360 Shipped Its Wildcard TLS Private Key Inside a Public Installer
360’s newly released AI Agent product shipped a public installer containing the private key for its *.myclaw.360.cn wildcard certificate. Public verification and local reproduction also exposed inconsistencies in the OCSP revocation path.