Wiz演示Gemini 4在网络安全漏洞挖掘中的实战能力
Using Gemini 4 Argon to protect against Cyber attackers
展示了前沿模型在垂直领域（网络安全）的具体落地效果与实测数据，对关注AI Agent实际效能与安全落地的从业者有参考价值。
South Green 30 seconds, bus track.
南格林30秒，公交轨道。
Any successful cyber attack could cause real harm.
任何成功的网络攻击都可能造成实际损害。
Sophisticated cyber attacks would have threatened the backbone of our national security.
复杂的网络攻击将威胁我们国家安全的骨干体系。
So, our job as researchers at Wiz is to help the security teams catch up. I want us to take those critical vulnerabilities that were super complex to find before and help organizations fix them in less than a day. When we use Gemini 4 in shadow AB testing on real-world systems, we saw that it was able to find over two times more vulnerabilities than other baseline models while using less tokens. After we saw the incredible performance of Gemini 4 on short horizon tasks, we've also put it to the test for longer ones.
因此，我们在Wiz作为研究人员的工作是帮助安全团队迎头赶上。我希望我们能够找出那些此前极其难以发现的严重漏洞，并帮助组织在一天之内修复它们。当我们在真实系统上使用Gemini 4进行影子AB测试时，我们发现它发现的安全漏洞数量比其他基线模型多出两倍以上，同时使用的token更少。在看到Gemini 4在短期任务上表现出的惊人性能后，我们也对其进行了更长期任务的测试。
What we saw is a huge jump compared to the other models we tested. It knows how to work tirelessly for hours, chaining complex vulnerabilities and signals to find very critical risks we weren't able to find before using other sort of models. Recently, we've announced Hack for Good in collaboration with Google DeepMind. This is where we use Gemini 4 to scan public websites of governments, hospitals, and critical infrastructure.
与我们测试的其他模型相比，我们看到的是巨大的飞跃。它知道如何不知疲倦地工作数小时，将复杂漏洞和信号串联起来，以发现以前使用其他类型模型无法找到的非常关键的风险。最近，我们与Google DeepMind合作宣布了“Hack for Good”项目。在这里，我们使用Gemini 4扫描政府、医院和关键基础设施的公共网站。
We find vulnerabilities and help remediate them. And in a health care software, Gemini found that there was a public file download feature which could be bypassed to download internal files from the underlying system. Gemini 4 was able to identify a configuration file which included inside it the master key for the application. Using read-only operations, it turned this master key into administrator access. Then it found out the actual blast radius.
我们寻找漏洞并帮助修复它们。在一款医疗软件中，Gemini发现存在一个公开的文件下载功能，该功能可被绕过以从底层系统下载内部文件。Gemini 4能够识别出一个包含应用程序主密钥的配置文件。通过只读操作，它将这个主密钥转化为管理员访问权限。然后它确定了实际的爆炸半径。
It means that attackers could have gained access, pretty much control the systems without the operators actually knowing it. So, we fixed this one vulnerability using the jump of Frontier AI capabilities to protect a lot of sensitive information. Now that we've seen what Gemini 4 can actually do in terms of its cyber capabilities, we believe defenders have the advantage of finding and fixing vulnerabilities pretty much faster than ever before and outpacing attackers.
这意味着攻击者几乎可以在操作人员不知情的情况下获得访问权并控制系统。因此，我们利用前沿AI能力的飞跃修复了这一漏洞，从而保护了大量敏感信息。现在我们已经看到了Gemini 4在网络能力方面的实际表现，我们相信防御者在发现和修复漏洞方面拥有比以往任何时候都快于攻击者的优势。
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力