1/ The future of AI in security is not just better models. It is better harnesses. The model matters, but the workflow around it matters more: scope, tools, evidence, validation, memory, scoring, and retry logic.
2/ Cloudflare’s Project Glasswing writeup makes this clear. Pointing a generic coding agent at a huge repo and saying “find bugs” creates noise. Real vulnerability research needs narrow tasks, independent validation, dedupe, reachability tracing, and structured reporting.
3/ The AgentFlow research shows the same pattern: Propose → execute → observe → score → diagnose → optimize. That loop is the difference between an AI that guesses and an AI system that can help prove.
4/ This is where things get interesting. An intermediate operator with a strong harness can now perform much closer to expert level on specific workflows. Not because AI replaces expertise, but because it compresses the learning and validation loop.
5/ The best teams will not just “use AI.” They will build agent harnesses that encode how their best researchers think. Private memory. Tool integration. Evidence gates. Validation loops. That becomes the new edge in offensive security.
This diagram captures the real shift: AI security work is moving from prompts to harnesses. The winning pattern is not “ask better.” It is “scope, execute, observe, score, diagnose, and improve.”