99.4% Takes the Global Top Spot! This Chinese AI Was Trained by World Champions

Yishui, reporting from Aofei Temple
QbitAI | Official WeChat Account QbitAI

99.4%, No. 1 in the world.

Wow—who would have thought that the Silicon Valley firms always basking in the spotlight and expounding on AI security would...?

Now, the one breaking the AI security world record is a Chinese AI system.

On the CyberGym leaderboard, dubbed the "AI Security World Cup,"360's in-house AI security offense-and-defense system Tulongfeng claimed the top spot with a 99.4% vulnerability reproduction success rate, setting the highest record on the leaderboard.

△Image source: CyberGym project homepage (partial screenshot)

Competing against Tulongfeng on the same leaderboard were OpenAI's GPT-5.5-Cyber, Anthropic's Claude Mythos Preview, and Google's Gemini 3.8 Flash Cyber.

Every contestant had cybersecurity capabilities specifically enhanced for the competition.

Quite the lineup, actually...

And this No. 1 spot genuinely wasn't something you could claim just by skimming some code and circling a few suspicious locations.

1,507 real-world vulnerability tasks and three consecutive rounds of independent evaluation, the AI had to pinpoint relevant locations in vast codebases, construct a PoC (proof of concept), and then actually reproduce the vulnerability before its answer counted as correct.

When CyberGym was first released, the world's best-performing combination, "OpenHands + Claude 3.7 Sonnet," had a success rate of only 11.9%.

Now, Tulongfeng has blasted straight to 99.4%, a score close to full marks.

That's a bit out of this world.

How on earth did 360 train an AI into the world's No. 1 vulnerability-hunting expert??

Tracing back through the history, all we can say is that the ultimate answer was both unexpected and entirely logical—

Right, people, as ever, remain the most critical variable.

Behind the world's No. 1 AI is a group of world champions

Tulongfeng's story happens to confirm that the old Chinese saying "Great teachers produce great students" still holds in the AI era.

Back in 2017, in Vancouver, at the Pwn2Own World Hacking Championship.

Known as the "Hacker World Cup," the competition had simple, brutal rules:

Teams had to hack real products within the allotted time and complete the exploit and verification on the spot.

If the program wasn't genuinely hacked, nothing else counted.

On the final day of the competition, the 360 security team unveiled an attack chain spanning Microsoft Edge, the Windows kernel, and VMware Workstation.

They set out to challenge three consecutive lines of defense:

First compromise the browser, then penetrate the operating system kernel, and finally force an escape from the virtual machine straight to the host machine.

The three stages were closely linked; if they stumbled at any point, the entire attack chain could come to nothing.

But once the live demonstration began, it took only 90 seconds to complete the entire attack chain.

Yes, 90 seconds, as if no one stood in their way.

Yet all the audience saw were those 90 seconds. The truly difficult work had begun long before the team took the stage.

The researchers had to find a way into an unfamiliar system, then string several vulnerabilities together into a complete path. How many trial-and-error attempts it took along the way was beyond the outside world's knowledge.

The 90 seconds onstage were merely the final correct path remaining after repeated judgment.

Ultimately, after three days of competition, 360 topped the leaderboard with 63 points and took home the event's highest honor, the Master of Pwn (World Exploitation Master).

△Image source: Pwn2Own official website

360 had showcased similar capabilities more than once before.

In 2020, 360 Alpha Lab security researcher Gong Guang presented an exploit chain named “Tiyunzong.”

The name had a distinctly wuxia flavor, and its real-world impact was every bit as fierce.

Attackers could remotely penetrate multiple layers of defense in the Chrome browser and Android, ultimately gaining control of the device.

Thanks to this research, Gong Guang won the Pwnie Awards' “Epic Achievement Award,” hailed as the “Oscars” of the security world, becoming the first Chinese security researcher to receive the honor.

△Image source: 360 official website

At this point, things began to get interesting.

Pwn2Own and “Tiyunzong” targeted different software, and their technical details were completely different.

But their core logic was the same:

Where there was no standard answer, find a workable path on your own.

Clearly, this kind of ability cannot be developed by memorizing answers from a question bank.

What does it take? Of course, real, hands-on work.

And what 360 has in abundance is precisely real-world experience.

According to 360, its security team has cumulatively discovered and helped fix CVE vulnerabilities in products from Microsoft, Google, Apple, Huawei, Qualcomm, and other vendors (that is, publicly disclosed vulnerabilities with internationally standardized identification numbers), totaling more than 3,000.

What does more than 3,000 real-world vulnerabilities amount to?

It means these people have long worked with unfamiliar code, complex systems, and problems with no ready-made answers.

Today they may tackle a browser; tomorrow it may be an operating system, a chip, or enterprise software. When the project changes, the previous solution may no longer work, and they have to start finding a new one.

After years of honing this skill, knowing which leads were worth pursuing and when to change direction gradually became a form of judgment.

That is what truly makes 360 difficult to replicate.

Top security experts are scarce in the first place. Even scarcer is a team that can keep a group of top experts tackling thousands of real-world vulnerabilities for more than twenty years, turning each cycle of trial and error into accumulated experience..

But the problem came with it: no matter how skilled an expert is, there are only 24 hours in a day.

Faced with massive amounts of code and new software constantly popping up, relying on people alone to read through it line by line will eventually be too much to handle.

So a very natural, yet also very bold idea emerged:

Can we let AI learn these experts' "judgment" as well?

And that is the true starting point of the Tulongfeng story.

Teaching a world champion's craft to AI, the hardest part is not feeding it the answers

The first reaction to teaching a world champion's skills to AI would of course be to feed it data.

Public CVEs, the NVD, plus vulnerability reports scattered across the internet—already a considerable number.

But after going through them, I quickly discovered an interesting problem:

These public datasets often tell you only what a vulnerability is, but make it hard to reconstruct how the masters actually found it.

Results, but no process—who wouldn't find that headache-inducing?

It's like hallucinating copying my winter vacation homework back in elementary school.

Turn to the reference answers and everything is spelled out clearly, yet the most crucial derivation process is just one word:omitted.

Yet for vulnerability hunting, the most valuable experience is precisely hidden inside that "omitted."

This is when 360's more than twenty years of accumulated experience came into play.

Having long stood on the front lines of security offense and defense, 360 has amassed a large number of real-world security samples in malware detection and removal, attack response, and vulnerability research.

More importantly, how its security researchers analyze things in real engagements, how they invoke tools, and how they adjust their approach after trial and error have gradually been distilled into process data and expert experience.

"Real samples + real experience"—put these two kinds of data together, and their weight is entirely different.

According to the technical roadmap 360 has disclosed, this content is used to train the security-domain large model behind Tulongfeng.

Voila—the world champion's secret "signature techniques" have thus entered the AI's brain.

However, for the model to learn how to make judgments, it still needs one more step: actually "getting its hands dirty."

I originally thought it would be enough to connect the model to a codebase and security tools, then wrap it in a layer of Agent.

That's also a very common approach in the industry.

But vulnerability hunting is a bit special.

Faced with millions of lines of unfamiliar code, the hardest part is often deciding where to start.

If the underlying model doesn't understand security, no matter how hard the Agent works, it may charge headlong down the wrong path...

This also explains why Tulongfeng advances two technical routes at the same time:

a security-domain large model + a swarm of specialized intelligent agents.

The finer engineering details have not been fully laid out in the public materials.

After all, it's a commercial product, so let's follow the diagram on the official website and look at its most core design thinking.

The security-domain large model is responsible for finding the direction.

First, 360 uses the security data and expert experience accumulated over many years to train a specialized model that understands security.

Then, through "reverse teaching," it has this security expert teach its skills to a general-purpose model.

Thus, the general-purpose model that could previously read any code gained another pair of eyes for discovering security issues, upgrading into a “large language model specializing in cybersecurity.”

With the brain in place, the swarm of specialized agents immediately got to work.

360 broke down the process and tools experts use to uncover vulnerabilities and assigned them to different agents to work in parallel, handling everything from analyzing code and invoking tools to generating PoCs and verifying vulnerabilities from start to finish.

Whenever a problem arose, the results were fed back, allowing the system to adjust its approach and try again.

At this point, the “process” omitted in the earlier reference answer had finally been pieced back together bit by bit.

The database provided vulnerabilities that had already occurred, process data taught the AI how to make judgments and correct errors, and the agents turned those judgments into concrete actions.

Only when all these pieces came together did Tulongfeng begin to acquire the world champion’s ability to “know how to proceed even when faced with an unknown problem.”

But the story doesn’t end here.

Tulongfeng did not merely learn the experts’ skills; it also began learning how to grow stronger from its own mistakes.

A technical report recently disclosed by 360 documented an instance of self-evolution.

The incident occurred during a routine vulnerability test.

At the time, the validation environment Tulongfeng had built for itself simply would not run. After struggling with it for a while without success, it went online in search of a solution and actually found an address labeled “test environment” in a technical blog post.

Great—here was a ready-made test environment!

Just as it was about to use the address to validate the vulnerability, the request was intercepted by an isolated sandbox before it could even be sent.

What was the problem?

The blog post said “test environment,” but it never said you had permission to use it for vulnerability testing.

Interestingly, Tulongfeng’s automatic post-event review also identified the problem.

So it added a new rule for itself:

From now on, only test addresses explicitly designated by the task may be used.

After several rounds of review and verification, the new rule officially took effect.

From the initial alert to the new rule taking effect in a controlled environment, the entire process required no human intervention.

Now, the AI could not only find vulnerabilities; it could also turn a mistake into a new capability useful for the next task.

Let’s summarize Tulongfeng’s technical approach:

First, teach the AI how security experts make judgments, then have the agents put those methods into action, and, when confronted with new problems, continue accumulating experience through trial and error.

In the past, a world champion’s skills resided in an expert’s mind. Now, those experiences are beginning to become an AI system capable of repeated execution and continuous updating.

As the saying goes, “A great teacher produces a great disciple.” And that was exactly what happened.

The AI has graduated, and quickly achieved major results in the “AI Security World Cup”

Tulongfeng soon faced its first major challenge—CyberGym.

CyberGym was developed by a team from the University of California, Berkeley, and its paper was accepted by the top-tier conference ICLR 2026.

Its 1,507 questions were all drawn from historical vulnerabilities in 188 real-world open-source projects, including OpenSSL, FFmpeg, nginx, and cURL, making it 7.5 times the size of comparable previous benchmarks.

For most of the things running on your phone, server, or router, you can find counterparts among these projects.

The tasks are sufficiently realistic and the scale sufficiently large; CyberGym has therefore become an open arena for testing the cybersecurity capabilities of frontier models.

In the AI security field, this is virtually on the scale of a World Cup.

Right out of the gate, Tulongfeng not only set a new leaderboard record but also delivered rock-solid consistency.

Across three independent evaluations, the success rates were 99.27%, 99.47%, and 99.40% (averaging 99.38%, which rounds to the 99.4% mentioned throughout the article).

Every agent execution involves some randomness. An occasional high score can be attributed to luck, but if it happens every time, there are only two words to explain it:

Real strength.

Tulongfeng has already mastered a suite of vulnerability-discovery capabilities that can be consistently replicated.

Talk is cheap.

The following figures make the point clearly—

Since its launch in June this year, Tulongfeng has discovered more than 15,000 vulnerabilities in total, and more than 500 companies have integrated it to conduct specialized security testing.

Among the vulnerabilities it uncovered, some had remained hidden in Windows for as long as five years, while others had lurked in Office for eight years; Microsoft has also officially acknowledged the related findings.

△Image source: 360’s official website (screenshot of an acknowledgment from the Microsoft Security Response Center)

That’s not all.

In October 2026, the China Academy of Information and Communications Technology (CAICT) announced the first batch of results for the “Vulnerability Mining Agent Capability Assessment.”

Tulongfeng cleared all 12 capability requirements across four dimensions in a single sweep, becomingthe only product in Chinato pass the assessment.

With success both at home and abroad, 360 Tulongfeng has really landed a major win (doge).

Speaking of 360, many people’s first thought may still be of the familiar antivirus icon that used to sit in the bottom-right corner of their computers.

But in the AI security field, 360 actually has an even more formidable role.

According to 360, it is currently a core technical support organization for the CNNVD National Information Security Vulnerability Database, and the cumulative number of vulnerabilities it has reported to the relevant regulatory authorities has reachedthe million mark.

What’s more interesting is that, long before the large-model boom, 360 was already exploring how to enable machines to find vulnerabilities on their own.

In 2018, an article introducing 360’s cybersecurity practices on the official website of the Cyberspace Administration of China mentioned that 360 had already developed an automated vulnerability-mining system.

Now, looking at Tulongfeng, its development can indeed be traced.

From the world champions taking the field personally back then to the “AI apprentice” topping the global leaderboard today, the method of finding vulnerabilities has changed, but what has always underpinned it is the hard-earned expertise amassed by those security experts over more than two decades.

The arrival of AI has finally given these skills, once possessed by only a handful of people, an opportunity to be replicated on a large scale.

So, looking back at the 99.4% at the outset, it seems less surprising after all.

Nine years ago, it was 360’s security researchers who stood on the world championship podium.

Nine years later, it is the AI they trained that tops the global leaderboard.

There’s a clear trail behind it all.