You’re just sitting on your couch scrolling through TikTok.

You didn’t click on any suspicious links.

You didn’t download any unfamiliar files.

Your phone seems perfectly fine.

But during a cybersecurity research demonstration, a researcher successfully accessed the camera and photo gallery of a phone remotely, while it was browsing TikTok.

At first glance, this outcome easily leads to a frightening conclusion:

“AI can now hack into your phone by itself.”

But what actually happened is more worth noting.

AI did not suddenly decide to attack TikTok on its own.

Instead, it did something potentially far more significant:

It made the time-consuming and expert-dependent task of finding vulnerabilities much faster, easier, and more scalable.

Researchers Turned a Free AI into a “Bug Hunter”

According to a September 18 report from The Washington Post, the US cybersecurity startup DepthFirst aimed to develop an AI system capable of automatically searching software for vulnerabilities.

They didn’t just use models from OpenAI or Anthropic.

Instead, the team chose the GLM model freely provided by China’s Z.ai—available for free download and modification—and significantly customized it, combining it with other tools to create a specialized system for code analysis and security flaw detection.

DepthFirst’s core business is assisting companies in detecting, verifying, and fixing software vulnerabilities using AI; their system has already found security issues in many open-source projects.

The really interesting point is:

AI doesn’t have to “take control of the whole computer” like movie hackers.

It only needs to speed up the most labor-intensive task:

Finding “where problems might exist” within vast amounts of code.

Then it Found Open-Source Components Used by TikTok

During testing, DepthFirst’s AI vulnerability scanner uncovered multiple security weaknesses in an open-source software component used by TikTok.

But it’s important to understand:

Finding a vulnerability

does not mean you can already control the phone.

Real attacks usually require researchers to keep verifying:

Can this flaw actually be exploited?

What happens if it’s combined with other vulnerabilities?

Can the attacker bypass various security restrictions step by step?

This case was no different.

AI helped find suspicious code and potential flaws, but human researchers verified the findings and connected multiple vulnerabilities into an attack chain.

In other words,

AI did not execute the entire attack alone.

It more like suddenly gained a very fast cybersecurity assistant capable of scanning code non-stop.

The final determination of whether these flaws could be chained and how was still done by human researchers.

In the End, They Really Accessed the Phone’s Camera and Photos

In a video shown to The Washington Post, a DepthFirst researcher remotely accessed the camera and photo gallery of a smartphone actively browsing TikTok by exploiting this chain of vulnerabilities.

This part of the story hits closer to home for most people.

Because vulnerability research often feels distant.

Terms like memory errors, open-source components, or code are hard to connect to personal impact.

But when it comes down to:

Your camera.

Your photos.

The issue becomes very concrete.

However, it’s important to clarify one boundary here:

This was a cybersecurity research demonstration—not proof that simply opening TikTok today lets anyone access your camera at will.

DepthFirst reported the vulnerabilities to TikTok.

The Washington Post reviewed communications between TikTok’s security team and the researchers, reporting that TikTok confirmed the issue and completed a patch. Follow-up reports indicate there is no evidence the vulnerabilities remain exploitable on the platform.

So the real takeaway from this story is not whether TikTok can still be attacked this way now.

It’s:

The next person to find a vulnerability might no longer need to sift through every line of code slowly as before.

Previously, Expert Researchers Were Rare; Now AI Is Lowering That Barrier

Traditional cybersecurity research relies heavily on experience.

An expert must know which parts of the code deserve attention.

Which anomalies are just false positives.

Which small vulnerabilities, when combined, could suddenly become serious threats.

Hence, high-level vulnerability research has always been a high-barrier profession.

AI is starting to change that.

DepthFirst’s public info shows the company is training AI agents specialized in vulnerability hunting, aiming for the system to automatically discover, verify, and even help patch security flaws in large codebases.

This is of course good news for defenders.

Vulnerabilities that might take weeks to find previously

might be detected much earlier with AI.

Companies then get a chance to patch issues before real attackers discover them.

But the same capability also has another side.

If the cost of finding vulnerabilities drops,

then more people interested in finding vulnerabilities will emerge.

The Real Danger Isn’t “AI Going Rogue” but Lowering the Cost of Capabilities

This is the key point of the event.

When many discuss AI and cybersecurity,

the first question that comes up is:

“Will AI become hackers by itself?”

But the more practical risk might not be whether AI has “malice.”

It’s that capabilities once possessed by only a few experts

are becoming accessible tools to many.

One reason DepthFirst’s use of the GLM model gained attention is because it’s freely accessible and modifiable.

The Washington Post noted that, compared to some cutting-edge US providers placing more restrictions on advanced cybersecurity uses, open and downloadable models give users greater control.

This doesn’t mean open models are inherently dangerous.

The same freedom also lets researchers use them to protect software, find zero-day vulnerabilities, and patch systems earlier.

The problem is:

The same tool can be used for very different purposes by different people.

AI Could Also Help Defenders Catch Up With Attackers for the First Time

This story is not simply “AI makes hackers stronger.”

DepthFirst positions itself firmly on the defense side.

They use AI to find flaws and report them to software companies.

This is one of the most crucial roles of cybersecurity research:

Finding problems

before actual malicious attacks happen.

Proving the issues exist.

Fixing them first.

If AI can scan code humans can barely finish reviewing,

defenders may gain abilities they never had before.

The real race becomes:

Who’s faster at finding vulnerabilities with AI—the defenders or the attackers?

What This Means for Ordinary Users

You don’t need to stop using TikTok because of this.

Nor should you assume all mobile apps can remotely turn on your camera from this case alone.

The vulnerabilities have been reported and patched.

But this case reminds us of a bigger reality:

The speed at which software vulnerabilities are found

is likely to increase.

Previously, a minor vulnerability in an open-source library

might stay undetected for years.

Now, AI can almost continuously read code, spot anomalies, and flag spots worthy of human review.

For software companies,

how quickly they patch vulnerabilities

will become even more important.

For regular users,

the simplest yet effective actions remain unchanged:

Update apps whenever possible.

Keep your phone’s system up to date.

Don’t keep unnecessary permissions—like camera, photos, or microphone—turned on.

AI may change the speed of vulnerability discovery,

but the actual impact depends on permissions given to apps and whether patches have been applied.

The Real Turning Point Is Not Whether AI Will Attack

Years ago,

we asked:

Can AI write code?

Later,

Can AI find bugs?

Now, the question has evolved further:

Can AI find exploitable vulnerabilities faster than humans?

DepthFirst’s TikTok demonstration provides an answer:

At least in some cases, AI can already be a highly effective vulnerability-hunting assistant.

The truly concerning matter

is not this now-patched TikTok vulnerability,

but what happens when finding vulnerabilities becomes cheaper and more automated,

and the next discovered vulnerability is seen first

by either those aiming to fix it, or those wanting to exploit it.

Today, progress a little with AI.

Learn one AI technique a day.

Save a little time each day.

Improve your skills step by step.

SasaDaily, growing with you.