AI-powered security research uncovers flaws that could expose smartphone cameras and photos.

AI is becoming a cybersecurity tool. Researchers at US startup DepthFirst used an AI system to discover vulnerabilities in open-source software used by TikTok.

The researchers modified GLM, an AI model developed by Chinese company Z.ai, and combined it with other tools to create a system designed to search software for security weaknesses. It identified a chain of vulnerabilities that researchers used in a controlled demonstration.

In a video reviewed by The Washington Post, a DepthFirst employee demonstrated how the flaws could be combined to remotely access a smartphone’s camera and photo library while the device was browsing TikTok. The demonstration was a security test, not an attack on a real TikTok user.

The vulnerabilities were found in open-source components used by TikTok, not in the phone’s hardware. By linking multiple weaknesses, researchers were able to reach functions that should normally remain protected from remote access.

DepthFirst disclosed the vulnerabilities to TikTok through its security programme. TikTok confirmed the flaws and fixed them before publication, according to The Washington Post. TikTok said it had no evidence that the vulnerabilities had been exploited against its users.

The episode highlights a shift in cyber security. AI can help defenders examine huge amounts of software code faster than manual analysis. But the same capability could also lower the technical barrier for criminals searching for weaknesses in applications.

The choice of GLM is significant. Unlike many US AI models, some Chinese models can be downloaded and modified by users. The Washington Post reported that DepthFirst heavily modified a version of GLM for security research.

That flexibility can help legitimate security work, but it also raises questions about how easily advanced cyber capabilities should be distributed.

For smartphone users, the incident is a reminder that app security is not only about passwords. Keeping applications updated and limiting permissions for cameras, photos and other sensitive functions can reduce exposure when vulnerabilities are discovered.

The TikTok case ended with a patch rather than a reported breach of user data. Yet it demonstrates a bigger trend: AI is becoming capable of finding software weaknesses at remarkable speed, making cybersecurity increasingly a contest between machines searching for vulnerabilities and machines trying to close them.