AI that finds bugs 100x faster: 360 founder demands Chinese Mythos

The frontier of AI development is shifting from chat towards autonomous cyber operations, and Anthropic’s Mythos is its most consequential example yet. With the ability to slash vulnerability discovery costs and democratize offensive capabilities, Mythos has turned AI into a tool of strategic deterrence. For China’s AI labs, Zhou’s speech signals that national security imperatives will increasingly dictate model priorities, pushing them beyond general benchmarks into hardened, military-grade cybersecurity applications. The race is no longer about who builds the best language model—it’s about who builds the best autonomous hacker.

In a stark warning at a Beijing cybersecurity conference on June 24, 2026, 360 Security Technology founder Zhou Hongyi declared that China must urgently develop its own equivalent to Anthropic's Mythos AI model, describing the US technology as a 'cyber nuclear weapon' that threatens to tilt the balance of global cyber defenses irreversibly against nations excluded from it. Zhou's remarks mark the first public alert from a prominent Chinese tech leader about the strategic dangers posed by an American frontier AI model designed from the ground up to autonomously find and exploit software vulnerabilities at unprecedented speed and scale. Released in April 2026, Mythos reportedly accelerates vulnerability discovery a hundredfold while slashing associated costs, effectively 'democratising' offensive cyber capabilities and putting them within reach of a much wider range of actors. The entire cybersecurity industry now confronts a new era where attack surfaces can be mapped and breached orders of magnitude faster than human researchers or legacy tools could ever manage.

“

The frontier of AI development is shifting from chat towards autonomous cyber operations, and Anthropic’s Mythos is its most consequential example yet.

Zhou specifically highlighted the US-orchestrated Project Glasswing alliance, through which Anthropic in April granted more than 40 organizations access to Mythos Preview to strengthen their cyber defenses, while conspicuously excluding any Chinese entity. This arrangement, Zhou argued, means that US and allied defenders can systematically scan Chinese digital infrastructure for zero-day vulnerabilities without Chinese counterparts ever getting the chance to examine the very engine performing those scans. For Zhou, that asymmetry is tantamount to a strategic nuclear imbalance — hence his call for a domestic equivalent to create a 'reciprocal strategic deterrence capability' modeled on mutually assured destruction logic. His framing was deliberately provocative, aiming to galvanize policymakers and industry into mobilizing the kind of resources China previously marshaled for its nuclear weapons and space programs. Behind the rhetoric lies a concrete fear: that Mythos-class models will shift the offense-defense balance so decisively that known vulnerabilities will proliferate faster than patches can be developed, tested, and deployed, leaving critical infrastructure permanently exposed.

The context of Zhou's warning is a fiercely intensifying US-China technology rivalry, now entering a phase where AI security tools are being weaponized as instruments of geostrategic advantage. Anthropic's own brief roll-out of its consumer-facing Claude Fable 5 model earlier this year — and its subsequent withdrawal after Washington ordered a block on foreign access — had already exposed the extent to which AI model distribution is becoming politicized. That episode fueled speculation that Chinese open-weight models, such as Zhipu AI's GLM-5.2, might close the gap, but Zhou's comments suggest a far more urgent and defense-focused ambition: not merely parity in general-purpose language models, but a dedicated, AI-powered vulnerability research engine that can operate at the scale of an entire nation's attack surface. For a country as digitally vast as China, with its massive state-owned enterprises, sprawling fintech ecosystem, and critical infrastructure networks, the absence of such a capability represents a potential systemic risk.