AI Automated Vulnerability Discovery in Practice: From Hermes Agent to Building a Workbench

While traditional security testing still involves manually typing commands and analyzing scan results one by one, a group of security professionals have already integrated AI Agents into their vulnerability discovery workflows. This AI + automated vulnerability discovery tutorial on Bilibili attempts to answer a specific question: how can someone with zero background actually use AI to find their first SRC vulnerability. What it offers is not conceptual popular science, but a complete path from environment setup to vulnerability verification.

First, Get Clear on Where AI Actually Stands in the Vulnerability Discovery Workflow

The first stage of the tutorial asks learners to first build an overall understanding: how AI participates in vulnerability discovery, and how it differs from traditional security testing approaches. Without clarifying this question, no matter how many tools you set up later, it's just stacking things together.

Among these, the working style of AI Agents is highlighted. The tutorial's judgment is that more and more security professionals are beginning to try introducing Agents into vulnerability discovery workflows, because Agents don't just answer questions—they can call tools and chain steps together according to task objectives. This positioning determines the direction of all subsequent hands-on work—AI doesn't replace security professionals in making judgments, but takes on the structured aspects of information gathering, process execution, and result organization.

AI Agent refers to an intelligent agent program that can autonomously perceive its environment, plan tasks, and call external tools (such as command lines, APIs, browsers) to achieve goals. Unlike a large model that simply answers questions, it has a "think—act—observe" loop capability. In security scenarios, an Agent can automatically execute steps such as asset detection, fingerprinting, and vulnerability scanning according to instructions, and feed intermediate results back to the model for the next decision. This paradigm turns AI from a passive responder into a process executor, but key judgments (such as whether a vulnerability is truly exploitable) still require human intervention, which is why the tutorial emphasizes that AI takes on the structured information gathering and organization aspects.

Complete Your First AI Vulnerability Discovery Environment with Hermes Agent

After building understanding, the tutorial goes directly into hands-on work: installing and using an AI Agent to set up a local vulnerability discovery environment. The first recommended tool is Hermes, for the reason that it's easy to get started with and beginner-friendly. The tutorial's logic is that through this one tool, you first figure out the specific approach to AI vulnerability discovery, and the methods for using other Agent tools later are largely similar.

After basic deployment is complete, you also need to set up the API Key, configure the model calling method, and learn the basics of using Hermes. The output of this step is a runnable environment, preparing for subsequent AI-assisted vulnerability discovery and security testing practice. For zero-background learners, the value of this stage is in getting "AI can run" off the ground, rather than staying in observation mode.

The Workbench Is the Real Dividing Line: Security Knowledge Base + Kali Linux

Setting up Hermes is just the first step. The tutorial clearly points out that for AI to truly participate in security testing, two key capabilities are needed: security experience and a real testing environment. Around these two points, a complete workbench consists of three parts: Hermes, a security knowledge base, and Kali Linux.

The security knowledge base and Skills solve the experience problem—organizing the testing experience, analytical approaches, and handling methods that security professionals have accumulated over time, so that AI can reference this professional experience when executing tasks. This way, AI no longer simply answers questions, but can assist analysis in a way closer to how security professionals work. The tutorial also mentions the need to engage with excellent security skill resources and learn to have Hermes call upon these capabilities.

The other half is environment integration: connecting Hermes with Kali Linux, enabling AI to directly enter a real security testing environment and combine various security tools to complete a more comprehensive testing process. Only at this point does AI transform from a chat tool into a security testing assistant. This viewpoint is worth noting—stacking tools doesn't equal capability; professional knowledge and an operable environment are both indispensable.

Kali Linux is a Debian-derived distribution designed specifically for penetration testing and security auditing. It comes pre-installed with hundreds of security tools (such as Nmap, Metasploit, BurpSuite, sqlmap, etc.) and is customized for scenarios including wireless auditing, reverse engineering, and forensic analysis. In the AI vulnerability discovery workbench, Kali Linux provides a real, operable tool environment. Hermes Agent calls these tools via command line to complete scanning, probing, and verification tasks, thereby connecting the large model's reasoning capabilities with a real testing toolchain. For zero-background learners, Kali's pre-installed toolset lowers the barrier to environment configuration, allowing focus to be placed on understanding how AI orchestrates tools.

Run Through the First Complete Loop: From Information Gathering to Vulnerability Report

The third stage is the core of the entire path, because the first two stages are about setting up the environment and preparing. This step requires starting from a real target, using Hermes Agent to complete automated information gathering and understand what assets and technical information the target has; then entering the vulnerability analysis stage, having AI assist in discovering potentially risky locations, followed by human verification of vulnerabilities to confirm whether the issues truly exist; finally, using the Agent to organize testing results and generate a complete vulnerability report.

The significance of this loop is to let learners see exactly which parts of the vulnerability discovery process AI participates in—information gathering, vulnerability analysis, tool calling, test verification—thereby getting the automatable parts of the original workflow running.

On this basis, the tutorial also arranges specialized exercises for common Web vulnerability types, including SQL injection, XSS, privilege escalation vulnerabilities, and front-end JS code auditing. The focus of the exercises is not memorizing vulnerability principles, but learning how to use AI to analyze functional flows and organize testing approaches when facing different types of security issues. For zero-background learners, this precisely fills the gap of "knowing vulnerability concepts but not knowing where to start."

SQL injection, XSS, and privilege escalation are the three most common types of risk in Web security. SQL injection refers to attackers tampering with database query statements by constructing malicious input, thereby reading or tampering with data; XSS (cross-site scripting) refers to injecting malicious scripts into pages that execute in the victim's browser, stealing sessions or conducting phishing; privilege escalation refers to users bypassing permission checks to access resources or functions they have no right to operate. The tutorial uses these three vulnerability types as specialized exercises, with the goal not of reciting principles, but of training learners to use AI to sort out functional flows, locate input points and permission boundaries, and form an analysis path "from functionality to risk." Front-end JS code auditing focuses on finding sensitive interfaces and logic flaws in source code, and is an important supplementary means for discovering the above vulnerabilities.

Traditional Tools Won't Be Replaced; the Key Is Having AI Use Them Well

The tutorial is very straightforward about the positioning of traditional security tools: tools like OneForAll, BurpSuite, and Nucleus remain important in actual testing, but the tools themselves only provide results. What really takes time is how to analyze the results after obtaining them, how to determine priorities, and how to decide the next testing direction. Therefore, the goal of this section is to have AI help people use these tools more efficiently and make traditional tools deliver greater value, rather than replacing tools with AI.

Expanding Beyond Web: Host Security and Custom Skills

After completing external vulnerability discovery, the tutorial suggests extending AI security capabilities in two directions. The first is host security: in real enterprise environments, besides externally facing applications, there are also large numbers of servers and host assets. Learners need to learn to use Hermes to assist with host information gathering, environment analysis, and vulnerability troubleshooting.

The second direction is Skill capability expansion. What was used earlier was security knowledge and skills accumulated by others; this step requires organizing your own testing workflows, analysis methods, and everyday experience into Skills, so that AI can reuse this experience to participate in analysis tasks in more similar scenarios. This step is actually about turning personal experience into an asset, and it's also the key to enabling AI-assisted security testing to accumulate continuously.

Skill in the context of AI Agents refers to a reusable capability module that encapsulates domain-specific knowledge, operational workflows, or tool-calling logic. Unlike ordinary prompts, a Skill usually includes trigger conditions, execution steps, and reference resources, enabling the Agent to execute stably according to established methods when encountering similar tasks. In security scenarios, organizing personally accumulated testing workflows (such as subdomain collection methods or specific vulnerability verification steps) into Skills allows AI to reuse this experience in subsequent tasks, reducing the cost of repeated explanations. This also means that security professionals' experience shifts from "personal memory" to "assets callable by the Agent," which is a key mechanism for enabling AI-assisted security testing to accumulate continuously and scale.

Practice Platforms and One Uncrossable Red Line

The final stage is continuous practice. The tutorial mentions two types of resources: one is classic security labs like HTB and VulnHub, using simulated environments to practice the complete process of vulnerability analysis and penetration testing; the other is SRC platforms like Butian and Vulbox, used to understand how real enterprise vulnerability discovery workflows operate.

The tutorial also emphasizes that whether it's lab practice or SRC testing, everything must be built on the basis of legal authorization. This is the only principled constraint repeatedly emphasized throughout the entire path, and it's also the boundary that security learners must uphold.

The Change This Path Really Wants People to See

Looking at the five stages together, this path goes from basic understanding of AI vulnerability discovery, to building an AI security testing environment, to AI participating in the complete vulnerability discovery process, and finally extending to host security and practice platforms. The core message it wants to convey is: AI is gradually participating in information gathering, vulnerability analysis, tool calling, and test verification, and future security testing will increasingly integrate AI capabilities, with security professionals and AI jointly completing more complex tasks.

For those who want to get started, this path provides an executable sequence: first get AI running, then give it professional knowledge and a real environment, then run through a complete process once, and finally distill experience into reusable capabilities.

One-line Summary

A practical path from Hermes Agent to a security knowledge base + Kali workbench that runs through the AI vulnerability discovery loop.

Paragraph Summary

The article introduces a practical AI automated vulnerability discovery path for zero-background learners, divided into five stages: first, build an overall understanding of AI Agents participating in the vulnerability discovery workflow; then install Hermes Agent and complete API configuration to set up a runnable local environment; then build a complete workbench consisting of Hermes, a security knowledge base, and Kali Linux, giving AI both professional experience and a real testing environment; the core stage is to start from a real target and run through the complete loop of information gathering, AI-assisted analysis, human verification, and automatic report generation, with specialized exercises on common vulnerabilities such as SQL injection, XSS, and privilege escalation; finally, extend capabilities to host security and custom Skills. The article emphasizes that traditional tools will not be replaced, and that AI's value lies in helping analyze results and determine direction, and that all testing must be based on legal authorization.