How Tencent’s CDN Agentic Workflow Automates 24/7 Vulnerability Discovery and Patch Deployment

Background: OOM incident reveals a hidden bug

In early 2026 a CDN edge platform suffered an out‑of‑memory crash caused by a malformed media file that altered a field, exposing a boundary bug that had existed for four years in a codebase of millions of lines.

Challenges

Three intertwined challenges prevent fast detection: (1) the input‑combination space grows exponentially due to flexible media file structures, multi‑layer protocols, and streaming constraints; (2) the codebase exceeds a million lines, making manual review infeasible; (3) diverse deployment environments make reproducible testing difficult.

Can AI break the wall?

Recent works such as Google Big Sleep (2024‑10, 2025‑7) and G2FUZZ (USENIX Security 2025) demonstrate that large language models can perform deep code reasoning and generate syntax‑aware fuzz inputs, but they still operate on isolated analysis rather than end‑to‑end validation.

Solution: CDN Agentic Workflow

We built a red‑team/blue‑team Agentic Workflow that runs 7×24, turning the analysis‑generation‑validation‑repair loop into a fixed workflow while keeping the LLM’s reasoning capabilities within well‑defined stages.

Red‑team pipeline

RFC‑anchored code audit to locate attack surfaces.

Generate Python mutation scripts that respect protocol constraints and recompute size/offset fields.

Execute targeted attacks; collect black‑box response anomalies (status‑code, latency, content) and white‑box metrics (memory, CPU, core dumps).

Archive successful exploits in a shared data pool for the blue‑team.

Blue‑team pipeline

MDT multi‑disciplinary consultation (Expert A and Expert B) to validate root cause and propose a fix.

Generate patches, unit tests, and submit a merge request.

Deterministic container‑topology replay to verify patch correctness and distinguish patch failures from environment faults.

Record the fix in a structured knowledge base.

Scale and Efficiency

We split CDN functionality into 149 third‑level modules; each physical node runs one workflow handling all modules sequentially. To date the red‑team has launched over 2.6 million attack requests with a blue‑team fix rate above 99 %.

Compared with the original manual OOM investigation that required three engineers a full day, the automated loop resolves similar bugs in about one hour—a ~20× speedup. Token consumption has dropped to ~41 M tokens per discovery (≈28 CNY) and ~8 M tokens per repair (≈27 CNY).

Knowledge Accumulation

Two‑layer fingerprinting prevents duplicate analysis: a stack‑trace fingerprint before any LLM processing and a root‑cause fingerprint after MDT. Successful fixes are stored as case records; repeated patterns become generalized rules that the Agent consults in future rounds.

Future Outlook

Industry reports (Anthropic Claude Mythos, CrowdStrike 2026) confirm AI‑driven attacks are rising, while defenses such as Google CodeMender and OpenAI Codex Security automate patch generation. Our roadmap focuses on further shrinking the discover‑to‑fix cycle, expanding coverage to multi‑protocol and network‑condition edge cases, and leveraging an LLM‑Wiki to continuously refine structured knowledge.