Chinese Cybersecurity Company Accused of AI Hacking Similarities to Claude Mythos

Post Views: 8

China’s Cybersecurity Firm Claims AI-Driven Vulnerability Discovery Capabilities

In recent weeks, 360 Digital Security Group, a leading Chinese cybersecurity firm, has made headlines with its claim that its internally developed Multi-Agent Collaborative Vulnerability Discovery System has achieved remarkable success in identifying vulnerabilities.

System Success in Identifying Vulnerabilities

The system reportedly contributed to nearly half of the vulnerabilities discovered during the Tianfu Cup, a major Chinese hacking competition, and found close to 1,000 vulnerabilities in total, including over 50 high-severity flaws affecting various software and hardware products.
The firm cited CVE-2026-32190, a critical Office vulnerability that their AI agent allegedly identified within minutes, despite having gone undetected for approximately eight years.
The firm also claimed to have identified a Windows kernel vulnerability (CVE-2026-24293), although Microsoft credits researchers from Taiwan and South Korea with this discovery, casting doubt on 360’s claims.

Eugenio Benincasa, an ETH Zurich cybersecurity researcher specializing in China, has analyzed these claims, suggesting that while 360’s AI capabilities appear impressive, they do not yet match the reasoning capabilities attributed to Claude Mythos. Instead, he draws comparisons to Google’s Big Sleep, which accelerates specific stages of vulnerability research rather than functioning as a fully autonomous agent.

Chinese Legislation Advantage

Benincasa highlights a crucial aspect that may ultimately prove more significant than technical comparisons. Chinese legislation requires private companies and researchers to report vulnerabilities to government agencies before disclosing them publicly, effectively funneling top-tier security research into state intelligence channels.

This places China at an advantage compared to the United States, Europe, and other democratic nations, where such requirements can hinder the disclosure process.

Claude Mythos Model Performance

Anthropic’s Claude Mythos model has autonomously discovered thousands of vulnerabilities.
The company’s CEO has suggested that open-source models and Chinese developers could replicate Mythos-level performance within six to twelve months, a viewpoint shared by researchers at cloud security firm Wiz.

Related Developments

Mozilla has reported that Claude Mythos helped identify over 270 Firefox vulnerabilities.
Palo Alto Networks experienced a significant increase in vulnerability discovery.
Only a handful of public CVEs have been attributed to Anthropic, with only one specifically credited to Glasswing.