360 Unveils AI Tools To Match Anthropic's Mythos

360's rollout is a case study in a pattern now recurring across Chinese AI announcements: a company that explicitly concedes a 20-30% model-capability gap against frontier US systems claims parity through agentic orchestration, domain-specific data, and multi-agent workflows rather than larger models or more compute. Founder Zhou Hongyi's own framing, laid out in a full transcript of his ISC.AI 2026 keynote, describes this directly as an alternative to "the strongest model, the strongest computing power, the strongest chips" route, an approach eWeek separately likens to DeepSeek's efficiency-over-scale strategy. The comparison matters for practitioners because it signals that capability gaps versus frontier models can be partly compensated for with orchestration and domain tooling, which should change how buyers evaluate vendor claims that a system matches a better-resourced competitor.

Speaking at the ISC.AI 2026 conference in Beijing, Zhou unveiled two AI systems under the banner "Yitian Tulong": Tulongfeng, an automated vulnerability-discovery agent he called "China's version of Mythos," and Yitianzhen, an automated cyber-defense and incident-response system described as nearing full release, per Reuters and the full transcript of Zhou's speech published the same day. 360 says Tulongfeng has identified 3,432 software vulnerabilities to date, with 105 confirmed by Chinese authorities, but Reuters states plainly that it could not independently verify those figures. That caveat carries real weight: the numbers are entirely self-reported by 360, with no third-party audit cited in any of the reporting reviewed.

Zhou's speech frames the release as a response to Anthropic's Mythos, which the company said in April had found "thousands" of vulnerabilities across operating systems and browsers during red-team testing. The US government subsequently ordered export controls barring foreign nationals, including Anthropic's own non-citizen employees, from Mythos 5 and the safety-throttled Fable 5, and Anthropic extended Mythos scanning access to more than 40 organizations under its Project Glasswing alliance, from which China was excluded. Zhou calls this exclusion a "one-way transparency" risk, comparing mutual vulnerability-discovery capability to nuclear deterrence. That framing is an explicit strategic argument from 360's own founder rather than an LDS assessment, and is worth reading as company positioning, particularly since the underlying vulnerability counts remain unverified.

The transcript attributes specific results to Tulongfeng beyond the vulnerability count Reuters reported: a Windows kernel privilege-escalation bug dormant for five years, an Office remote-code-execution flaw dormant for eight years, and an Excel vulnerability dormant for ten years, all of which 360 says earned formal acknowledgment from Microsoft. Notably, 360 also claims Tulongfeng found zero-day vulnerabilities in the AI agent framework openclaw and 13 zero-days in the AI application-building platform Flowise, covering authentication and access-control issues. If accurate, that detail matters more immediately to practitioners than the geopolitical framing: it indicates vulnerability-discovery AI, on both the Mythos and Tulongfeng sides, is now being pointed directly at the agentic AI tooling stack itself, not just conventional operating systems and applications.

Treat 360's vulnerability counts as unverified vendor claims until an independent researcher or the affected vendors, Microsoft and the openclaw and Flowise maintainers, confirm them directly, the same standard Reuters applied. Teams running agent frameworks or AI app-builder platforms should track official advisories from those specific projects rather than relying on either company's self-reported discovery numbers. More broadly, security and procurement teams operating in or with China should expect continued bifurcation in access to frontier vulnerability-discovery tools: US export controls on one side, and on the other a limited, state-vetted rollout of Tulongfeng and Yitianzhen to key state-backed and critical-infrastructure units, per Zhou's transcript, rather than open commercial availability of either system in the near term.