大多数人认为网络安全的主要挑战是发现漏洞，因为传统上找到安全漏洞需要专业知识和时间。但作者认为，随着AI加速了漏洞发现过程，现在的主要瓶颈已经转变为修复漏洞，因为发现的漏洞数量已经远超防御者的处理能力。

• Distributed AI Training and Scraping: AI companies require massive amounts of web-scraped data for training, search, and agent grounding. Because traditional data centers face heavy blocking and throttling by security services (like Cloudflare and DataDome), scrapers rely on residential proxy networks to route traffic through home internet connections.
• Bright Data's SDK Network: Bright Data operates a massive commercial residential proxy network (marketing over 150M+ to 400M+ IPs). They source these exit nodes by embedding a consent-based Software Development Kit (SDK) inside consumer-facing mobile apps and Connected TV (CTV) / Smart TV applications.
• Why Smart TVs are the Ideal Proxies: Compared to mobile phones, Smart TVs provide a near-perfect infrastructure for proxy routing:
  • They are permanently connected to high-speed home Wi-Fi and grid power (no battery constraints).
  • They run 24/7 in standby mode and offer effectively unlimited bandwidth.
  • They operate largely unattended with virtually no corporate or family oversight.
  • The consent UI on TVs is typically dense text navigated via remote arrow keys, making it unlikely for users to understand that their bandwidth is being sold to third-party scrapers.
• Deceptive Allocation Limits: While opt-in prompts (such as in the Roku app Petflix) claim the SDK "occasionally" uses free resources, the underlying, publicly queryable SDK configuration sets a massive monthly default Wi-Fi budget of up to 200 GB (max_bw_monthly_wifi: 200,000,000,000 bytes).
• Notable SDK Integration Partners: Public, unauthenticated partner manifest endpoints expose integrations with platforms reaching hundreds of millions of households, including:
  • PlayWorks Digital Ltd: Over 400 CTV game titles across Comcast, Sky, Cox, LG, Samsung, Vizio, and Roku.
  • CloudTV: Integrated across more than 125 TV brands and 15+ OEMs.
  • Viber Media (Rakuten): Massive messaging app ecosystem.
  • Supercent & Moonfrog Labs: Major mobile game publishers.
• Technical Reverse-Engineering & VPN Bypasses: Technical analysis of the iOS framework (brdsdk.framework) reveals that:
  • The SDK dials out to a persistent WebSocket connection tracking device metrics (CPU, memory, network state, battery level).
  • Bypassing VPNs: By forcing network interface bindings directly to Wi-Fi (en0) or cellular (pdp_ip0) instead of the system default route, the SDK completely bypasses user-configured local VPN tunnels (tun0).
  • Broad Definition of "Idle": The SDK configuration allows relaying traffic even when the user is actively on a phone call or the screen is on, provided CPU utilization remains below 70% and memory below 90%.
• Cross-Platform Identity Stitching: The SDK's config file contains tracking properties like dual_pairing maps designed to tie a single user's distinct installations across iOS, Windows, and macOS together into a single unified identity.
• Mitigation and Defense Strategies:
  • DNS Sinkholing: Network-wide blocking of key domains (proxyjs.brdtnet.com, proxyjs.luminatinet.com, proxyjs.bright-sdk.com, and clientsdk.bright-sdk.com) entirely kills the proxy peer tunnel without impacting legitimate public traffic.
  • Network Boundaries: Utilizing TLS SNI filtering on domains matching *.brdtnet.com or *.luminatinet.com.
  • MDM Application Auditing: For enterprise environments, scanning mobile binaries for unique Swift symbols like BrdWebSocketFacade and BrdNetwork.DNSResolver to filter out infected applications.

Hacker News Discussion

• The Irony of Cloud-to-Cloud Scrapes: Users point out the profound irony that both the AI data scrapers and the target websites being scraped are often simultaneously hosted on AWS infrastructures, engaging in a costly, artificial cat-and-mouse game to mask their identities.
• Strict Hardware Isolation ("Dumb" Displays): A popular consensus among commenters is to completely air-gap or isolate smart TVs from the internet, relying exclusively on local HDMI inputs connected to trusted devices (like Apple TV, HTPCs, or Home Assistant setups).
• Automatic Content Recognition (ACR) over HDMI: Contributors point out that simply removing network permissions may not protect privacy entirely if a TV is ever connected later. Academic papers cited in the thread reveal that Smart TVs run Automatic Content Recognition to analyze and log content even on local HDMI inputs while offline, caching data to upload the moment an internet connection becomes available.
• The Threat of VPN Bypassing: The community expressed severe alarm regarding the SDK's ability to explicitly bypass local system VPN configurations via forced network interface bindings, highlighting the growing complexity required to self-host secure, consumer-friendly networks.
• Legal Risks and Misleading Consent: Commenters note that the SDK text hides behind the guise of "downloading public data," masking that its true utility is to circumvent security blocks. There is also discussion regarding the liability risk for home residents if a malicious third party utilizes their residential IP address through these unregulated networks for illicit activities (e.g., severe cybercrimes), though others note Bright Data utilizes strict Know-Your-Customer (KYC) onboarding for their buyers.
• Network-Level Defense: Users shared practical setups for containment, such as creating isolated local VLANs with restrictive firewall configurations, whitelisting device MAC addresses via DHCP policies, and deploying Pi-holes or AdGuard Home setups to drop the domains mentioned in the report.

大多数人认为AI安全措施应该随着技术发展而逐步完善，但作者认为更高级别的AI模型需要更强的网络安全保障才能发布。这挑战了AI行业逐步推进安全标准的常规做法，暗示高级AI可能需要突破性的安全方法而非渐进式改进。

大多数人认为AI在网络安全领域的应用主要局限于防御辅助，而非直接参与核心安全任务。但作者暗示GPT-5.5已具备'高级'网络安全能力，这一分类表明AI已从被动防御工具向主动安全参与者转变，挑战了网络安全领域对人类主导地位的认知。

大多数人认为AI在网络安全领域的进步应该是渐进式的，但作者暗示GPT-5.5代表了网络安全能力的显著跃升，达到了'高'级别而非仅仅'临界'级别。这一观点挑战了人们对AI安全能力发展速度的预期，暗示AI在防御复杂网络威胁方面可能比人们想象的进步更快。

大多数人认为AI在网络安全领域的应用应该被严格限制或视为威胁，但作者认为GPT-5.5的网络安全能力是'进步'而非危险，并将其归类为'高级'而非'关键'风险级别。这与主流的'AI网络安全威胁论'相悖，暗示AI可能成为网络安全防御的重要工具而非主要威胁。

大多数人可能认为高级 AI 模型的访问权限非常难以获得，但作者指出，一个黑客小组通过从 Mercor 数据泄露中获得的信息来猜测 Mythos 的在线位置，这表明了数据泄露可能对更广泛的网络安全构成威胁。

在视觉敏锐度测试中从54.5%跃升至98.5%是一个惊人的进步，这展示了AI在网络安全领域的突破性进展，'our single biggest Opus pain point effectively disappeared'表明这一进步解决了实际应用中的关键瓶颈。

令人惊讶的是：Claude Mythos Preview在利用Firefox漏洞方面的成功率从Opus 4.6的不到1%跃升至72%，这种能力提升是指数级的，展示了AI在网络安全攻防领域可能带来的革命性变化。

令人惊讶的是：深度伪造诈骗已经造成数千万美元的损失，这表明AI技术已被大规模用于犯罪活动，而传统安全系统几乎无法应对这种新型威胁。

令人惊讶的是：AI生成的概念验证(PoC)能够揭示人类安全补丁中的不完整之处。这表明AI不仅能发现漏洞，还能评估现有补丁的有效性，这种能力对于提高软件安全性具有重要意义，因为人类开发者可能会忽略这些细微的补丁缺陷。

令人惊讶的是：Claude Mythos Preview模型已经发现了数千个高危漏洞，包括所有主流操作系统和网络浏览器中的漏洞。这表明AI模型已经达到了能够超越大多数人类专家发现软件漏洞的水平，这种能力在网络安全领域具有革命性意义。

令人惊讶的是，Claude Mythos能够自主发现并利用一个存在了27年的OpenBSD漏洞。这一事实表明AI模型在网络安全领域的能力已经达到了令人难以置信的水平，能够找到人类专家和安全系统长期未发现的漏洞。这引发了关于AI安全性和控制机制的深刻问题。

令人惊讶的是：文章揭示了网络安全领域的根本性转变——过去需要高技能黑客多年经验才能完成的漏洞利用工作，现在AI可以在短时间内完成。这种技术民主化虽然提高了效率，但也大大降低了攻击门槛，使网络安全形势急剧恶化。