Ready for attacks that move at machine speed.
AI agents can now run an intrusion from the first scan to stolen data with almost no one at the keyboard. Anvil Point Security hardens the systems and software you depend on, and builds the detections that catch an agent at work.
Speed is the tell
A person testing stolen cloud keys tries a few things a minute. An agent tries dozens. These are three of the detection rules we wrote from the FBI's report on ARTEX. Set the pace and watch when each one fires.
One identity tries many different EC2 actions with DryRun on, to learn what a stolen key is allowed to do. The rule fires at 10 different actions in one minute.
Quiet
The demo needs JavaScript. Without it, the rule descriptions still tell you what each one catches.
The log lines are made up for this demo, with fake accounts and documentation IP ranges. The rules and thresholds are the ones we wrote and tested.
An attack that doesn't wait for a person
On November 13, 2026, the FBI published a FLASH on ARTEX, an open-source framework that hands a penetration test to AI agents. Attackers have used it since at least August 2026 against organizations in finance, government, healthcare, energy, and other sectors.
The FBI says some of those intrusions went from first targeting to privileged access in under three hours, and that the speed leaves defenders little time to respond. It also says the traffic is noisy enough to set off alerts.
Both points shape our work. Your systems have to hold up before anyone has time to step in, and your alerts have to be tuned to the noise an agent makes.
What we do
Readiness for AI-driven attacks
We read advisories like the FBI's ARTEX report against your environment and tell you where an agent would get in, what it could reach, and what to fix first. You get a short, ranked list of fixes.
Detection engineering
We turn attacker behavior into rules your tools can run. Sigma is the portable source, with versions for Microsoft Sentinel, Defender XDR, and Elastic. Each rule is tested against sample logs: it has to fire on the attack and stay quiet on normal activity.
Threat modeling and infrastructure hardening
We map what you run, who can reach it, and what a break-in would cost. Then we help close the gaps: exposed management interfaces, permissions that are too broad, missing network limits, and secrets kept in the wrong places.
AI-assisted vulnerability discovery, with patches
We use frontier AI models to find flaws in source code, inside isolated sandboxes that we validate first. A finding isn't done until it has a minimal fix and a test that fails before the fix and passes after. Then we report it privately to the people who maintain the code.
Open-source hardening
Most software rests on open-source projects with only a few maintainers. We send small security fixes upstream, following each project's own rules, so the fix reaches everyone who runs that code. If your stack depends on a project, we can review it and send fixes upstream.
Merged upstream
A look at a few of our security fixes in open-source projects. Every row links to the public record.
| Project | What changed | Record | Merged |
|---|---|---|---|
| Mealie | Reported privately: the Paprika import unzipped gzipped recipes with no size limit. The maintainer fixed it in 3.31.0 and published the advisory. | GHSA-g8p4-w9f8-6cc6 | Nov 2026 |
| Garry's Mod | Traitors can no longer use ttt_c4_disarm to disarm a living traitor's C4. |
PR #2566 | Nov 2026 |
| Garry's Mod | The ttt_mute_team command now ignores modes it doesn't know. |
PR #2565 | Nov 2026 |
| Garry's Mod | Spawning a vehicle now checks its AdminOnly setting. |
PR #2564 | Nov 2026 |
| UnPoller | The web server now masks the InfluxDB token and the OTel API key. | PR #1136 | Nov 2026 |
| UnPoller | Remote mode now verifies the api.ui.com certificate. | PR #1135 | Nov 2026 |
| Homarr | Failed logins now log the client's IP address. | PR #7242 | Oct 2026 |
| Microsoft APM | Package downloads over HTTPS can now trust a corporate CA bundle. | PR #2741 | Oct 2026 |
| Gotify | The server now limits the size of a request body. | PR #1073 | Oct 2026 |
How we use AI, and how we contain it
An AI model that can find a vulnerability can also do damage if it's left loose. Every model run that builds, tests, or probes code happens inside a sandbox built like this.
Sandbox VM
The agent and the code under test. No network adapter. Standard user.
Proxy on the host
Adds the credential, passes model API calls, and refuses and logs the rest.
Model API
The only destination.
Not reachable from the sandbox: the internet, the host's files, the clipboard, and the credential.
-
Isolate
The VM has no network adapter. Its only way out is one proxy on the host that forwards requests to the model's API and refuses everything else. Tools and dependencies go in before the run.
-
Keep the keys outside
The model credential lives on the host, and the proxy adds it on the way out. The agent runs as a standard user and can't change its own rules.
-
Validate before real work
We review the sandbox's configuration, then have the model try to escape while we watch. A change to the model, the proxy, or the VM means validating again.
-
Log every request
The host records each request the sandbox makes, with the full transcript, and keeps it at least 30 days. Any denied request gets a review.
-
Fix it, then report privately
Proofs run only in the sandbox against our own installs, never against anyone's live systems. Each confirmed finding gets a patch and a test, and the details go only to the maintainers until they publish.
About the firm
Anvil Point Security was founded in 2026. We're new and small, so in place of client logos we point to work you can check: every fix listed above is public.
We're built for small and mid-sized organizations, schools, and healthcare providers: places that carry real risk without a large security team.
Tell us what you run
Tell us what you run, what worries you, and when you need an answer. We'll tell you whether we can help and what a first step would look like.