Chinese Firm’s AI Vulnerability Claims Draw Comparisons to Claude Mythos
Summary
360 Digital Security Group claims its AI system contributed to roughly half of its findings at Tianfu Cup, where the firm says it identified nearly 1,000 vulnerabilities. An expert questions whether its capabilities match Claude Mythos.
Key points
- 360 Digital Security Group says its Multi-Agent Collaborative Vulnerability Discovery System contributed to roughly half of the vulnerabilities it identified at Tianfu Cup.
- The firm says it found close to 1,000 vulnerabilities at the competition, including more than 50 high-severity flaws across products such as Windows, Office, and Android.
- 360 claims its AI identified CVE-2026-32190, a critical Office vulnerability, within minutes; the firm says the flaw had gone undetected for about eight years.
- 360 also claimed discovery of Windows kernel flaw CVE-2026-24293, but Microsoft credits researchers from Taiwan and South Korea, casting doubt on 360’s claim.
- Researcher Eugenio Benincasa says 360’s capabilities appear significant but not equivalent to the reasoning attributed to Claude Mythos, and compares its approach more closely with Google’s Big Sleep.
- Benincasa says Chinese law requires private companies and researchers to report vulnerabilities to government agencies before public disclosure.
Article Details
- Event Type
- 360 Digital Security Group claims its AI-driven vulnerability discovery system found nearly 1,000 vulnerabilities, drawing comparisons with Anthropic’s Claude Mythos.
- Impact
- The reported findings include more than 50 high-severity flaws across products including Windows and Microsoft Office. 360 claims its system found the critical Office vulnerability CVE-2026-32190 within minutes; its claim concerning Windows kernel vulnerability CVE-2026-24293 is disputed, as Microsoft credits researchers from Taiwan and South Korea. The article also notes that Chinese vulnerability-reporting requirements channel research to government agencies before public disclosure.
CVE
CVE-2026-24293Microsoft · Windows 10 Version 21H2; Microsoft · Windows 10 Version 22H2; +8 moreA separate Windows kernel vulnerability (CVE-2026-24293) was also claimed, though Microsoft credits researchers from Taiwan and South Korea with that discovery, casting doubt on 360’s claims.CVE-2026-32190Microsoft · Microsoft 365 Apps for Enterprise; Microsoft · Microsoft Office 2016; +5 moreThe most striking individual claim involves CVE-2026-32190, a critical Office vulnerability that 360 says its AI agent identified within minutes, after it had allegedly gone undetected for roughly eight years.
People
Vendors
AnthropicA Chinese cybersecurity firm has claimed AI-driven vulnerability discovery capabilities that approach the scale of those attributed to Anthropic’s recently unveiled Claude Mythos model.GoogleA closer comparison, the expert suggests, is Google’s Big Sleep, which accelerates discrete stages of vulnerability research rather than operating as a fully autonomous agent.Microsoftfinding close to 1,000 vulnerabilities in total, including over 50 high-severity flaws across Windows, Microsoft Office, Android, OpenClaw, IoT devices, and other products.MozillaAs for Mythos’ capabilities, outside of Anthropic’s claims, Mozilla said the AI helped it find over 270 Firefox vulnerabilities, and Palo Alto Networks reported a significant boost in vulnerability discovery.Palo Alto NetworksAs for Mythos’ capabilities, outside of Anthropic’s claims, Mozilla said the AI helped it find over 270 Firefox vulnerabilities, and Palo Alto Networks reported a significant boost in vulnerability discovery.Qihoo 360According to Benincasa, claims made by the 360 Digital Security Group at 360 Security Technology (Qihoo 360), one of China’s largest cybersecurity companies, in the weeks surrounding Anthropic’s unveiling of Claude
Products
Android1,000 vulnerabilities in total, including over 50 high-severity flaws across Windows, Microsoft Office, Android, OpenClaw, IoT devices, and other products.Claude MythosA Chinese cybersecurity firm has claimed AI-driven vulnerability discovery capabilities that approach the scale of those attributed to Anthropic’s recently unveiled Claude Mythos model.Microsoft Officeclose to 1,000 vulnerabilities in total, including over 50 high-severity flaws across Windows, Microsoft Office, Android, OpenClaw, IoT devices, and other products.Microsoft Windowscontest, finding close to 1,000 vulnerabilities in total, including over 50 high-severity flaws across Windows, Microsoft Office, Android, OpenClaw, IoT devices, and other products.Mozilla FirefoxAs for Mythos’ capabilities, outside of Anthropic’s claims, Mozilla said the AI helped it find over 270 Firefox vulnerabilities, and Palo Alto Networks reported a significant boost in vulnerability discovery.OpenClawin total, including over 50 high-severity flaws across Windows, Microsoft Office, Android, OpenClaw, IoT devices, and other products.
Tools
Big SleepA closer comparison, the expert suggests, is Google’s Big Sleep, which accelerates discrete stages of vulnerability research rather than operating as a fully autonomous agent.Multi-Agent Collaborative Vulnerability Discovery System360 Digital Security Group’s claims center on an internally developed ‘Multi-Agent Collaborative Vulnerability Discovery System’, which appears to have played an important role in its first-place finish at Tianfu Cup, a
Countries
Industries
CybersecurityA Chinese cybersecurity firm has claimed AI-driven vulnerability discovery capabilities that approach the scale of those attributed to Anthropic’s recently unveiled Claude Mythos model.TechnologyAccording to Benincasa, claims made by the 360 Digital Security Group at 360 Security Technology (Qihoo 360), one of China’s largest cybersecurity companies, in the weeks surrounding Anthropic’s unveiling of Claude