360's Tulongfeng tops CyberGym with 99.4% vulnerability reproduction rate across 1,507 tasks

360's in-house AI security attack-and-defense system, Tulongfeng (图龙锋), reached a 99.4% vulnerability reproduction success rate on the CyberGym leaderboard, the highest record on that list, according to a report by Chinese-language outlet QbitAI (量子位) published 2026-11-06. The article is in Chinese; this summary translates its claims.

The result

CyberGym was developed by a team at the University of California, Berkeley, and its paper has been accepted at ICLR 2026. It contains 1,507 tasks drawn from historical vulnerabilities in 188 real open-source projects, including OpenSSL, FFmpeg, nginx and cURL. QbitAI says that is 7.5 times the scale of earlier comparable benchmarks.

To score a task, the AI must locate the relevant code in a large codebase, build a PoC (proof of concept) and actually reproduce the vulnerability.

Tulongfeng was evaluated in three independent rounds:

• Round 1: 99.27%
• Round 2: 99.47%
• Round 3: 99.40%

QbitAI gives the average as 99.38%, rounded to the headline 99.4%. For reference, QbitAI says that when CyberGym launched, the best global combination, OpenHands with Claude 3.7 Sonnet, reached 11.9%.

The same leaderboard lists OpenAI's GPT-5.5-Cyber, Anthropic's Claude Mythos Preview and Google's Gemini 3.8 Flash Cyber. QbitAI describes all three as models specifically strengthened for cybersecurity. The scores for those entries are not given in the article.

How 360 says it built the system

According to 360's disclosed technical route, Tulongfeng combines two tracks: a security-domain large model and a swarm of specialized agents.

• Training data: 360 says it used real-world security samples from malware detection, incident handling and vulnerability research, plus process data and expert experience from its researchers (how they analyze, call tools and change direction after failed attempts).
• Model: a security-specialist model is trained first. Through what 360 calls "reverse teaching," it then transfers that knowledge to a general-purpose model, producing the security-domain large model.
• Agents: 360 splits its experts' vulnerability-hunting workflow into separate agents covering code analysis, tool calls, PoC generation and verification. Results feed back to the system, which adjusts and retries.

QbitAI notes that finer engineering details are not fully public.

Self-evolution incident

A recent 360 technical report describes one event during a routine vulnerability test. Tulongfeng's self-built verification environment would not run, so it searched online and found an address labeled "test environment" in a technical blog. An isolated sandbox blocked the request before it was sent. After the event, the system reviewed the case and wrote itself a rule: use only test addresses explicitly specified by the task. According to 360, the rule took effect in a controlled environment after multiple rounds of review and verification, with no human intervention.

Other figures from 360

• Since its release in June, Tulongfeng has found more than 1.5万 (1.5 wan) vulnerabilities, and more than 500 enterprises have connected to run dedicated security tests.
• Some of its findings sat in Windows for 5 years and in Office for 8 years, and Microsoft's official acknowledgment was received, per 360.
• In October 2026, China Academy of Information and Communications Technology (CAICT) published its first "vulnerability-discovery agent capability assessment" results. QbitAI reports Tulongfeng passed all 12 capability requirements across four dimensions and was the only product in China to pass.
• 360 says its security team has found and helped fix more than 3,000 CVEs at vendors including Microsoft, Google, Apple, Huawei and Qualcomm.
• QbitAI recounts 360's 2017 Pwn2Own win (63 points, Master of Pwn, an attack chain run in 90 seconds) as background on the team.

What this means

The CyberGym result rests on three independent evaluation rounds that landed within a narrow band (99.27% to 99.47%), which QbitAI reads as stable, repeatable capability rather than a lucky run. The benchmark uses historical vulnerabilities from real projects, so the score measures reproduction of known issues, not discovery of new ones. The separate claims of newly found Windows and Office vulnerabilities come from 360 itself.

The design 360 describes puts domain-specific process data ahead of agent scaffolding: QbitAI quotes the reasoning that an agent built on a model that does not understand security can run fast in the wrong direction. Whether that approach generalizes beyond 360's proprietary data is not addressed in the article, and the leaderboard scores of the competing cyber-tuned models are not reported there.