WHY THIS MATTERS IN BRIEF
State-aligned firms turning AI into a vulnerability-finding engine could shift the offence-defence balance in global cyber security.
Matthew Griffin is the World’s #1 Futurist Keynote Speaker and Global Advisor for the G7 and Fortune 500, specialising in exponential disruption across 100 countries. Book a Keynote or Advisory Session — Join 1M+ followers on YouTube and explore his 15-book Codex of the Future series.
A large Chinese cyber security firm is using Artificial Intelligence (AI) to identify security vulnerabilities in widely used software applications, positioning itself as a competitor to Anthropic and their new Claude Mythos platform, according to a new report.
The company, 360 Digital Security Group, has in recent months said it has developed an AI-powered “Vulnerability Discovery Agent” that has uncovered close to 1,000 previously unknown vulnerabilities, including in Microsoft Office and in OpenClaw, an open-source framework for building and deploying AI agent workflows, according to published Wednesday by , a research group focused on Chinese cybersecurity.
Representatives for 360 did not immediately respond to requests for comment.
Earlier this year, Beijing-based 360 said it had developed AI tools that speed the identification of flaws and the construction of so-called exploit chains. which are required to hack into targeted computers, according to the report.
The effort resembles the new AI model from Anthropic, Mythos, which the company says can autonomously uncover and exploit software flaws in popular technologies. The model is so powerful, according to Anthropic, that the company has only released it to a select group of organisations, encouraging them to use it to find and plug their holes before attackers do. The US government is also moving to make some version of Mythos available to federal agencies.
China’s 360 said that its use of AI had evolved “from an auxiliary tool to the core engine of vulnerability discovery,” according to the report, which reviewed a series of recent Chinese-language announcements from the organisation.
Eugenio Benincasa, the author of the report and a senior researcher at ETH Zurich’s Center for Security Studies, said that 360 appears to be positioning itself as a direct competitor to Anthropic’s Mythos.
Even if some of the company’s claims are overstated, he said, the developments point to the maturation of underlying capabilities.
“AI is moving from an auxiliary tool to something closer to a scalable engine for vulnerability research, and firms like 360 are well positioned to push that forward in China,” he said.
Benincasa said China poses a particular threat due to its government’s control over the cyber security industry and legal requirements that force cyber security researchers to disclose any software vulnerabilities they find to security agencies, which can use them to enable cyber intrusions.
The Chinese government’s wide-reaching domestic authority may give its AI capabilities “greater operational impact,” Benincasa said. “Closer integration between private firms and state actors mean that improvements in discovery can translate more directly into offensive use.”
Why does China's 360 using AI to find software flaws matter?
Because the same capability that lets defenders patch holes first also lets state actors stockpile them. With Chinese law requiring researchers to report vulnerabilities to the government, faster AI discovery could translate more directly into offensive operations, raising the stakes of an emerging US-China cyber capability race.
