About Orithos · Built by Antanox
We got tired of watching security teams discover AI vulnerabilities the wrong way.
Orithos is built by security engineers who have been on both sides of an AI security incident — the side that finds the vulnerability during a scan, and the side that finds it during a breach. We built the scanner we needed when we were doing the scanning.
Built by
Antanox
Orithos is a product of Antanox
Our principles
Three things we refuse
to compromise on.
Security tooling earns trust through what it won't do as much as what it will. These are the design constraints we've built Orithos around.
🔍
Agent-aware, not generic
Every scan includes probes generated from your specific system prompt, tool manifest, and RAG configuration — on top of a 124-probe catalog mapped to OWASP, MITRE ATLAS, NIST AI RMF, and EU AI Act controls. A scanner that sends the same payloads to every agent is a marketing product. Orithos is a security product.
⚖️
CRITICAL findings earn their severity
A CRITICAL finding that turns out to be a false positive destroys trust. Our 3-tier judge pipeline exists for one reason: holding CRITICAL findings to a near-zero false-positive target (<3% across all scans), with every verdict carrying its evidence and confidence so your team can verify it.
📖
Open probe catalog
Security teams should understand what probes are being run against their agents, challenge the methodology, and contribute improvements. Our full attack catalog is published openly on GitHub under the MIT license — we show our work.
Methodology
How we designed
the scan engine.
The scan architecture is documented and the probe catalog is public. These are the design decisions that distinguish Orithos from generic LLM security tools.
01
Probes generated from agent configuration — not templates
Your system prompt contains identifiers, constraints, and tool references that an attacker who extracts it will use in follow-on attacks. We extract those rules first, then generate probes that test them — alongside tool blast-radius and RAG injection probes built from your agent's own configuration.
02
Session-isolated probe execution
Every probe runs in a clean session context — its own session ID, its own client, its own memory identity. Multi-turn attacks depend on session state; cross-probe contamination would produce false positives. Each probe is an independent interaction with your agent.
03
3-tier cascading judge pipeline
Tier 1 is a fast classifier that clears unambiguous refusals. Tier 2 runs a full AEGIS-J evaluation — and high-severity probes skip Tier 1 entirely. Tier 3 is the authoritative verdict: any low-confidence or flagged result escalates to it. Temperature 0 throughout. The pipeline is engineered to keep false positives out of CRITICAL findings.
04
Independent per-probe evaluation
Every probe response is evaluated on its own merits by the cascade — never batched into a shared context where one finding can colour another. Findings are assembled into the unified report with per-probe evidence, severity, and confidence attached, so every verdict traces back to a specific interaction.
05
Execution counts, stated honestly — not inflated
256 probe definitions: 124 catalog probes carrying ~7 pre-baked prompt variants each (892 executions) plus 132 behavioral probes run once (incl. 8 German/French variants, marked unreviewed in-catalog). File-level floor ≈1,024 executions per full deep scan; production databases carry larger pre-baked batteries, and the staging-measured deep average is 41,121 executions (≈820 credits at $0.02 each). The formula is single-sourced in code so billing can never drift from it. Findings carry OWASP Agentic (ASI01–ASI10) mappings alongside the other framework controls. New languages ship only after ASR-vs-baseline judge validation.
124
attack probes across 25 categories, each mapped to OWASP, MITRE ATLAS, NIST AI RMF, and EU AI Act controls
3
judge tiers — high-severity probes skip the fast tier, uncertain verdicts escalate to the authoritative tier
<3%
CRITICAL false positive rate target across all scans
0
sessions shared between probe executions — full isolation
73%
of agents in our internal red-team evaluation (126 scans across 6 demo agent personas) surfaced at least one CRITICAL finding — see the full report for methodology and limitations
Open probe catalog
The attack library
is public. Here's why.
Security through obscurity is not a security model. Our full probe catalog — every payload class, severity, and compliance mapping — is published openly on GitHub under the MIT license, so the security community can audit the methodology, challenge probe design, and verify findings. The catalog is version-controlled and every release is tagged.
Orithos Attack Catalog
25 categories · 124 probes
Published openly. Version controlled. Community contributions accepted.
25
CATEGORIES
124
PROBES
v1.2.0
CURRENT VERSION
MIT
LICENSE
CAT-01Prompt Injection — Direct4 probes
CAT-02Prompt Injection — Indirect (Supply Chain)4 probes
CAT-03Jailbreaking — Persona & Roleplay4 probes
CAT-04Jailbreaking — Encoding & Obfuscation4 probes
CAT-05Jailbreaking — Hypothetical & Fictional Framing3 probes
CAT-06Jailbreaking — Multi-Turn Chained Escalation3 probes
CAT-07System Prompt & Configuration Leakage4 probes
CAT-08PII & Training Data Extraction3 probes
CAT-09Credential & Secret Harvesting3 probes
CAT-10Agentic Tool Abuse5 probes
CAT-11Privilege Escalation & Goal Hijacking3 probes
CAT-12Unauthorized Data Exfiltration2 probes
CAT-13Harmful Content — CBRN Facilitation4 probes
CAT-14Harmful Content — Violence & Self-Harm3 probes
CAT-15Harmful Content — Hate Speech & Discrimination2 probes
CAT-16Harmful Content — Disinformation & Synthetic Media3 probes
CAT-17Model Identity & Transparency Violations3 probes
CAT-18Compliance — Financial Advice Guardrails2 probes
CAT-19Compliance — Medical & Health Advice Guardrails2 probes
CAT-20Compliance — Legal Advice Guardrails1 probe
CAT-21Compliance — GDPR & Privacy Policy2 probes
CAT-22Bias, Fairness & Discrimination2 probes
CAT-23Adversarial Robustness & Filter Evasion4 probes
CAT-24Agentic — RAG & Memory Poisoning3 probes
CAT-25Resource Exhaustion & Denial of Service3 probes
Community & standards
Frameworks we build against
and map findings to.
Credibility in security is earned through verifiable mappings, not name-dropping. Every framework below is backed by seeded control data your auditors can inspect.
| Framework / Community | Our role | How Orithos uses it | Status |
|---|---|---|---|
OWASP LLM Top 10 2025 edition | Every catalog probe carries an OWASP LLM mapping; we track the 2026 edition as it develops. | Every finding mapped to the specific OWASP LLM control it violates. Included in all compliance exports. | Mapped |
OWASP Agentic Top 10 ASI01–ASI10 · Dec 2025 | Catalog probes carry OWASP Agentic mappings — goal hijack, tool misuse, privilege abuse, supply chain, memory poisoning, inter-agent, rogue agents. | Agentic control mapping included in all compliance exports and sealed evidence packages. | Mapped |
NIST AI RMF AI RMF 1.0 | Probe catalog mapped to GOVERN, MAP, MEASURE, and MANAGE functions. | NIST AI RMF control mapping included in all compliance exports. | Fully mapped |
EU AI Act Regulation (EU) 2024/1689 | Probes and findings mapped to risk-management, logging, robustness, and adversarial-testing obligations (Articles 9, 12, 15, 55). | Sealed evidence packages with per-artifact SHA-256 hashes and a Merkle root, exportable for conformity conversations with your notified body or auditor. | Mapped |
MITRE ATLAS AI Threat Landscape | Catalog probes carry MITRE ATLAS technique references (AML TTPs). | Findings include ATLAS technique identifiers for threat intelligence integration. | Mapped |
ISO/IEC 42001 AI Management System | Probes carry ISO/IEC 42001 references in their compliance tags; formal Annex A control-mapping coverage is on our roadmap. | 42001-tagged findings appear in compliance exports today; full Annex A coverage planned. | Planned |
SOC 2 / ISO 27001 / HIPAA / GDPR Audit frameworks | Findings map to SOC 2 Trust Services Criteria, ISO 27001, HIPAA Security Rule, and GDPR controls. | Included in compliance exports and sealed evidence packages for auditor consumption. | Fully mapped |
Our commitments
What we commit to
every customer.
Security companies earn trust differently. These are the commitments we make — in writing, not in marketing copy.
🔓
Your agent config is yours
Your system prompt, tool schemas, and RAG source configurations are encrypted per-organisation and never used to train our models. Scan data is purged on a per-plan retention schedule — 14 days on Free, 90 days on Starter, 365 days on Team and above.
Read the Data Processing Agreement →📋
Probe catalog is published openly
The attack probes we run against your agents are published on GitHub under the MIT license — all 124 payloads across 25 categories, version-controlled and tagged. Any security engineer can review them, challenge them, or propose additions.
View on GitHub →✓
Every CRITICAL carries its evidence
Every CRITICAL finding ships with the exact probe, the agent's response, the judge pipeline's verdict, and a confidence score — so your team can reproduce and verify it, not take our word for it. Manual security-team review of CRITICALs is on our early-access roadmap.
See our judge pipeline methodology →📊
We publish our own scan statistics
The statistics on our homepage come from our internal red-team evaluation — 126 scans across 6 demo agent personas — with every number, failed scan, and methodology disclosed. No synthetic benchmarks, no cherry-picking.
Read the red-team report →About Orithos · Early access
Scan your agents before a regulator — or an attacker — does it for you.
Early access spots remain. Security teams that establish their AI agent scanning programme now set the baseline before enforcement begins.
📋
Probe catalog published openly
All 124 attack probes across 25 categories — MIT licensed on GitHub. Review exactly what runs against your agents.
⚖️
CRITICAL findings earn their severity
Three-tier judge pipeline with evidence and confidence on every finding, targeting a sub-3% CRITICAL false-positive rate.
📊
Audit-ready evidence packs
Every finding mapped to OWASP, MITRE ATLAS, NIST AI RMF, and EU AI Act controls — exportable for your legal team.
Request Early Access
Priority review for security teams and CISOs.