The questions security teams should be asking about China's "Mythos rival" TuLongFeng

When 360 Security Technology (Qihoo 360) rolled out TuLongFeng on June 24, 2026, the Western press reached for the obvious framing: is China's AI bug-hunter as good as Claude Mythos?

It is a tidy question - but the wrong one. For any leader deciding what to buy or defend against, capability is the least interesting variable.

The first point to note is that under China’s vulnerability rules, a network product provider that discovers or learns of a vulnerability in its product must report it to the Ministry of Industry and Information Technology's platform within two days.

The rules also restrict public disclosure before a patch. Their precise application to findings in a foreign customer’s code is not publicly clear.

The National Intelligence Law imposes broad obligations to cooperate with state intelligence work. That raises questions about whether TuLongFeng findings reach Beijing first. This is not an argument to ban the tool, only that a buyer should understand what it inherits.

But those are not the only questions.

A category confusion

Both TuLongFeng and Mythos are described in the trade press as tools that do SAST, DAST, and supply chain scanning. That flattens a distinction that matters.

These are discovery engines built to hunt novel flaws in source code, not the appsec platform your CI/CD pipeline already runs, and not designed to replace it.

TuLongFeng is a multi-agent swarm, not a single frontier model. Data-flow agents perform static analysis with semantic reasoning rather than signature rules. Sandbox agents fire exploit payloads at live targets in a sandbox environment to confirm exploitability.

READ MORE: "A productive equilibrium": How to scale agentic AI without losing control

Founder Zhou Hongyi has indicated a 20 to 30 percent capability gap against U.S. frontier models and compensates with specialization, orchestration, and roughly twenty years of exploit telemetry drawn from a 250,000-record database.

What is missing, based on the public materials we reviewed, is the work most enterprises actually mean when they say “supply chain.” Neither system is publicly documented as parsing a manifest, producing a software bill of materials, or running reachability analysis. That is composition analysis, the daily work of the conventional appsec platform inside your build pipeline.

Modern applications often rely heavily on third-party code. The scanner you already own owns that territory. The AI swarm hunts unknown flaws in the code you wrote yourself.

Any briefing that treats 'AI-powered supply chain scanning' as a replacement for the existing scanner is a category error waiting to become a budget mistake.

Discovery is cheap. The work that matters still is not.

The economics have shifted plainly. Published experiments suggest that the compute cost of finding vulnerabilities can now fall into the hundreds or low thousands of dollars, although the figures vary substantially by codebase, methodology and the depth of verification required.

Those are order-of-magnitude changes from two years ago, and they are why every major security vendor is racing to fold discovery agents into a roadmap. What has not gotten cheaper is anything downstream.

Triage still needs an analyst. Validation still needs a reproducible test case. The patch still needs an engineer with context and customers who can absorb the change.

Anthropic’s initial Project Glasswing disclosure said that 75 of the 530 high- or critical-severity vulnerabilities reported to open-source maintainers had been patched at the reporting cutoff. Anthropic noted that it was still early in its 90-day disclosure window and that some patches might not yet have been counted. The drop-off was not in the model. It was at every human step after.

Among discovery engines, proof is the product

This is where TuLongFeng and Mythos genuinely diverge, and it is not architectural. Before Anthropic made a public claim about its capabilities, Mythos was pushed through the UK AI Security Institute, six independent security firms, and more than fifty partner organizations.

Those evaluators assessed 1,752 high and critical findings and confirmed 90.6 percent as true positives. Mozilla used the model to close 271 Firefox vulnerabilities in a single cycle, more than ten times its prior-cycle total. Five thousand findings at 95 percent beats ten thousand at 50.

TuLongFeng’s true-positive rate is unknown and we could not find any tests from recognised independent evaluators. The 3,432 vulnerabilities in the headline and the 105 said to be confirmed both come from 360, which says the latter were confirmed by Chinese regulatory bodies rather than an outside lab. The company’s record makes that unaudited number worth more scrutiny, not less.

READ MORE: "Nine seconds of terror": AI agents are wiping out systems at machine speed

However, the tool is not vaporware. 360 says its swarm found 13 zero-days in an open-source AI-application platform; eight had been confirmed at the time of its initial report. The company also says it found and confirmed 23 vulnerabilities across an open-source AI agent platform and ten derivative products.

Eugenio Benincasa at ETH Zurich analyzed 360’s earlier multi-agent vulnerability work. He claimed that its capabilities appeared significant but did not yet match the reasoning attributed to Mythos, placing the system closer toGoogle’s Big Sleep, which accelerates individual stages of vulnerability research rather than operating as a fully autonomous agent. Real and verified are not the same word.

Is the disclosure path the disqualifier?

Western enterprises have gotten comfortable running Chinese-origin AI. Coinbase reported cutting its AI spend nearly in half while experimenting with open-weight models including GLM 5.2 and Kimi 2.7.

Orange in France runs a mixed stack that includes Chinese open models, comparing self-hosting them to buying a painting in China and hanging it at home. The logic is control: weights on the buyer’s hardware, data inside the perimeter. TuLongFeng does not offer the same public transparency.

360 has released no public weights. Its current offer is an approval-based trial, and the available materials do not indicate whether customers can deploy it on-premises or keep the source code entirely within their own environment. The vendor is subject to U.S. Entity List export controls and appears on the Defense Department’s current list of Chinese military companies.

Four questions to put to any AI discovery vendor

The lens I would offer any leader evaluating an AI discovery pitch, regardless of the vendor's flag, is a short list. First, name the layer: novel discovery, composition analysis, or both, and be clear who owns dependency scanning and reachability.

Second, produce the independently confirmed true-positive rate, not the raw count. An unaudited number is marketing.

Third, trace the disclosure path in writing: who sees a finding first, under what legal obligation, and how long before you do. Fourth, fund the patch. You are about to buy more findings than your remediation pipeline can absorb, and discovery you cannot triage or fix is not defense. It is inventory.

Discovery has been automated. Proof and the patch have not. A vulnerability you cannot verify or repair is a liability wearing a CVSS score.

Collin Hogue-Spears is senior director of solution management at Black Duck