100x faster vulnerability finding: China’s defenders face ‘cyber nuclear gap’

For cybersecurity defenders, the speed at which vulnerabilities are found and patched is the entire game. When a tool autonomously accelerates that discovery a hundredfold and prices plummet, the attack surface expands beyond any human-staffed incident response team’s capacity. China’s exclusion from the early-adopter club of Mythos Preview means its critical networks are being scanned by an AI that Chinese defenders cannot even inspect, let alone counter. The strategic asymmetry is the stuff of red-team nightmares, and it demands an immediate, government-backed response from Beijing.

In a stark warning at a Beijing cybersecurity conference on June 24, 2026, 360 Security Technology founder Zhou Hongyi declared that China must urgently develop its own equivalent to Anthropic's Mythos AI model, describing the US technology as a 'cyber nuclear weapon' that threatens to tilt the balance of global cyber defenses irreversibly against nations excluded from it. Zhou's remarks mark the first public alert from a prominent Chinese tech leader about the strategic dangers posed by an American frontier AI model designed from the ground up to autonomously find and exploit software vulnerabilities at unprecedented speed and scale. Released in April 2026, Mythos reportedly accelerates vulnerability discovery a hundredfold while slashing associated costs, effectively 'democratising' offensive cyber capabilities and putting them within reach of a much wider range of actors. The entire cybersecurity industry now confronts a new era where attack surfaces can be mapped and breached orders of magnitude faster than human researchers or legacy tools could ever manage.

“

China’s exclusion from the early-adopter club of Mythos Preview means its critical networks are being scanned by an AI that Chinese defenders cannot even inspect, let alone counter.

Zhou specifically highlighted the US-orchestrated Project Glasswing alliance, through which Anthropic in April granted more than 40 organizations access to Mythos Preview to strengthen their cyber defenses, while conspicuously excluding any Chinese entity. This arrangement, Zhou argued, means that US and allied defenders can systematically scan Chinese digital infrastructure for zero-day vulnerabilities without Chinese counterparts ever getting the chance to examine the very engine performing those scans. For Zhou, that asymmetry is tantamount to a strategic nuclear imbalance — hence his call for a domestic equivalent to create a 'reciprocal strategic deterrence capability' modeled on mutually assured destruction logic. His framing was deliberately provocative, aiming to galvanize policymakers and industry into mobilizing the kind of resources China previously marshaled for its nuclear weapons and space programs. Behind the rhetoric lies a concrete fear: that Mythos-class models will shift the offense-defense balance so decisively that known vulnerabilities will proliferate faster than patches can be developed, tested, and deployed, leaving critical infrastructure permanently exposed.

The context of Zhou's warning is a fiercely intensifying US-China technology rivalry, now entering a phase where AI security tools are being weaponized as instruments of geostrategic advantage. Anthropic's own brief roll-out of its consumer-facing Claude Fable 5 model earlier this year — and its subsequent withdrawal after Washington ordered a block on foreign access — had already exposed the extent to which AI model distribution is becoming politicized. That episode fueled speculation that Chinese open-weight models, such as Zhipu AI's GLM-5.2, might close the gap, but Zhou's comments suggest a far more urgent and defense-focused ambition: not merely parity in general-purpose language models, but a dedicated, AI-powered vulnerability research engine that can operate at the scale of an entire nation's attack surface. For a country as digitally vast as China, with its massive state-owned enterprises, sprawling fintech ecosystem, and critical infrastructure networks, the absence of such a capability represents a potential systemic risk.