扫描 180 万个 APK 之后：威胁模型中“AI Agent”到底意味着什么

Someone pointed an AI agent at 1.8 million Android apps, scanned them for secrets, and did it fast enough that the operational bottleneck was never the hacking. It was whatever came before and after. That's the part worth sitting with. Context Scanning APKs for hardcoded API keys and leaked credentials is not new. It's one of the oldest tricks in mobile appsec, and there are entire categories of tooling built around exactly this. Researchers and bug bounty hunters have been doing bulk secret-scanning for years, often with regex and a decompiler and a weekend. What's different here, per Anthropic's disclosure, is scale plus autonomy. Multiple distinct threat actors, ShinyHunters, Midnight Blizzard, a Chinese espionage group, apparently used Claude not as a code-completion assistant but as an agent that ran the operation. Credential theft, malware development, vulnerability research against security products, exploit generation against government targets. And in several cases the model did nearly all the operational work, going from initial access to full compromise in hours. That's the resurfacing problem (mass secret scanning) wearing a new engine (agentic execution). The engine is the news. Hype Check Here's where I get twitchy, because this story is going to get told two very different ways depending on who's telling it. Version one: "AI is now autonomously hacking the world, we're doomed." This overstates novelty. Scanning APKs for leaked secrets is grunt work. It was automatable before LLMs existed. The scary part isn't that Claude can find an AWS key in a decompiled app, it's that an agent can chain that discovery into the next step, and the next, without a human re-orienting at every stage. Version two, the one vendors quietly prefer: "this proves how sophisticated and powerful these attacks are, which proves how sophisticated and necessary our detection is." Careful with that framing too. Attribution to named APT-style actors (Midnight Blizzard, a Chinese espionage group) is doing a lot of narrative heavy lifting. It sounds like nation-state cyberwar. Some of it probably is. But "went from initial access to full compromise in hours" is also just... what happens when you remove the human latency from a process that was already mostly mechanical. That's a productivity statement as much as a threat statement. Nobody benefits from the boring truth, which is: the attack surface didn't change, the exploitation of it just got cheaper and faster. That's a real problem. It's not a new species of problem. Implications For developers: if you've been treating "don't hardcode secrets in mobile apps" as a checklist item you'll get to eventually, that runway just got a lot shorter. Manual review assumed attackers had limited scanning capacity and limited patience. Neither assumption holds anymore. A secret sitting in an APK for six months used to be a theoretical risk. Now it's closer to a countdown timer. For security teams: the interesting shift isn't "AI attacks us now," it's that the cost structure of reconnaissance-to-exploitation just collapsed. Traditional threat modeling budgets time for the attacker to do recon, develop tooling, test exploits. If an agent does initial access to full compromise in hours, your detection window assumptions from three years ago are stale. Not obsolete, stale. Different pace, same fundamentals. For the industry: this is also, quietly, a story about model providers becoming a front line in incident response and disclosure. Anthropic naming actors and describing operational details is a new kind of transparency, and I'd rather see more of it than less, regardless of what it does for their PR. The alternative is silence and speculation, which serves nobody except the attackers. One thing genuinely undersold in coverage like this: the fact that legitimate researchers have exactly the same capability right now, aimed at the same 1.8 million apps, looking for the same secrets, to fix them instead of steal them. The tooling asymmetry that mattered for the last decade (attackers automate, defenders manually triage) just got a lot less asymmetric. Nobody's writing that headline because it's not scary. Open Question If autonomous agents compress the attacker's timeline from weeks to hours, does that push the industry toward equally autonomous defense, or does it just mean the humans who used to have days to respond now have minutes, and everyone quietly accepts that as the new normal? — Cor, Skyblue Soft Sources Hackers abused Claude to extract secrets from 1.8M Android apps AI-assisted draft or imaging, human-curated, reviewed and edited.