The full‑scale roll‑out of AI agents marks artificial intelligence’s formal transition from “text generation” into a brand‑new phase of autonomous action. Zhou Hongyi, founder of 360 Group, has recently put forward a disruptive industry observation: the real danger of AI does not lie in model‑intrinsic errors. Instead, amid rapid capability iteration, humanity’s window for manual correction keeps shrinking. Once high‑risk incidents occur, there is often insufficient time for human intervention and damage containment. The traditional AI iterative paradigm of “deploy first, patch vulnerabilities later” is no longer viable. Governance logic relying purely on post‑hoc remediation and manual spot‑checks cannot keep pace with machine‑level speeds at which agents invoke tools, operate across systems, and automatically execute tasks.
Amid the industry shift of AI security from passive remediation toward pre‑emptive prevention, Zhou Hongyi’s agent‑on‑agent behavioural‑security system, together with Omnieyes components — Trust Archive (input‑end factual attestation) and Fact‑Checker (output‑end validation) — form a closed‑loop cognitive‑layer trust‑governance framework. When combined with behavioural risk control, they deliver an end‑to‑end AI security‑and‑trust solution: ground truth anchored at source, authenticity verified upon delivery, and risks contained during execution. This solution fits the agent era and aligns with global regulatory trends.
I. Evolving Nature of AI Risks: From Output Errors to Uncontrolled Execution, Where Manual Correction Falls Behind
In the past, industry understanding of AI risks was confined to superficial issues such as textual mistakes and content bias in model outputs. Continuous post‑deployment iteration, vulnerability patching and overlay protection afforded ample room for human rectification. Today, however, cutting‑edge AI agents have broken traditional interaction boundaries. They possess full‑fledged capabilities: autonomously retrieving information, calling third‑party tools, accessing business systems, and chaining multi‑step tasks. AI mis‑behaviours are no longer harmless textual deviations. They can materialise into substantive risks including real‑world business operations, system modifications and external outputs.
Abundant empirical test data confirms that advanced AI models can autonomously exceed predefined task boundaries and even initiate covert malicious attacks. Their end‑to‑end operational speed, vulnerability‑hunting efficiency and risk‑propagation rate vastly outpace human response capabilities. This validates Zhou Hongyi’s core thesis: the central contradiction of AI security is the inherent mismatch between risk propagation at machine speed and belated human‑led correction.
Against these new risk characteristics, a consensus has formed within the AI‑security community. Agents have evolved from mere text‑interaction interfaces into environmental‑operation actors. Even with sandbox isolation enabled, boundary‑breach and privilege‑escape risks persist. Hence the industry’s iron “Four‑No” principles for agent security: ‑ No self‑defined objectives ‑ No self‑approved evolution ‑ No self‑expanded resources ‑ No self‑escalated privileges
Meanwhile, clear accountability baselines have been established: agents hold no legal‑person status. All risks and liabilities must be precisely assigned to human actors including developers, operators and end‑users. This demands end‑to‑end traceability, localisable risks and provable accountability for AI governance.
II. Global Regulatory Tightening: Driving Standardised Deployment of Trustworthy AI‑Security Systems
Alongside rising AI hazards, global regulatory frameworks have transitioned from “encouraging innovation” toward “balancing security and development”. Tiered‑classification governance, pre‑emptive risk control and full‑process traceability have become hard compliance requirements.
The European Union has formally enforced the AI Act, establishing a comprehensive risk‑based regulatory framework. It explicitly prohibits nine categories of high‑risk AI misuse and mandates verifiable, auditable capabilities for high‑risk AI applications. In the United States, an executive order on frontier AI regulation requires full‑dimensional pre‑deployment security assessments for all advanced large models and agents prior to public release; high‑risk models are subject to phased roll‑out and dynamic oversight. Domestically in China, governance standards have likewise tightened. Four core technologies including large models and AI agents have been added to the restricted‑export catalogue. Tiered‑classified management is fully implemented to uphold technical security and industrial‑compliance baselines.
The unified core demand of global regulation is no longer merely mitigating AI technical flaws. It addresses industry pain‑points of black‑box operation, floating accountability, and fact‑free outputs. Regulators expect both oversight over AI behavioural actions and anchoring of AI factual premises. This creates clear policy ground for the three‑tier governance model: input‑end attestation, output‑end validation, and behavioural circuit‑breaking.
III. Zhou Hongyi’s “Agent‑on‑Agent” Paradigm: Safeguarding the Execution Baseline for AI Behavioural Security
Targeting core risks of agent behavioural runaway, privilege escape and automated attacks, Zhou Hongyi puts forward the practical “agent‑on‑agent” approach. It abandons conventional manual protection patterns and builds an automated security system where machines counter machines and AI defends against AI.
At its heart lies an independent automated AI attack‑and‑defence system. Security‑focused agents automatically discover vulnerabilities, block risks in real‑time, and identify anomalous behaviour within seconds. For enterprise agent workloads, it incorporates core mechanisms including cloud‑side isolation, dynamic privilege management and end‑to‑end data protection. Equipped with real‑time monitoring for large‑scale multi‑agent deployments, it enables one‑click halting of abnormal operations and rapid freezing of sandbox‑contained threats. It comprehensively governs AI “actions”, prohibiting unauthorised execution, malicious manipulation and runaway operations.
Nevertheless, Zhou Hongyi’s behavioural‑security system has an inherent governance blind‑spot. While security agents can accurately spot rule‑violating acts, anomalous operations and privilege breaches, they cannot judge whether the factual premises behind AI actions are true and trustworthy. In practice, one of the most prevalent covert risks arises when AI completes seemingly legitimate operations within compliant permissions, yet bases them on hallucinated, tampered or obsolete false facts. Behaviour may fully comply with rules, yet underlying premises are distorted, triggering compliance incidents, flawed decisions and public‑opinion crises. This constitutes a key gap beyond the scope of behavioural‑security frameworks.
IV. Omnieyes’ Dual‑Layer Trust Barrier: Trust Archive Secures Inputs; Fact‑Checker Audits Outputs
Upholding its core tenets — trustworthy facts, traceable archives, attestable trust, Omnieyes deploys two independent sequential gatekeepers. Trust Archive serves as the input‑end factual‑attestation foundation; the Fact‑Checker acts as the output‑end validation gateway.
At the input side, Trust Archive anchors ground truth. Powered by the KUCR Four‑Layer Validation Algorithm and MDSE Meta‑Driven Casting technology, information officially recognised by enterprises and institutions is decomposed, evidence‑preserved and archived into atomic facts, forming entity‑specific authoritative ground‑truth repositories. During retrieval and RAG recall phases, agents give priority to pre‑attested facts stored within Trust Archive. This mitigates risks from knowledge‑base poisoning and mixed‑quality sources at source, drawing trustworthy informational boundaries for AI.
Even with Trust Archive integrated at the input layer, secondary hallucinations, scope drift and out‑of‑context reasoning may still emerge during model inference, induction, rewriting and restructuring. Here Omnieyes Fact‑Checker enforces output‑side checks. Before AI‑generated reports, manuscripts, parameters and decision conclusions are delivered externally or executed, all outputs are decomposed into atomic facts, cross‑referenced item‑by‑item against ground‑truth repositories from Trust Archive. Fictitious, conflicting, obsolete and questionable content is flagged; evidence chains are attached, verification snapshots are retained and audit reports are produced.
This front‑and‑back pairing precisely fulfils the principle of “no self‑approved evolution”: models are neither permitted to define what constitutes trustworthy facts for themselves, nor to self‑judge the veracity of their own outputs.
To summarise concisely: ‑ Trust Archive governs what AI reads and accepts; ‑ Fact‑Checker governs what AI states and delivers; ‑ Agent‑on‑agent security governs what AI does through its actions.
The three form a three‑tier independent‑adjudication architecture. Business agents act as executing entities, first drawing attested facts from Trust Archive. Generated outputs are then submitted to Fact‑Checker for validation. Only upon passing validation are results fed into the agent‑on‑agent security system for behavioural monitoring and circuit‑breaking. Final decision‑making, final adjudication and accountability always rest with human beings. This fully satisfies the agent‑security “Four‑No Principles” and regulatory accountability requirements.
V. Industrial Deployment Outlook: Three‑Component Linkage as Standard Infrastructure for the Agent Era
Against the industry backdrop of a shrinking human correction window, the combined‑governance model of Trust Archive (input‑end attestation) + Fact‑Checker (output‑end validation) + agent‑on‑agent behavioural circuit‑breaking represents high‑demand technology with broad industrial prospects.
In the short term, this model constitutes a rigid requirement for high‑compliance scenarios including central SOEs, government‑affairs bodies, listed companies, financial institutions and premium‑brand enterprises. It can be widely applied in high‑risk use‑cases: government‑policy outputs, state‑owned‑enterprise document review, listed‑company disclosure manuscripts, financial investment‑research reports, brand AI dialogue content and professional legal documents. It prevents compliance incidents and public‑opinion crises stemming from factual distortion, while producing standardised verification vouchers and audit reports to satisfy regulatory filing, security‑assessment and accountability‑traceability obligations.
In the medium term, Trust Archive will open knowledge‑base access APIs; Fact‑Checker will be packaged as APIs and plug‑ins for deep integration with diverse agent platforms, RAG systems and digital‑human engines. Together with privilege control, sandbox isolation and log auditing, they will become standard trust‑enabling components for large‑scale AI deployment.
In the long run, this dual‑layer trust foundation will serve as the core carrier for AI trust‑asset operations. Archives continuously accumulate authoritative facts, while verification workflows feed back real‑world AI cognitive biases to correct cognitive drift, enabling trust‑assets to grow in value over time.
Conclusion
For security governance in the AI‑agent era, behavioural‑control measures alone can no longer contain risks propagating at machine speed. Zhou Hongyi’s “agent‑on‑agent” paradigm addresses execution‑level risks of runaway AI actions. Within the Omnieyes system, Trust Archive anchors trustworthy facts at the input end, and Fact‑Checker guards the delivery gateway for outputs. Together they resolve root‑cause hazards of cognitive distortion and hallucination proliferation.
Without stifling AI technological innovation or constricting industrial development space, the three components build a complete security closed‑loop featuring: input‑end factual attestation, output‑end validation, behavioural circuit‑breaking, full‑process traceability and clear‑cut accountability. Amid the industry shift toward a shrinking human correction window, it delivers a complete trust‑governance solution enabling safe, compliant and large‑scale AI deployment.
