AI agents helped uncover a CVSS 10 vulnerability, but people still had to steer

Eye Security says researchers used a 12-step AI-agent method to uncover a CVSS 10.0 vulnerability chain in ASUS Control Center. The result is a useful security story for a less glamorous reason: the agents accelerated reconnaissance and code analysis, but human researchers still had to guide them through the difficult parts.

Watch Desk analysis

What happened

Eye Security’s researchers called their method the “Kitten process”. They used AI agents to map an attack surface and parse reverse-engineered code while investigating ASUS Control Center, eventually identifying the chain recorded as CVE-2026-75754.

According to Eye Security, the chain combined a leaked encryption key, an exposed Guacamole servlet and a hardcoded root password. Together, those weaknesses could enable unauthenticated remote code execution, which is why the vulnerability received the maximum CVSS score of 10.0.

The researchers say models such as Claude Opus 4.5 were particularly useful for exploring the attack surface and working through large amounts of code. They also report that the agents repeatedly needed supervision, steering and manual intervention when they hit roadblocks. The machine did not stroll into the server room wearing a tiny balaclava. It needed a research team holding the map.

Why it matters

This is a concrete example of AI being used in vulnerability research rather than merely being advertised as a future security assistant. The practical payoff is speed and breadth: agents can help researchers inspect systems, connect clues and keep several lines of investigation moving.

The limitation is just as important. Eye Security’s account does not support the idea that an agent independently discovered and exploited the flaw from start to finish. Human researchers supplied judgement, redirected the investigation and handled obstacles the models could not overcome. That distinction matters for defenders deciding whether these systems are ready for unsupervised security work.

The disclosure also shows why basic security failures remain painfully consequential. A leaked key, an exposed service and a hardcoded root password can become a severe compromise when they connect in the wrong order. AI may help find that chain faster, but it does not make poor credential and access controls less dangerous.

Our read

The strongest takeaway is not that AI has replaced vulnerability researchers. It is that a well-directed agent can make experienced researchers more effective, especially when the work involves repetitive searching, code comprehension and attack-surface mapping.

Security teams should treat agentic vulnerability research as an amplifier, not an autopilot. The sensible investment is better tooling around human review, reproducible testing and rapid remediation. Anyone promising a button marked “find every flaw” is selling the button rather than the security programme.

What to watch

• Remediation:
  whether ASUS Control Center users receive clear fixes and guidance for CVE-2026-75754.
• Reproducibility:
  whether other researchers can confirm the reported chain and the Kitten process’s contribution.
• Human workload:
  which parts of vulnerability research agents can reliably handle without expert intervention.
• Offensive use:
  whether the same agent techniques are used to discover weaknesses before defenders can patch them.

Discussion spark: Should AI-assisted vulnerability research be judged mainly by how quickly it finds serious flaws, or by how safely teams can verify and fix what it surfaces?

Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.