Qihoo 360’s Tulongfeng AI Bug-Hunter Adds Geopolitical Heat to Cyber Sovereignty

By NewSunSEO | June 30, 2026

⏱ 8 min read · Last updated 2026-06-30

On June 29, 2026, Chinese cybersecurity firm Qihoo 360 Security Technology unveiled two AI-driven tools it says rival Anthropic’s Mythos vulnerability-hunting model. In rhetoric pulled straight from Cold War nuclear doctrine, CEO Hongyi Zhou framed the technology as essential for cyber deterrence, warning that anyone without equivalent AI-powered offense becomes a passive target. The release comes as the U.S. government imposes and then partially lifts export bans on Anthropic’s most advanced models, turning AI bugs-hunting into a flashpoint in the global digital sovereignty debate.

Why It Matters

Autonomous vulnerability discovery is no longer a niche lab exercise. Anthropic’s Mythos model, first previewed in 2025, has shown that an AI can comb through open-source code, identify flaws, and chain them into exploit paths at a scale no human team can match. By mid-2026, Mythos had generated more than 23,000 findings across over 1,000 open-source projects, with over 6,200 rated high or critical. Through its exclusive Project Glasswing taskforce, partners including Cisco and Palo Alto Networks have already identified more than 10,000 serious flaws. In the same period, Qihoo 360 introduced Tulongfeng and Yitianzhen, two tools that channel similar ambition through a distinctly Chinese software-engineering lens.

The emergence of a parallel capability outside U.S. labs intensifies an ongoing debate: should AI models powerful enough to audit any network be treated as strategic assets subject to export controls and national-security restrictions? For business owners who rely on web platforms, payment gateways, and cloud services, the rapid militarization of vulnerability research means the code your business depends on is being tested daily by both allies and adversaries, with or without your knowledge.

What's New: Tulongfeng and Yitianzhen

Qihoo 360, a Beijing-headquartered firm that landed on the U.S. Entity List in 2020 over allegations of enabling high-technology surveillance, announced the tools at the ISC.AI 2026 cybersecurity conference in Beijing. According to Reuters, Zhou described the second model, Yitianzhen, as “China’s version of Mythos.” Together, the pair forms a product suite named “Yitian Tulong,” drawn from a classic martial arts novel whose title translates to “Heavenly Sword and Dragon Saber.” Tulongfeng, the tip of the dragon saber, automates vulnerability hunting across open-source code, binary software, and AI-agent systems. Yitianzhen, a cluster sword formation, is an AI-driven security operations center (SOC) layer designed for automated cyber defense.

Zhou made clear that the approach is software-first, not model-first. Where he characterized Mythos as an automated researcher relying on “the strongest model, the strongest computing power and the strongest chips,” Tulongfeng instead orchestrates AI agents around Qihoo 360’s proprietary vulnerability intelligence. In his conference speech, Zhou said that domestically developed AI models still lag behind U.S. counterparts by 20% to 30% in underlying capabilities, but that China cannot wait to close the gap before fielding an operational bug-hunter. The platform was trained on 360’s database of 250,000 vulnerabilities accumulated since the company’s founding in 2005.

The Numbers

• 3,432 software vulnerabilities flagged by Tulongfeng across open-source code, binary software, and AI-agent systems, according to Zhou’s conference disclosure.
• Over 23,000 findings by Anthropic’s Mythos across more than 1,000 open-source projects, with over 6,200 high or critical, per Anthropic’s public statements.
• 10,000+ serious flaws identified by Project Glasswing partners since the taskforce gained exclusive access to Mythos’s full capabilities.
• 250,000 vulnerabilities in Qihoo 360’s internal database, used to train Tulongfeng since 2005.
• Before Q1 2027: Tsinghua University professor and Z.ai founder Jie Tang estimates on X that a Chinese “Mythos-class” model will arrive.

“Why has nuclear war never actually broken out? Because everyone possesses nuclear weapons, allowing for mutual deterrence. The same applies to cybersecurity. If others have them, so do I; I won't be passively attacked.”

Hongyi Zhou, CEO of Qihoo 360, via speech transcript at ISC.AI 2026

What Comes Next

The Tulongfeng launch landed in the same week that Anthropic accused Chinese tech giant Alibaba of illicitly extracting capabilities from its Claude models, and as the U.S. government imposed then partially rescinded an export ban on Anthropic’s latest models. Mythos 5 and Fable 5 were banned from export earlier in June 2026 over an alleged jailbreak method for Fable 5. Days later, the restriction on Mythos 5 was rolled back for a select group of more than 100 companies and agencies, while Fable 5 remains blocked.

Security analysts are watching the ripple effects. Laura Wilber, senior analyst in the office of the CTO at Swedish specialist Enea, said the ban reversal “added yet more fuel to the digital sovereignty fire in Europe, which will no doubt mean more funding flowing to the EU’s leading homegrown commercial LLM, Mistral.” Zhou’s nuclear-deterrence framing, combined with Entity List status and fresh accusations of AI intellectual property theft, points to a future where the world’s most capable vulnerability-hunting models are treated as regulated munitions, with every major bloc racing to build or acquire its own.

What This Means for You

Business owners may feel far removed from a Chinese firm on the Entity List, but the capabilities under discussion scan the same open-source libraries that power your website CMS, e-commerce plugins, and cloud connectors. An AI that can autonomously discover and chain vulnerabilities does not care whether the target is a government network or a small business database. As the model gap narrows, the offense accessible to state-backed actors and eventually to broader criminal groups will only grow more automated and faster.

Taking a few practical steps can reduce your exposure. Audit your website’s code and plugin stack for known vulnerabilities, and work with a team that understands secure code from the ground up. Our web design service builds sites with security as a foundation, not an afterthought. Complement that with SEO copywriting that respects content integrity and avoids injection vectors, clean, well-structured content is harder for automated tools to exploit.

Consistency across your digital presence helps you spot anomalies early. Keeping your social profiles active and uniform through an AI-powered manager like Feedsta.ai reduces the noise so you notice if something drifts. And to understand how AI agents perceive your brand today, run a free visibility scan at BizScoreAI, it shows whether your business gets recommended across ChatGPT, Gemini, and Perplexity, which matters when an automated attacker or a customer consults the same tools. For a deeper look at how Chinese models are catching up, read our post on Z.ai’s GLM-5.2 matching Mythos on cybersecurity tasks.

The Bigger Picture

Cyber deterrence that was once a matter of military doctrine is now written into model architecture and export-control paperwork. Tulongfeng is a signal that AI-driven vulnerability research will no longer be a one-sided advantage, and every organization with a digital footprint, regardless of size, sits on the terrain where this arms race plays out. The most realistic protection is not hoping your stack goes unnoticed, but building and monitoring it with the assumption that it will be poked by machines that learn faster than any patch cycle.

Frequently Asked Questions