Key Takeaways
- TuLongFeng is an AI‑driven multi‑agent swarm from Qihoo 360 designed to discover software vulnerabilities, not to fix them.
- Unlike traditional SAST/DAST tools, it does not perform software‑composition analysis or provide remediation guidance.
- Its true‑positive rate has not been independently verified; the numbers released by 360 come from internal sources and China’s national vulnerability database.
- The system operates as a closed cloud service—no model weights or source code are released, so enterprises cannot self‑host or keep data on‑premises.
- Chinese law requires any discovered zero‑day to be reported to the Ministry of Industry and Information Technology within 48 hours, giving the state early knowledge before the vendor or public.
- For Western buyers, the combination of non‑verifiable findings, lack of remediation, and legal disclosure obligations makes TuLongFeng a high‑risk, low‑utility option unless the four vendor questions outlined below are answered satisfactorily.
- Discovery engines are only valuable when paired with independent proof of accuracy and a funded patch‑management process; otherwise they generate inventory, not security.
Overview of TuLongFeng and Its Positioning
On June 24 2026, Qihoo 360 (also branded 360 Security Technology) unveiled TuLongFeng, marketing it as China’s answer to Anthropic’s Claude Mythos. The tool is presented as an AI‑agent swarm that hunts for zero‑day vulnerabilities across software stacks. While Western coverage has focused on whether TuLongFeng matches Mythos in raw capability, security leaders should look beyond capability to verifiability and actionability. A tool that can uncover flaws but cannot be trusted or acted upon adds noise rather than defense. Consequently, the decisive metric is not the ceiling of what the AI can find, but the floor of what an organization can verify, prioritize, and patch.
How TuLongFeng Works: The Multi‑Agent Swarm
TuLongFeng is not a single frontier large language model; it is a swarm of smaller, specialized models wired together. These agents draw on 360’s twenty‑year exploit telemetry and a vulnerability repository claimed to hold 250,000 records. Founder Zhou Hongyi describes the swarm as a “professional attack‑and‑defense team” rather than a lone genius hacker, acknowledging a 20‑30 percent capability gap against U.S. frontier models and arguing that the collective agents and historic data close that gap. The swarm’s agents map to familiar AppSec categories: data‑flow agents conduct static application security testing (SAST) by reasoning semantically about user input and dangerous code paths, while sandbox agents perform dynamic application security testing (DAST) by launching exploit code against live targets in isolation.
Comparison with Anthropic’s Mythos
Anthropic’s Mythos, by contrast, is a single frontier model that has undergone extensive external validation. Before public release, Mythos was evaluated by the UK AI Security Institute, six independent security firms, and over fifty partner organizations. Those evaluators confirmed 90.6 percent of 1,752 high‑ and critical‑findings as true positives, and Mozilla used the model to patch 271 Firefox vulnerabilities—more than ten times its prior cycle total. TuLongFeng’s true‑positive rate remains unknown; the headline figure of 3,432 discovered vulnerabilities and the claim that 105 were “confirmed” originate solely from 360, with confirmations drawn from China’s national vulnerability database rather than an independent auditor. The lack of third‑party testing shifts the burden of proof onto prospective buyers.
Discovery vs. Remediation: Why Finding Isn’t Fixing
Both TuLongFeng and Mythos are discovery engines; neither remediates the vulnerabilities they uncover. 360 offers a companion tool, Yitianzhen, pitched as automated defense, but it has not been subjected to independent evaluation either. Consequently, organizations that adopt TuLongFeng receive a stream of findings that must still be triaged, validated, disclosed, patched, and deployed by human teams. As security executive Grant Bourzikas notes, asking a model to find bugs will return results even when the code is clean, and the hedged “maybes” can drown out genuine issues. The result can be a Monday queue of hundreds of unverified findings, overwhelming analysts who are already busy patching last quarter’s bugs.
Independent Validation and True‑Positive Rates
The security value of any discovery tool hinges on its verified true‑positive rate. Mythos benefited from a transparent validation pipeline: independent labs assessed thousands of findings, producing a robust metric that allowed teams to trust the output. TuLongFeng lacks such transparency. No recognized independent evaluator has tested the swarm, and the company’s own record raises concerns—e.g., in 2015 three antivirus labs revoked 360’s certifications for submitting a test configuration it did not ship, and in April 2026 Microsoft credited a Windows kernel vulnerability presented by 360 as an AI discovery to researchers in Taiwan and South Korea instead. While these incidents do not prove the current claims false, they underscore the need for external verification before trusting any output.
Operational Model: Closed Service vs. Open‑Weight Alternatives
TuLongFeng is delivered as a closed cloud service; 360 has released no model weights, architecture details, or documentation. This prevents enterprises from self‑hosting the tool or keeping data on‑premises, a model many Western firms favor when using Chinese open‑weight models for cost savings and control. Companies such as Coinbase and Orange have reported cutting AI spend by hosting models like GLM 5.2 and Kimi 2.7 on their own infrastructure, ensuring that data never leaves their control. By contrast, TuLongFeng’s opaque, off‑premise delivery means that any finding—and the underlying code or telemetry used to generate it—remains under 360’s purview and, by extension, subject to Chinese legal obligations.
Geopolitical and Legal Considerations for Western Adoption
Chinese law imposes strict disclosure timelines on vulnerability discoverers. Any zero‑day identified by TuLongFeng must be reported to the Ministry of Industry and Information Technology within 48 hours, before the software vendor is notified and before the public learns of the flaw. Furthermore, China’s National Intelligence Law obliges companies to cooperate with state intelligence efforts, meaning that every vulnerability TuLongFeng uncovers is likely to reach Beijing before the affected organization or the global community. This early knowledge can be used defensively to harden Chinese systems or offensively to exploit the window before a patch is released. For Western enterprises, adopting TuLongFeng therefore entails inheriting a disclosure pipeline that prioritizes state awareness over customer protection—a significant strategic and compliance concern.
Practical Guidance for Evaluators: Four Questions to Ask Vendors
When assessing any AI‑based vulnerability discovery product—whether it flies a Chinese, American, or other flag—buyers should demand clear answers to four core questions:
-
Layer of operation: Does the tool perform novel zero‑day discovery, or does it also handle software‑composition analysis and reachability analysis? If the latter is needed, which component or partner supplies it, because the discovery engine alone will not.
-
Verified accuracy: What is the independently confirmed true‑positive rate, not merely the raw count of findings? Request audit reports, third‑party test results, or peer‑reviewed studies that validate the tool’s precision.
-
Disclosure path: Who sees a finding first, and under what legal or contractual obligations is that information shared before the customer? Understanding the flow of data helps assess risk of premature state exposure or delayed customer notification.
- Patch funding: How will the organization address the volume of findings? Discovery without a funded remediation process creates inventory, not security. Ensure that budget, personnel, and workflow are allocated for triage, validation, patch development, and deployment.
Only when satisfactory answers are obtained can a discovery engine be considered a genuine asset rather than a liability.
Conclusion: Discovery Engines Need Proof and Patch
TuLongFeng illustrates a broader trend in AI‑driven security: the price of discovering a zero‑day has fallen dramatically—industry estimates place the compute cost below $1,000 per flaw and a directed review of a large codebase near $20,000 at frontier‑API pricing. Yet low cost does not equal value. A tool that generates unverified findings and offers no remediation merely adds to the workload of already stretched security teams. Real security gains arise when discovery is coupled with independent proof of accuracy and a concrete, funded patch‑management pipeline. Until vendors can demonstrate both, any vulnerability uncovered by an AI swarm remains a potential liability wearing a CVSS score, not a definitive win for defense.