Working title above. Editor alternates: “TuLongFeng Finds Zero-Days. It Does Not Fix Them, and You Cannot Check Its Work.”
The question about China’s new AI vulnerability finder is not whether it is comparable to Anthropic’s Mythos. It is whether anyone independent has checked its work, where the tool operates in your stack, and who reads a finding first.
On June 24, 2026, 360 Security Technology (also branded Qihoo 360) unveiled TuLongFeng, an AI agent swarm built to find software vulnerabilities, and framed it as China’s answer to Anthropic’s Claude Mythos. The Western news coverage asked one question: is it as good as Mythos? For a security leader deciding what to buy or defend against, that is the wrong lens. Capability sets the ceiling on what a tool can find. Verifiability sets the floor on what you can act on, and a finding you cannot verify is just noise with a severity score attached.
A second confusion sits in how these systems get sold. TuLongFeng and Mythos are often described as doing SAST, DAST, and supply chain scanning. Neither AI system remediates, and that is the center of the problem, not a gap in the product. 360 pairs it with a companion tool, Yitianzhen, pitched as automated defense, but no evaluator has tested that either. A discovery engine does not fix what it finds.
What changed is the price of discovery. Industry estimates put the compute to find one zero-day below $1,000, and a directed review of a large codebase near $20,000 at frontier-API pricing.
These are discovery engines, not scanners, and they fix nothing
TuLongFeng is not a single frontier model like Mythos. It is a multi-agent swarm: smaller specialized models wired to 360’s twenty years of exploit telemetry and a vulnerability database the company puts at 250,000 records. Founder Zhou Hongyi calls it a professional attack-and-defense team rather than a cultivated genius hacker. He concedes a 20 to 30 percent capability gap against the U.S. frontier, and the swarm is his answer to it: agents and exploit data compensating for a weaker base model.
The swarm maps onto categories a CISO already knows. Its data-flow agents run static application security testing, or SAST, tracing user input to dangerous code paths with semantic reasoning instead of pattern rules. Its sandbox agents run the dynamic half, DAST, firing exploit code at a live target in isolation. What is absent matters more. Nothing shows TuLongFeng doing software composition analysis, the dependency work most people mean by supply chain: parsing a manifest, producing a software bill of materials, or running reachability analysis to see whether flawed code is ever called. Mythos does not do this either; it finds novel flaws in library source code, a different act from flagging a known CVE in a stale package.
This is where the average appsec platform, the enterprise stack already embedded in your pipeline, earns its keep. A conventional tool runs deterministic SAST and composition analysis across dozens of languages, resolves reachability to cut false positives, and ships remediation guidance inside the CI/CD pipeline, for $10 to $50 per developer per month. Modern applications run 70 to 90 percent third-party code; that exposure is the scanner’s home turf, not the swarm’s. The scanner cannot find the unknown flaw; it matches what is already cataloged. The two are complements. A board that hears “AI-powered supply chain scanning” and pictures a faster version of the scanner it already owns has bought a category error.
Neither AI system remediates, and that is the center of the problem, not a gap in the product. In Anthropic’s Project Glasswing disclosure, fewer than one percent of the model’s findings had been patched at reporting time, with the drop-off at the human steps: triage, validation, disclosure, patch, deploy. Security executive Grant Bourzikas puts it plainly: ask a model to find bugs and it will return them whether the code has any or not, and the hedged maybes swamp the solid ones. Picture Monday’s queue after a weekend of machine discovery: hundreds of findings, none validated, and the analysts who must confirm them are the same people still patching last quarter’s.
Among discovery engines, proof is the product
TuLongFeng and Mythos diverge here, and not on architecture. Before Anthropic made a public claim, Mythos went through the UK AI Security Institute, six independent security firms, and more than fifty partner organizations. Those firms assessed 1,752 high and critical findings and confirmed 90.6 percent as true positives. Mozilla used the model to fix 271 Firefox vulnerabilities, more than ten times the team’s prior-cycle total with a weaker model. The number is the independently confirmed true-positive rate: five thousand findings at ninety-five percent beat ten thousand at fifty.
TuLongFeng’s true-positive rate is unknown. No recognized independent evaluator has tested it. The headline 3,432 vulnerabilities and the 105 said to be confirmed both come from 360, the confirmations from China’s national vulnerability database rather than an outside evaluator. The company’s record sharpens the point. In 2015, three independent antivirus labs jointly revoked 360’s certifications for submitting a test configuration it did not ship to customers. In April 2026, Microsoft credited a Windows kernel vulnerability 360 had presented as an AI discovery to researchers in Taiwan and South Korea instead. None of this proves the current claims false. It does raise the burden of proof.
None of that makes TuLongFeng vaporware. It works. Its swarm found 13 zero-days in Flowise, an open-source platform for building AI applications; the state database confirmed eight. It found 23 more in the OpenClaw framework. Eugenio Benincasa of ETH Zurich judges the architecture genuine and able to find confirmed, exploitable bugs. He concludes it does not yet match Mythos and sits closer to Google’s Big Sleep, which speeds up stages of research rather than running the whole chain. Real is not the same as verified.
Few Western enterprises will run it, and the ones tempted should read the disclosure law first
What Western firms already do is the opposite of what adopting TuLongFeng would require. They run Chinese open-weight models for cost savings. Coinbase reported cutting its AI spend nearly in half after moving to GLM 5.2 and Kimi 2.7. Orange in France self-hosts open models, Chinese ones included, likening it to buying a painting abroad and hanging it at home. The point of this approach is control: open weights run on the company’s own hardware and the data never leaves.
TuLongFeng offers none of that. 360 has released no weights and no documentation; it runs as a closed service, so a buyer cannot self-host it or keep the data on prem. It is an offensive-capable tool from a company on the U.S. Entity List since 2020 and named a Chinese military company by the Pentagon in 2022. So the honest answer is that almost no Western enterprises would run it. The few tempted by the capability hit a disqualifier. Chinese law requires any vulnerability to be reported to the Ministry of Industry and Information Technology within 48 hours, before the vendor is told and before the public. The National Intelligence Law obliges the company to cooperate with the state, so every zero-day it finds reaches Beijing before the software’s maker. That early knowledge is a defensive and offensive edge: Beijing can harden its own systems and exploit the window before the flaw is public. This piece argues neither for copying China nor for banning the tool, only that a buyer should know what it inherits.
Put four demands to any vendor selling AI vulnerability discovery, whatever flag it flies. First, name the layer: novel discovery or composition analysis, and if you need dependency scanning and reachability, who does that, because the discovery engine will not. Second, show the independently confirmed true-positive rate, not the raw count; an unaudited number is marketing. Third, trace the disclosure path: who sees a finding first, and under what legal obligation, before you do. Fourth, fund the patch, because you are buying more findings than your team can fix, and discovery you cannot remediate is inventory, not defense. Discovery is automated. Proof and the patch are not. Until they are, a vulnerability you cannot verify or fix is not a security win. It is a liability wearing a CVSS score.
Join our LinkedIn group Information Security Community!
