---
title: "Anthropic gives away the bug scanner Qihoo 360 called a 'cyber nuclear weapon'"
description: "Qihoo 360 staked its AI story on founder Zhou Hongyi's claim that Anthropic's Mythos bug hunter is a \"cyber nuclear weapon\" China must match. Anthropic's October access expansion and free OSS Scanner now undercut the scarcity behind that pitch, and 360's controlling shareholder has just finished a 56-million-share trim."
publisher: "The Inference"
section: "Safety"
published: 2026-10-21T01:24:40.238Z
modified: 2026-10-21T01:24:40.238Z
canonical: https://theinference.org/article/anthropic-gives-away-the-bug-scanner-qihoo-360-called-a-cyber-nuclear-weapon
language: en
keywords: "Anthropic, Qihoo 360, Cybersecurity, China, Export Controls"
---

# Anthropic gives away the bug scanner Qihoo 360 called a 'cyber nuclear weapon'

> Qihoo 360 staked its AI story on founder Zhou Hongyi's claim that Anthropic's Mythos bug hunter is a "cyber nuclear weapon" China must match. Anthropic's October access expansion and free OSS Scanner now undercut the scarcity behind that pitch, and 360's controlling shareholder has just finished a 56-million-share trim.

## A weapon China cannot buy

At the 14th Beijing Cybersecurity Conference on June 25, 2026, Zhou Hongyi, founder of Chinese security vendor Qihoo 360, a company on the US Entity List since 2020, [called Anthropic's Mythos model the equivalent of a "cyber nuclear weapon"](https://www.theregister.com/security/2026/06/26/chinese-cybersecurity-company-claims-its-built-a-better-than-mythos-bug-finder/5262642) [1][2]. US curbs keep foreign nationals off the model, he argued, letting US-aligned organizations hunt flaws in the software everyone else runs, so China needs matching power for mutual deterrence.

## A swarm must beat brute force

His answer was [Tulongfeng](https://theinference.org/article/qihoo-360-swung-to-a-rmb-216-million-first-half-profit-selling-china-s-answer-to-anthropic-s-mythos), a multi-agent swarm of security agents, plus Yitianzhen, which simulates attacks against a customer's own defenses. "If the American approach is about cultivating a genius hacker, the 360 approach is about organizing a professional attack and defense team," Zhou said [1]. Domestic models trail US ones by 20 to 30 percent in underlying capability, he added, so a swarm must beat brute force [1][2]. He claimed 3,432 vulnerabilities found so far, and [Microsoft](https://theinference.org/markets/companies/microsoft)-recognized discoveries of Windows, Office and Excel bugs dormant for five, eight and ten years [1][2].

## Anthropic just made bug-finding free

Then the other side of the wall moved. On October 6, [Anthropic](https://theinference.org/markets/companies/anthropic) folded [Project Glasswing](https://theinference.org/article/palo-alto-rents-out-the-cyber-models-anthropic-and-openai-keep-locked) into [a three-tier Cyber Verification Program](https://www.anthropic.com/news/cyber-verification-program): Defense, Red Team and Specialized Access, the last reviewed in collaboration with the US government, all covering Claude Opus 5.5, Sonnet 5.5 and Mythos 5.1 [3].

Two days later came [the Cyber Mission and OSS Scanner](https://www.anthropic.com/news/anthropic-cyber-mission), which scans open-source projects free and emails maintainers model-generated reports, reproduction steps and fix candidates included, with no human review [4]. In validation, 85 of 97 sampled high-severity reports met disclosure criteria; early user wolfSSL judged 72 of 74 valid, five becoming CVEs [5].

*Chart: **Both checks cleared most early OSS Scanner reports** Column chart: 85 of 97 sampled high-severity reports met Anthropic's disclosure criteria, and 72 of 74 reports judged by wolfSSL were valid*

*Reports meeting the bar beside reports reviewed. Anthropic sampled 97 high-severity OSS Scanner reports against its disclosure criteria; early user wolfSSL judged 74 and found 72 valid, five of which became CVEs. Units are reports. Sources: Anthropic, October 8, 2026; Semicolon (note.com), October 11, 2026. [4][5]*

## The bill lands on Bank of America

Scale is the argument. Glasswing partners verified at least 129,000 vulnerabilities between April and July 2026; Anthropic's own scanning added 5,500 through October, and more than 33,000 of the total were rated critical or high, a tally Anthropic calls a floor drawn from partial survey data [3].

*Chart: **Anthropic's partners verified 129,000 bugs; 360's swarm claims 3,432** Bar chart of vulnerability counts: Glasswing partners 129,000, Anthropic's own scanning 5,500, Tulongfeng claimed 3,432*

*Counts of software vulnerabilities found. Glasswing partner finds verified April to July 2026; Anthropic's own open-source scanning April to October 2026; the Tulongfeng figure is 360's unaudited claim at its June launch. Sources: Anthropic, October 6, 2026; SDxCentral, June 29, 2026. [3][2]*

Fixing is the bottleneck: months often pass between a finding and a patch [4]. [Bank of America](https://theinference.org/markets/companies/bank-of-america) [hired about 1,000 contractors in the second quarter](https://techstory.in/bank-of-america-hires-1000-contractors-to-patch-software-flaws-exposed-by-anthropics-mythos/) to join roughly 3,000 employees remediating flaws found by AI tools including Mythos, and put combined remediation and anti-money-laundering spend at several hundred million dollars in the third quarter [6].

## The wall protects the market and erodes the pitch

The bull case survives. Chinese customers still cannot buy Mythos, so the export wall Zhou denounces also fences in his market, and in September the Pwnie Awards gave 360 and Tsinghua University's Institute for Network Sciences and Cyberspace a Most Innovative Research Award [7].

But the wall protects the market and erodes the pitch at the same time. Free scanning outside China removes the scarcity the deterrence story needs, and Nano Work, 360's agent platform launched August 3 with 100 million free tokens for 1,000 small businesses, fights the same price war at home [8].

## The Q3 report decides it

Between July 15 and October 14, controlling shareholder Tianjin Qixin Zhicheng sold 56.04 million shares, 0.8 percent of the company, executing its plan to within 91 shares of the cap and leaving 46.3 percent, [as disclosed on October 16](https://6ix.com/news/601360360-security-technology-incannouncement-on-expiration-of-shareholding-reduction-plan-of-controlling-shareholder-and-results-of-shareholding-reduction) [9][10]. The next reading is 360's third-quarter report: whether Tulongfeng, Yitianzhen or Nano Work appear in it as revenue, after a quarter when the story lived mostly on a conference stage [9][10].

## Takeaway

Anthropic's October giveaway makes the bug hunting Qihoo 360 called a "cyber nuclear weapon" free outside China, and 360's Q3 report must now show Tulongfeng and Nano Work as revenue.

## Sources

1. [The Register, "Chinese cybersecurity company claims it's built a better-than-Mythos bug finder", 26 June 2026](https://www.theregister.com/security/2026/06/26/chinese-cybersecurity-company-claims-its-built-a-better-than-mythos-bug-finder/5262642)
2. [SDxCentral, "'Chinese Mythos' adds further fuel to sovereignty debate in AI security", 29 June 2026](https://www.sdxcentral.com/news/chinese-mythos-adds-further-fuel-to-sovereignty-debate-in-ai-security/)
3. [Anthropic, "Expanding the Cyber Verification Program", 6 October 2026](https://www.anthropic.com/news/cyber-verification-program)
4. [Anthropic, "Introducing the Anthropic Cyber Mission", 8 October 2026](https://www.anthropic.com/news/anthropic-cyber-mission)
5. [せみころん (Semicolon), "What is Anthropic aiming for?", note.com, 11 October 2026](https://note.com/semicolonn/n/n7c1a485b5de4)
6. [TechStory, "Bank of America Hires 1,000 Contractors to Patch Software Flaws Exposed by Anthropic's Mythos", 15 October 2026](https://techstory.in/bank-of-america-hires-1000-contractors-to-patch-software-flaws-exposed-by-anthropics-mythos/)
7. [Futu News, "Joint research by 360 and Tsinghua INSC receives Most Innovative Research Award at The Pwnie Awards", 29 September 2026](https://news.futunn.com/en/post/1000336693/joint-research-findings-by-360-and-the-institute-for-network)
8. [Startup.ph, "360's Zhou Hongyi Called a Rival AI Model 'A Cyber Nuclear Weapon.' Weeks Later He Gave Away 100 Million Tokens", 7 October 2026](https://www.startup.ph/360s-zhou-hongyi-called-a-rival-ai-model-a-cyber-nuclear-weapon-weeks-later-he-gave-away-100-million-tokens-to-prove-his-own-ai-works/)
9. [Longbridge, "360 Security Technology: Tianjin Qixin Zhicheng reduces shareholding by 56.0358 million shares", 17 October 2026](https://longbridge.com/en/news/301967607)
10. [6ix / Shanghai Stock Exchange filing, "360 Security Technology: Announcement on Expiration of Shareholding Reduction Plan of Controlling Shareholder", 16 October 2026](https://6ix.com/news/601360360-security-technology-incannouncement-on-expiration-of-shareholding-reduction-plan-of-controlling-shareholder-and-results-of-shareholding-reduction)


---

Anthropic gives away the bug scanner Qihoo 360 called a 'cyber nuclear weapon' — The Inference. Canonical: https://theinference.org/article/anthropic-gives-away-the-bug-scanner-qihoo-360-called-a-cyber-nuclear-weapon