AI-Enabled Vulnerability Governance for Government Information Systems: Paths and Considerations

Liang Man of the Shanghai Big Data Center, writing in China Information Security magazine 2026 issue 8, describes city-level use of AI for government-system vulnerability discovery, triage, and lifecycle management. Reported figures include a 360 Pozhenzi drill finding 312 valid vulnerabilities across 132 critical-infrastructure organizations, of which 46 were AI-related, and a Sysdig case citing

Digital government programs such as integrated online services (Yiwangtongban) have expanded quickly. Liang Man of the Shanghai Big Data Center, writing in *China Information Security* 2026 issue 8, notes that the same systems concentrate sensitive personal data and high-value records. Exploited flaws can mean unauthorized access, leakage, tampering, service interruption, or systemic incidents.

Large models and agents are being applied to vulnerability discovery, code review, and attack-path analysis, moving work from labor-intensive processes toward automation. AI systems also introduce their own flaws. China National Radio reported on July 15, 2026, that during a national-level attack-defense drill pre-check, 360's Pozhenzi penetration-testing agent examined 132 critical-infrastructure organizations and found 312 valid vulnerabilities, including 46 AI-class issues such as prompt injection and agent over-privilege.

Risk characteristics and limits of traditional governance

One city example cited for 2026: an integrated online-service platform with more than 3,000 service items, cumulative volume above 800 million, and an online handling rate above 80 percent.

Four risk traits are listed. Business-logic flaws in authorization and interface authentication are hard for rule-based scanners because detection requires comparing intended behavior with actual behavior. Supply-chain flaws in open-source and third-party components, and in AI compute infrastructure and base software, can spread from upstream to downstream. Data-security failures involving citizen privacy or national security, including out-of-scope access to government data, carry severe impact. New AI surfaces include prompt injection, agent over-privilege, and data poisoning.

Traditional governance is described as reactive. The gap between introduction, discovery, and repair often favors attackers. In July 2026, Sysdig's *2026 Cloud-Native Threat Report* described JadePuffer as the first ransomware case autonomously driven by an AI large-model agent. Initial access used an unauthenticated remote code execution vulnerability in Langflow (CVE-2025-3248, CVSS 9.8). The report said the timeline compressed from weeks to hours or minutes, with 1,342 Nacos configuration records encrypted minutes after internal access. Manual dependence limits coverage. Fragmented management across systems and departments repeats the same flaw types. Classified cybersecurity protection and commercial cryptography assessments raise the required bar.

Practice in leading cities

Policy and compliance

Some cities have AI industry ordinances that authorize government use of AI, data ordinances that bound personal-information collection and sharing, "AI plus government services" policies, and large-model evaluation platforms that can be used to assess AI-assisted vulnerability tools.

Technical work

Network-security authorities have discussed a large-model-assisted discovery loop: document analysis, code parsing, and permission verification, producing interface identification, permission extraction, difference comparison, and a vulnerability report. Full automated proof that arbitrary code matches business intent is treated as undecidable in the general case. Practice narrows the scope to critical interfaces, high-risk permission operations, and data-flow paths, combining AI semantic review, static analysis of call chains, and expert confirmation.

One reported AI code-audit agent, tested on composite production code at a major industry customer, found 59 vulnerabilities with about a 10 percent false-positive rate, including 17 business-logic flaws. A traditional static application security testing (SAST) tool found 30 vulnerabilities with a 60 percent false-positive rate. A city government data agency piloted AI code audit and log analysis on more than 100 systems.

A joint attack-defense laboratory organized vendors to test more than 200 information systems and found more than 500 exploitable vulnerabilities. AI is described as encoding expert practice into agents that run some test cases and assist analysis, not as a replacement for human crowd-testing.

The Paper reported that in June 2025 the Shanghai Computer Software Technology Development Center presented a DeepSeek-based blockchain smart-contract detection system at the 11th Shanghai International Exhibition of Technology, targeting 11 high-risk classes including reentrancy and integer overflow, and generating repair proposals. From detection to repair, manual screening time was reported as reduced by about ten times. The system was tested on financial and government blockchain platforms.

A vulnerability intelligence library has recorded more than 20,000 vulnerabilities, matched to more than 200 systems, and used to inspect and harden more than 15,000 component risks. Matching, impact analysis, and priority ranking by asset importance, exploitability, and business impact are the intended AI insertion points.

Mechanisms

Leading cities have begun a Government Intelligent Application Evaluation and Verification Center covering talent, scenario innovation, and security, with pre-release assessment, in-process verification, and post-release evaluation, aiming to find and block flaws before launch.

Remaining problems

Model limits remain on complex business-logic verification and cross-module data-flow tracing. Weak explainability of deep learning hinders traceability of security findings in government settings. Evaluation standards for government-oriented AI vulnerability tools are still coarse. Existing vulnerability-management rules assume traditional systems and one-time evaluation, which fits poorly with continuously updated, learning tools. Grading, repair deadlines, and accountability under AI assistance still need rules. Staff who both analyze vulnerabilities and operate AI tools are scarce, and districts and departments differ in skill and budget. Whether a model-centric or systems-engineering-centric path better fits government reliability and audit needs is still open.

Optimization paths

The article argues that government reliability and audit needs currently favor a systems-engineering-centric path in which AI is a reasoning node in the process, not the entire solution.

Technical path

Move large-model discovery from pilots to scale, using static analysis, verification environments, and human review to offset weak explainability and determinism. Keep AI discovery plus human judgment. Use the evaluation center to embed evaluate-before-launch across the lifecycle and to run standing evaluations of AI vulnerability tools. Apply security earlier in planning, development, and testing. Convert intelligence into protection in a monitor-discover-repair-verify loop.

Institutional path

Issue special rules for AI-assisted discovery, triage, and repair, including compliance and accountability. Cover the full cycle: discovery, verification, repair, retest, and closure. For grading, GB/T 30279-2020 and CVSS can map to four levels with repair windows: critical within 24 hours, high within 72 hours, medium within 14 working days, low within 30 working days. AI can match intelligence, help confirm validity and impact, draft repair advice, retest, and archive. Exceptions for flaws that cannot be fixed on time should use temporary hardening, with AI assisting risk rating, recommending mitigations, and tracking progress. Provide AI tools as shared capability on a unified security-capability platform.

Skills path

Train operations staff on AI-assisted discovery and analysis through theory, cases, and hands-on drills at government intelligent training ranges. Run dedicated programs for hybrid skills. Bring vendor research into government settings and extend capability to lower-tier districts and departments.

Closing

Liang writes that leading cities followed policy first, then technical work, then closed-loop mechanisms, with evaluation at the center and a large-model detection framework. Whether AI becomes a trusted, auditable, continuously improved partner depends on technical trustworthiness, institutional fit, and staff capacity.

(Published in *China Information Security*, 2026 issue 8.)