How 360 Security's 'Dragon-Slaying Blade' AI Is Taking on Anthropic's Mythos and the US Export Ban

Here is a comprehensive, sourced breakdown of the ISC.AI 2026 announcement and its geopolitical context.

What 360 unveiled at ISC.AI 2026

On June 24, 2026, at the ISC.AI (Internet Security Conference) in Beijing, 360 Security Technology founder Zhou Hongyi presented two AI-driven cybersecurity tools: Tulongfeng (屠龙锋) and Yitianzhen (仪天针) . The conference theme was "Intelligent Agents Subvert Security" .

Zhou Hongyi explicitly branded Tulongfeng as "China's version of Mythos," arguing that China could not afford to be absent from the AI security race . He framed the U.S. model as a "strategic cyber capability" that the U.S. was denying to China through export restrictions, making domestic development a national imperative .

Tool capabilities

Tulongfeng (屠龙锋) – The name is derived from Chinese martial arts fiction and translates roughly to "Dragon-Slaying Blade." It is an automated vulnerability discovery system positioned as a direct counterpart to Anthropic's Mythos .

• As of the conference, it had cumulatively discovered more than 3,000 vulnerabilities, of which 105 had been confirmed by regulators, with several classified as high-risk by China's national vulnerability database .
• Capable of finding open-source code vulnerabilities, binary vulnerabilities (including a Windows kernel bug that had lain dormant for 5 years and an Excel bug dormant for 10 years), and vulnerabilities in AI models and intelligent agents .
• Zhou said 360 took an "intelligent agent engineering route" rather than copying the U.S. "brute-force compute" approach .

Yitianzhen (仪天针) – Translates roughly to "Heaven-Measuring Needle." It is designed for automated cyber defense and incident response, operating as the defensive counterpart to Tulongfeng's offensive vulnerability-hunting role .

U.S. restrictions: Export controls and Project Glasswing

The U.S. government moved aggressively to restrict access to Mythos well before 360's announcement.

• Project Glasswing: When Anthropic first previewed Mythos in April 2026, the company kept it restricted within a program called Project Glasswing, limiting access to a small set of approved U.S. security researchers and government partners .
• Emergency export control directive (June 12, 2026): The Trump administration's Commerce Department issued an unprecedented export control order forcing Anthropic to suspend access to Claude Mythos 5 and Claude Fable 5 for all foreign nationals — including Anthropic's own foreign-born employees . At 5:21 p.m. ET, the company abruptly disabled both models for all customers globally .
• The directive was triggered in part by controversy over Anthropic's ties to South Korea's SK Telecom, which had commercial access to the models . The move was widely described as marking the start of an "AI Cold War" .

Skepticism from independent analysts

Independent security researchers and analysts have expressed significant skepticism about 360's AI vulnerability claims.

• Reports from April 2026 noted that 360's earlier AI system (internally called VULCAN) had claimed to autonomously discover over 1,000 vulnerabilities, but questions arose about how many of those were truly novel, autonomously found, or simply aggregated from existing databases .
• Security analysts have drawn comparisons between 360's claims and the Claude Mythos narrative, suggesting that 360's numbers may conflate human-assisted discoveries with fully AI-autonomous findings and that independent verification remains limited .
• The Bloomberg report (April 22, 2026) noted that while 360 had clearly been using AI to augment its security research, the company's public claims outpaced what outside experts could independently confirm .

Broader context: U.S.-China frontier AI tensions

This announcement is the latest episode in an accelerating technology decoupling over frontier AI models.

• Direct timing link: 360's launch came just 12 days after the U.S. export ban on Mythos 5, and Zhou Hongyi explicitly cited U.S. restrictions as the reason China needed its own capability .
• Zero-sum framing: Zhou cast AI vulnerability discovery as a strategic asset — whoever finds bugs first can patch them or weaponize them . This mirrored the U.S. national security rationale for the Mythos export controls.
• Escalation cycle: The U.S. restricted Mythos → China's 360 announced a domestic "equivalent" → Beijing frames the move as technological sovereignty. Each action by one side provides political cover for the other to accelerate its own program.
• Global fallout: The U.S. export ban on Mythos set off alarm bells not just in Beijing but also in Europe and Canada, as allies suddenly lost access to models they had been using for research, fueling a broader push for AI sovereignty worldwide .