China’s 360 Security Launches AI Tools to Counter U.S. Export Restrictions on Anthropic

Published by James Harris on June 24, 2026June 24, 2026

China’s largest cybersecurity firm unveiled two AI security tools at the ISC.AI 2026 conference in Beijing this week, positioning them as a direct answer to Anthropic’s Mythos vulnerability-detection system after Washington moved to restrict that technology’s export to foreign entities.

The framing matters as much as the tools themselves. Anthropic’s Mythos, previewed in April, reportedly uncovered thousands of serious vulnerabilities across operating systems and browsers before U.S. authorities ordered a suspension of even its less powerful export variant, citing national security. That export restriction is the proximate cause of 360 Security’s announcement: founder Zhou Hongyi, who sits on China’s top political advisory body, argued explicitly that without domestic equivalents, China faces what he called “one-way transparency,” where American systems can probe Chinese infrastructure while Chinese firms lack reciprocal reach. The announcement lands in a context where U.S. chip export controls since 2022 have constrained Chinese AI development broadly, making the agent-based workaround Zhou describes less a technical preference and more a necessity shaped by restricted hardware access.

Zhou acknowledged a 20 to 30 percent base capability gap between Chinese and American AI models, which is a rare admission from a founder pitching parity.

The two tools, Tulongfeng for vulnerability discovery and Yitianzhen for automated defense and incident response, are built on what 360 describes as an agent architecture: layering AI over existing security expertise, vulnerability databases, and automated tooling rather than competing on raw model performance. The company claims Tulongfeng has identified 3,432 software vulnerabilities, with 105 confirmed by Chinese authorities. Whether that output genuinely matches Mythos performance is unverifiable from the outside, but the architectural argument Zhou is making, that a well-integrated system beats a more capable model running in isolation, is a legitimate engineering position and one that other resource-constrained teams have used to close gaps against frontier labs before.

The dual-use problem here is the same one that alarmed Western security researchers when Mythos was first announced. A system that finds vulnerabilities at scale for defensive purposes is, by definition, an offensive capability waiting for different instructions. Both sides of this exchange understand that, which is precisely why Zhou’s remarks carry political weight beyond the product launch itself. The mutual accusations over offensive cyber operations targeting critical infrastructure that have defined U.S.-China relations for years now have a new technical layer, and this announcement signals that Chinese firms are no longer content to let that layer develop asymmetrically.