Chinese cybersecurity company Qihoo 360 says it has built two AI security tools to rival Anthropic's Mythos, framing advanced vulnerability-hunting AI as a strategic deterrent in the US-China technology race. One of the tools has already flagged 3,432 vulnerabilities, according to founder Zhou Hongyi.
What Qihoo 360 announced
Speaking at a conference in Beijing, Zhou showed off two systems. The first, "Tu Long Feng," automatically hunts for software vulnerabilities, while the second, "Yi Tian Zhen," automates cyber defense. He put the gap between top Chinese models and the most capable Western ones at 20 to 30 percent, arguing that an agent-based approach, pairing models with human security expertise and automated tooling, helps close that distance.
- Vulnerability hunter: "Tu Long Feng" (3,432 vulnerabilities flagged so far)
- Automated defense: "Yi Tian Zhen"
- Claimed model gap vs. Western systems: 20 to 30 percent
Separately, Tsinghua professor Jie Tang, founder of Z.ai, estimated that a Chinese "Mythos"-class model could arrive before the first quarter of 2027. Without independent benchmarks, none of these performance claims can be verified, a caveat that applies to many vendor-led announcements in this fast-moving space. Follow the broader race in our AI news section.
The cyber-nuclear deterrence framing
Zhou compared an AI system that can find vulnerabilities and build attack chains on its own to "cyber-nuclear weapons of the AI era." He argued that China needs an "equivalent strategic deterrent capability," warning that one-sided transparency could let an adversary scan systems at scale while defenders are left blind.
The logic mirrors classic deterrence thinking: if one side can autonomously discover and exploit weaknesses faster than the other can patch them, the imbalance itself becomes a threat. By that reasoning, having a comparable offensive-defensive capability is presented less as an attack tool and more as a way to discourage attacks in the first place.
He pointed to export limits on Anthropic's Fable 5, calling it the "civilian, neutered version of Mythos," and said the US wants to preserve a monopoly over the capability. Both governments have used national security arguments to justify export controls, echoing a Cold War pattern now applied to AI rather than physical weapons.
Why it matters for the AI security race
The rhetoric signals how seriously state-aligned firms now treat automated security tooling as a national asset. AI that can autonomously probe code for flaws is a genuine double-edged technology: the same system that helps defenders find and fix bugs before attackers do can, in the wrong hands, accelerate the discovery of exploits.
Even the tool names carry martial overtones, likely referencing a classic Chinese martial arts novel, underscoring how the framing leans into conflict imagery. That positioning matters because it shapes policy: if vulnerability-hunting AI is treated like a strategic weapon, expect tighter export controls, more secrecy around capabilities, and a continued race to match rivals.
The wider debate over AI risk, governance, and export policy continues to ripple across the industry. The lack of independent verification means observers should treat bold capability claims with caution, but the strategic intent on display is unmistakable. The broader policy picture is covered across our tech and business reporting.
China's AI security tools: quick FAQ
What are Tu Long Feng and Yi Tian Zhen?
They are two AI security systems from Qihoo 360. Tu Long Feng automatically hunts for software vulnerabilities, having flagged 3,432 so far, while Yi Tian Zhen automates cyber defense.
How big is the gap with Western AI models?
Founder Zhou Hongyi estimated the gap between top Chinese and Western models at 20 to 30 percent, though the claims have not been independently benchmarked.
