Qihoo 360’s Tulongfeng AI Bug Hunter Takes On Anthropic’s Mythos
China’s Qihoo 360 Security Technology has unveiled two AI-driven cybersecurity tools, Tulongfeng and Yitianzhen, that it claims can match Anthropic’s Mythos bug-hunting model. Founder and CEO Hongyi Zhou announced them at the ISC.AI 2026 conference in Beijing, saying Tulongfeng had already discovered 3,432 software vulnerabilities across open-source code, binary software, and AI/agentic systems. The launch lands as Anthropic’s Mythos 5 model gains partially restored access for a select group of U.S. companies after a brief export ban, fueling fresh debate over AI sovereignty and the weaponization of vulnerability research.
The rhetoric was unmistakably geopolitical. Zhou compared frontier AI models to nuclear weapons and argued that China cannot wait for its domestic AI to catch up before fielding an equivalent strategic deterrent. The message: AI-driven vulnerability hunting is too powerful to leave in the hands of a single nation, and China must build its own.
Why It Matters
Anthropic’s Mythos family, particularly within the closed Project Glasswing task force, has set a new benchmark in autonomous vulnerability discovery. The model uncovered more than 23,000 potential issues across over 1,000 open-source projects, with more than 6,200 rated high or critical. With exclusive partners like Cisco and Palo Alto Networks, the project has flagged more than 10,000 serious flaws to date. Automating this work at scale forces governments and enterprises to confront a stark reality: the same technology that hardens critical infrastructure can also probe adversarial systems for exploitable weaknesses.
That dual-use nature is why the U.S. government temporarily banned exports of Anthropic’s Fable 5 and why Mythos 5 was initially restricted. Even after the partial reversal, Fable 5 remains blocked, and only a vetted cohort of more than 100 companies and agencies can legally access Mythos 5. Zhou framed these controls as proof that America intends to maintain an "absolute monopoly" over a strategic cyber asset.
What’s New: Tulongfeng and Yitianzhen
Qihoo 360’s approach differs fundamentally from Anthropic’s. Zhou described Mythos as an automated vulnerability researcher that leans on "the strongest model, the strongest computing power and the strongest chips." Tulongfeng, by contrast, is an agentic platform that orchestrates multiple AI models with security expertise and automated tooling, a software-first architecture tailored for a domestic AI landscape that Zhou acknowledged trails the U.S. by 20% to 30% in base model capability.
The tool was trained on 360’s internal vulnerability database, accumulated since the company’s founding in 2005, a repository of 250,000 known flaws. Its companion, Yitianzhen, is an automated cyber-defense system designed to function as an AI-driven security operations center (SOC) layer. Together they sit under the product banner "Yitian Tulong," a reference to the classic martial arts novel Heavenly Sword and Dragon Saber. In that literary context, Tulongfeng is the tip of the dragon saber, while Yitianzhen represents a cluster sword formation.
Qihoo 360, a Beijing-based cybersecurity company that was added to the U.S. Bureau of Industry and Security’s Entity List in 2020 for allegedly "enabling China’s high-technology surveillance," is no stranger to geopolitical friction. That history amplifies the sovereign-defense narrative that Zhou is now constructing around its AI tools.
The Numbers
- 3,432 vulnerabilities identified by Tulongfeng so far, per Zhou, across open-source, binary, and AI/agentic targets (Reuters).
- 250,000 vulnerabilities in 360’s proprietary database used to train the system, built over two decades.
- 23,000+ findings generated by Claude Mythos Preview across 1,000+ open-source projects; 6,200+ rated high or critical.
- 10,000+ serious flaws uncovered by Project Glasswing partners Cisco and Palo Alto Networks using Mythos’ full capabilities.
- 20% to 30% estimated capability gap between top Chinese models and the best Western models, according to Zhou.
Zhou framed the strategic calculus bluntly in his speech: "Why has nuclear war never actually broken out? Because everyone possesses nuclear weapons, allowing for mutual deterrence. The same applies to cybersecurity. If others have them, so do I; I won’t be passively attacked."
"Why has nuclear war never actually broken out? Because everyone possesses nuclear weapons, allowing for mutual deterrence. The same applies to cybersecurity. If others have them, so do I; I won’t be passively attacked."
Hongyi Zhou, founder and CEO, Qihoo 360, speaking at ISC.AI 2026 (Sina)
AI vulnerability hunting is becoming the nuclear deterrence of cybersecurity, with nations refusing to leave a strategic weapon in the hands of a single power.
What Comes Next
The Tulongfeng announcement lands in a volatile landscape. Anthropic recently accused Chinese tech giant Alibaba of "brazenly" and "illicitly" extracting capabilities from its Claude models (BBC), underscoring the intensity of the AI race. At the same time, the partial unblocking of Mythos 5 for select U.S. partners and the continued blockade of Fable 5 fuel sovereignty discussions worldwide. Security analyst Laura Wilber noted the move "added yet more fuel to the digital sovereignty fire in Europe, which will no doubt mean more funding flowing to the EU’s leading homegrown commercial LLM, Mistral."
Zhihua Tang, a Tsinghua University professor who founded Z.ai and recently shipped the GLM-5.2 model, estimated that a Chinese model with Mythos-class capabilities could arrive before the first quarter of 2027. The timeline intensifies the urgency for both sides.
What This Means for You
Enterprises and security teams should assume that autonomous, AI-driven vulnerability discovery is no longer a distant prospect but a present capability, wielded by both allied and adversarial states. The philosophy of mutual deterrence might stabilize nation-state tensions, but it also means that zero-day research and offensive tooling will accelerate. Organizations need to harden their software supply chains, invest in AI-verified code reviews, and run their own agentic red-team exercises.
For those tracking the evolution of frontier AI and cybersecurity, this story is part of a broader pattern. Earlier, China’s Zhipu AI released an open-weight GLM-5.2 model that researchers claimed matched Mythos on cybersecurity benchmarks (read our coverage). Meanwhile, the U.S. government has tightly coordinated model rollouts, as seen with OpenAI’s restricted GPT-5.6 release under administration pressure (here’s our report). The convergence of these events signals that cybersecurity has become the sharpest edge of strategic AI competition.
The Bigger Picture
Tulongfeng is more than a technical announcement; it is a declaration that China will not cede the AI cybersecurity domain to any single nation. Whether the tool’s claims hold up to independent scrutiny remains unverified, but the framing, the timing, and the surrounding export-control drama have already cemented it as a pivotal moment in the sovereignty debate. AI security is no longer just about defense; it has become the latest theater of global deterrence.
FAQ
What is Tulongfeng and how many vulnerabilities has it found?
Tulongfeng is Qihoo 360’s AI-powered, agentic vulnerability-hunting platform announced at ISC.AI 2026. According to CEO Hongyi Zhou, it has discovered 3,432 software vulnerabilities across open-source code, binary software, and AI/agentic systems, drawing on a proprietary database of 250,000 flaws accumulated since 2005.
How does Tulongfeng differ from Anthropic’s Mythos?
Mythos is a single frontier AI model that relies on top-tier compute and chips and generated over 23,000 findings (6,200+ high or critical) across 1,000+ open-source projects, plus 10,000+ serious flaws via Project Glasswing partners. Tulongfeng is an agentic platform that orchestrates multiple AI models with security tooling, a software-first architecture Zhou said compensates for a 20% to 30% base-model gap between Chinese and Western systems.
Why did Zhou compare AI cybersecurity to nuclear deterrence?
Zhou argued that autonomous vulnerability-hunting AI is so powerful it functions like a strategic weapon, and that mutual possession creates deterrence the way nuclear arsenals did. He said China’s domestic AI cannot be allowed to lag behind, and that if one nation holds such a capability, others must field an equivalent to avoid being "passively attacked."