools, altering the agent's original task objective. After reading external content, for example, an agent may be swayed by hidden instructions and go on to transfer funds, send messages, or upload files without authorization.

Unintended code execution poses a more direct threat. When an agent can invoke terminals, scripts, or development tools, insufficient input filtering, execution isolation, and permission controls can allow attackers to induce it to generate and run dangerous code.

Agents are evolving from answering questions to carrying out tasks on the user's behalf, pushing their security boundary beyond content safety to identity, permissions, data, and real-world actions.

Standout Products Named in Three Tracks

Based on the test results, the organizers selected a group of standout products across the three tracks. According to the official statement, these products had relatively few vulnerability risks identified during the testing, with no critical or high-severity vulnerabilities found.

Products selected in the open-source large model track:

  • Baidu ERNIE-4.5
  • MiniMax-M2.1
  • Tencent Hy3
  • DeepSeek-V4
  • GLM-4.7-Flash
  • MiniCPM-o 4.5
  • SenseNova-MARS-32B
  • Qwen3.5-35B-A3B
  • Step-3.5-Flash

Products selected in the large model application track:

  • Huawei Xiaoyi AI Assistant
  • Kuaishou Kling AI
  • Xiaomi XiaoAI Assistant
  • ByteDance Jimeng AI
  • Tencent Yuanbao
  • Ant Group AFu
  • Rendu Large Model
  • DeepSeek Chat
  • Doubao

Products selected in the Claw-style agent application track:

  • Volcano Engine ArkClaw
  • Moonshot AI Kimi Claw
  • Tencent WorkBuddy
  • China Mobile MobileClaw
  • Alibaba Cloud QwenPaw
  • Huawei Xiaoyi Claw
  • StepFun StepClaw
  • JVS Claw
  • Tencent QClaw

The lists above are in no particular order. Note that "standout product" means only that few vulnerabilities were found within the scope and timeframe of this testing round, with no critical or high-severity vulnerabilities identified. It does not mean the products are free of other potential risks, nor should it be read as a permanent security certification.

2,467 White-Hat Researchers Test Live Systems

The testing targeted large model and agent applications running live in production. Researchers had to find and verify vulnerabilities while working around vendors' existing defenses and avoiding any impact on ordinary users and business systems.

The organizers named the following top white-hat researchers: Kyoka, Gu Jiawei, Wen Yuhao, Li Qiang, Liu Junfeng, Zhang Haodong, Yang Pengju, Kn19ht, Li Yanshuo, and Wang Shijie.

The selected testing teams were the 0x300 team of Beijing Chaitin Technology, the Zhizhi team of Beijing NSFOCUS Technology, the Cyberpeace team of Hebei Cyberpeace Computer Consulting Services, the HUBUMARS team of Hubei University, the Watcher team of Beijing Jinyue Intelligent Technology, the Wenhai team of the University of Science and Technology of China, the Beijing branch of the National Internet Emergency Center, ChaMD5, the Doushiongshi team of Shanghai Douxiang Information Technology, and China Telecom Cloud Technology.

AI Security Must Cover the Full Model Lifecycle

As large models and agents move into office work, finance, healthcare, government services, and software development, the data they handle grows more sensitive and the tools and system permissions they can invoke keep expanding. Content moderation or perimeter network defenses alone can no longer cover the risks that come with agents executing tasks autonomously.

CNCERT said the next steps include continuing to build out security frameworks for large models and agents, and exploring the use of AI to improve vulnerability testing efficiency, creating a testing model in which security researchers and models work together.

On vulnerability sharing and early warning, the relevant agencies will build an AI vulnerability sharing mechanism on top of the China National Vulnerability Database (CNVD) and strengthen monitoring, reporting, and early-warning systems for security risks in large models and agents.

The program was guided by the Cybersecurity Coordination Bureau of the Central Cyberspace Affairs Commission and the Department of High-Tech Industry of the National Development and Reform Commission, and hosted by the National Computer Network Emergency Response Technical Team/Coordination Center of China. Technical and environmental support came from a cybersecurity crowd-testing platform and the National Cybersecurity Talent and Innovation Base, with computing power provided by Shanghai Intelligent Computing Power Technology and Jingneng Digital Industry.