Chinese cybersecurity firm Qihoo 360 has revealed that its agent-based vulnerability-hunting platform, Tulongfeng, has flagged 3,432 software flaws since launch, with a companion SOC tool called Yitianzhen now handling automated defense. The disclosure lands in the middle of a fast-widening race over AI-powered bug discovery, and it changes what responsible site owners should be checking on their own stacks this quarter.<\/p>\n
Tulongfeng, whose name draws from a classic martial arts novel, is not a single large model. According to Qihoo 360 CEO Hongyi Zhou, it is an orchestrated platform that pairs multiple AI agents with security expertise and automated tooling. Zhou has publicly framed the gap between top Chinese and Western AI capabilities at roughly 20-30%, and positioned the architecture as a way to close that gap in vulnerability research specifically.<\/p>\n
The Tulongfeng figure matters less for its raw size than for what it represents: a second sovereign-grade AI system is now actively scanning open-source code, binary software, and agentic systems for exploitable weaknesses. Anthropic’s Mythos Preview has already generated more than 23,000 findings across 1,000+ open-source projects, including over 6,200 rated high or critical, and partners in Project Glasswing (Cisco, Palo Alto Networks) have surfaced 10,000+ serious flaws using the full Mythos capability set. With Tulongfeng on the other side of the ledger, every public-facing dependency you ship is now being read by at least two AI systems trained for adversarial review.<\/p>\n
For a site owner running technical SEO audits, the practical translation is straightforward: your attack surface and your crawl surface overlap more than they used to. Components that were obscure enough to escape human review are now indexable by AI scanners that report flaws up the supply chain. If a CMS plugin, a CDN worker, or a third-party script ships with a known weakness, expect it to surface in published vulnerability databases within weeks, not months.<\/p>\n
The platform is built on an agent-based orchestration layer rather than a monolithic frontier model. Zhou describes it as combining AI models with Qihoo 360’s security tooling and a 250,000-vulnerability internal database accumulated since 2005. The training corpus, drawn from two decades of Chinese-language vulnerability research, is one of the system’s main differentiators, along with the integration between discovery and the Yitianzhen defense layer that automates response.<\/p>\n
The architecture choice is itself a signal. Rather than waiting for a single Chinese model to match Western frontier performance head-on, Qihoo 360 has wrapped multiple models, including open-weight ones, into a workflow that compensates for per-model weakness with coordination. That is a pattern site owners will see mirrored in offensive security tooling more broadly over the next year.<\/p>\n
Qihoo 360 was placed on the U.S. Bureau of Industry and Security Entity List in 2020 over accusations of enabling China’s high-technology surveillance. That restriction sits underneath the current exchange: Anthropic’s Fable 5, which Zhou called the “civilian, neutered version of Mythos,” remains blocked from China, while the U.S. government has partially rescinded the Mythos 5 export ban to give access to more than 100 vetted companies and agencies. Security analyst Laura Wilber of Enea has noted that this widening gap is pushing European funding toward domestic alternatives, with Mistral cited as a likely beneficiary.<\/p>\n
For site owners, the export-control layer matters because it determines which AI scanner sees your stack first and which patches reach which market on what timeline. A CVE disclosed by Mythos in a U.S.-hosted project may not produce a Tulongfeng-flagged equivalent on a China-hosted mirror for weeks, and vice versa. Dual-listing and dual-patching are becoming the norm rather than the exception.<\/p>\n
Given that two sovereign AI vulnerability hunters are now actively scanning public code, the audit items below should move up your priority list. None of them require new tooling beyond what a competent technical SEO or DevSecOps setup already includes.<\/p>\n
Two near-term milestones will reshape the picture. Tsinghua University professor Jie Tang, founder of Z.ai, has predicted that a Chinese model with Mythos-class vulnerability-hunting capability will arrive before Q1 2027. If that lands, a third scanner enters the field and the audit cadence above shifts from weekly to near-real-time. Separately, watch how the partial U.S. export relaxation is administered: the list of 100-plus approved Mythos 5 recipients will set the precedent for which allied organizations get sovereign-grade scanning access.<\/p>\n
The deterrence framing Zhou used, comparing vulnerability-hunting AI to nuclear weapons, is rhetorical, but the operational implication is concrete. When every major power can find your flaws faster than you can patch them, the only defensible posture is continuous monitoring and a documented, rehearsed response loop. That is the audit posture worth building now, before the next disclosure cycle forces it on you.<\/p>\n
Tulongfeng is an orchestrated, agent-based platform that combines multiple AI models, security expertise, and automated tooling on top of a 250,000-vulnerability internal database Qihoo 360 has built since 2005. Mythos is described as a more centralized model with its own substantial scan footprint. Tulongfeng’s architecture is explicitly designed to compensate for the 20-30% per-model capability gap Qihoo 360’s CEO cites between Chinese and Western frontier systems.<\/p>\n
Yes, but in a productive way. Faster discovery of known flaws shortens the window between disclosure and patch, which rewards teams that maintain current SBOMs, pin third-party scripts, and rebuild containers on a schedule. The risk falls on teams that rely on obscurity or slow patching, since AI scanners now read public code at machine speed across multiple jurisdictions.<\/p>\n
Qihoo 360 has been on the U.S. Entity List since 2020 over allegations of enabling high-technology surveillance, which limits its access to U.S. exports and shapes its incentive to build indigenous tooling. For site owners, that means vulnerability disclosures originating from Qihoo 360’s research may appear on different timelines than Western CVE feeds, and dual-listing in both Western and Chinese vulnerability databases is becoming standard practice.<\/p>\n