Zhou Hongyi explicitly branded Tulongfeng as "China's version of Mythos," arguing that China could not afford to be absent from the AI security race. He framed the U.S. model as a "strategic cyber capability" that the U.S. was denying to China through export restrictions, making domestic development a national imperative.

What Are Tulongfeng and Yitianzhen?

Tulongfeng — The name is derived from Chinese martial arts fiction and translates roughly to "Dragon-Slaying Blade." It is an automated vulnerability discovery system positioned as a direct counterpart to Anthropic's Mythos.

• As of the conference, it had cumulatively discovered more than 3,000 vulnerabilities, of which 105 had been confirmed by regulators, with several classified as high-risk by China's national vulnerability database.
• Capable of finding open-source code vulnerabilities, binary vulnerabilities (including a Windows kernel bug that had lain dormant for 5 years and an Excel bug dormant for 10 years), and vulnerabilities in AI models and intelligent agents.
• Zhou said 360 took an "intelligent agent engineering route" rather than copying the U.S. "brute-force compute" approach.

Yitianzhen — Translates roughly to "Heaven-Measuring Needle." It is designed for automated cyber defense and incident response, operating as the defensive counterpart to Tulongfeng's offensive vulnerability-hunting role.

The U.S. Export Controls That Preceded the Launch

The U.S. government moved aggressively to restrict access to Mythos well before 360's announcement, creating the vacuum 360 sought to fill.

• Project Glasswing: When Anthropic first previewed Mythos in April 2026, the company kept it restricted within a program called Project Glasswing, limiting access to a small set of approved U.S. security researchers and government partners.
• Emergency export control directive (June 12, 2026): The Trump administration's Commerce Department issued an unprecedented export control order forcing Anthropic to suspend access to Claude Mythos 5 and Claude Fable 5 for all foreign nationals — including Anthropic's own foreign-born employees. At 5:21 p.m. ET, the company abruptly disabled both models for all customers globally.
• The directive was triggered in part by controversy over Anthropic's ties to South Korea's SK Telecom, which had commercial access to the models. The move was widely described as marking the start of an "AI Cold War."

Skepticism from Independent Analysts

Independent security researchers and analysts have expressed significant skepticism about 360's AI vulnerability claims, casting doubt on whether the tools truly match Mythos.

• Reports from April 2026 noted that 360's earlier AI system (internally called VULCAN) had claimed to autonomously discover over 1,000 vulnerabilities, but questions arose about how many of those were truly novel, autonomously found, or simply aggregated from existing databases.
• Security analysts have drawn comparisons between 360's claims and the Claude Mythos narrative, suggesting that 360's numbers may conflate human-assisted discoveries with fully AI-autonomous findings and that independent verification remains limited.
• The Bloomberg report (April 22, 2026) noted that while 360 had clearly been using AI to augment its security research, the company's public claims outpaced what outside experts could independently confirm.

Broader Context: U.S.-China Frontier AI Tensions

This announcement is the latest episode in an accelerating technology decoupling over frontier AI models, with each side's actions fueling the other's.

• Direct timing link: 360's launch came just 12 days after the U.S. export ban on Mythos 5, and Zhou Hongyi explicitly cited U.S. restrictions as the reason China needed its own capability.
• Zero-sum framing: Zhou cast AI vulnerability discovery as a strategic asset — whoever finds bugs first can patch them or weaponize them. This mirrored the U.S. national security rationale for the Mythos export controls.
• Escalation cycle: The U.S. restricted Mythos → China's 360 announced a domestic "equivalent" → Beijing frames the move as technological sovereignty. Each action by one side provides political cover for the other to accelerate its own program.
• Global fallout: The U.S. export ban on Mythos set off alarm bells not just in Beijing but also in Europe and Canada, as allies suddenly lost access to models they had been using for research, fueling a broader push for AI sovereignty worldwide.

Zhou Hongyi explicitly branded Tulongfeng as "China's version of Mythos," arguing that China could not afford to be absent from the AI security race. He framed the U.S. model as a "strategic cyber capability" that the U.S. was denying to China through export restrictions, making domestic development a national imperative.

What Are Tulongfeng and Yitianzhen?

Tulongfeng — The name is derived from Chinese martial arts fiction and translates roughly to "Dragon-Slaying Blade." It is an automated vulnerability discovery system positioned as a direct counterpart to Anthropic's Mythos.

• As of the conference, it had cumulatively discovered more than 3,000 vulnerabilities, of which 105 had been confirmed by regulators, with several classified as high-risk by China's national vulnerability database.
• Capable of finding open-source code vulnerabilities, binary vulnerabilities (including a Windows kernel bug that had lain dormant for 5 years and an Excel bug dormant for 10 years), and vulnerabilities in AI models and intelligent agents.
• Zhou said 360 took an "intelligent agent engineering route" rather than copying the U.S. "brute-force compute" approach.

Yitianzhen — Translates roughly to "Heaven-Measuring Needle." It is designed for automated cyber defense and incident response, operating as the defensive counterpart to Tulongfeng's offensive vulnerability-hunting role.

The U.S. Export Controls That Preceded the Launch

The U.S. government moved aggressively to restrict access to Mythos well before 360's announcement, creating the vacuum 360 sought to fill.

• Project Glasswing: When Anthropic first previewed Mythos in April 2026, the company kept it restricted within a program called Project Glasswing, limiting access to a small set of approved U.S. security researchers and government partners.
• Emergency export control directive (June 12, 2026): The Trump administration's Commerce Department issued an unprecedented export control order forcing Anthropic to suspend access to Claude Mythos 5 and Claude Fable 5 for all foreign nationals — including Anthropic's own foreign-born employees. At 5:21 p.m. ET, the company abruptly disabled both models for all customers globally.
• The directive was triggered in part by controversy over Anthropic's ties to South Korea's SK Telecom, which had commercial access to the models. The move was widely described as marking the start of an "AI Cold War."

Skepticism from Independent Analysts

Independent security researchers and analysts have expressed significant skepticism about 360's AI vulnerability claims, casting doubt on whether the tools truly match Mythos.

• Reports from April 2026 noted that 360's earlier AI system (internally called VULCAN) had claimed to autonomously discover over 1,000 vulnerabilities, but questions arose about how many of those were truly novel, autonomously found, or simply aggregated from existing databases.
• Security analysts have drawn comparisons between 360's claims and the Claude Mythos narrative, suggesting that 360's numbers may conflate human-assisted discoveries with fully AI-autonomous findings and that independent verification remains limited.
• The Bloomberg report (April 22, 2026) noted that while 360 had clearly been using AI to augment its security research, the company's public claims outpaced what outside experts could independently confirm.

Broader Context: U.S.-China Frontier AI Tensions

This announcement is the latest episode in an accelerating technology decoupling over frontier AI models, with each side's actions fueling the other's.

• Direct timing link: 360's launch came just 12 days after the U.S. export ban on Mythos 5, and Zhou Hongyi explicitly cited U.S. restrictions as the reason China needed its own capability.
• Zero-sum framing: Zhou cast AI vulnerability discovery as a strategic asset — whoever finds bugs first can patch them or weaponize them. This mirrored the U.S. national security rationale for the Mythos export controls.
• Escalation cycle: The U.S. restricted Mythos → China's 360 announced a domestic "equivalent" → Beijing frames the move as technological sovereignty. Each action by one side provides political cover for the other to accelerate its own program.
• Global fallout: The U.S. export ban on Mythos set off alarm bells not just in Beijing but also in Europe and Canada, as allies suddenly lost access to models they had been using for research, fueling a broader push for AI sovereignty worldwide.