ORA · LIVE TRENDS·Detection patterns refreshed daily from live vulnerability research·

When a process breaks character.

SPR{K3 Defend runs a local agent on the machine that actually runs pip, torch.load, and your agent runtime. It learns what each process is for — tokenizer, trainer, inferencer, agent, artifact — and flags sequences that don't fit that role: a tokenizer that egresses right after local init, an inferencer reaching for ~/.ssh, an artifact whose digest changes after promotion, a download that writes, goes quiet, then executes. Each event alone is ordinary. The order is the tell.

Same research as the public CVEs: 14 across NVIDIA's security bulletins.

Get Defend — freeHow Observe worksScan in VS Code →
Runs locally · no file contents · no packet bodies · process / path / destination metadata
sprk3 observe — local agent
$ sprk3 observe --status
# role-aware · metadata only · enforce: off

ROLE    tokenizer   proc 4471
FINDING egress to 185.x after local-init
  → role-inconsistent sequence
ROLE    inferencer proc 5120
FINDING read attempt on ~/.ssh/id_ed25519
  → role-inconsistent sequence
DRIFT    artifact digest changed after promote

✓ observe: reporting only — enforce off
✓ actions: controls.json (customer-defined)
$
PyTorch
TensorFlow
HuggingFace
NVIDIA TRT-LLM
LangChain
Semantic Kernel
ONNX Runtime
JAX
SageMaker
MLflow
ClearML
safetensors
NCCL / ProcessGroup
pickle / torch.load
AutoGluon
DLRover
Apple Notarized · 6JBK94Z45M
Public BetaApple-notarized · 6JBK94Z45MScans run locally
Part of SPR{K3 Defend · scan at rest

SPR{K3 Mini Ora for VS Code

Mini Ora is the at-rest scanner in the SPR{K3 Defend family — a lightweight scanner that works directly inside VS Code. It checks the code you are writing for high-risk patterns that can lead to code execution, credential exposure, unsafe model loading and compromised AI-development workflows — and shows each finding on the affected line, in the Problems panel, as a notification and in the SPR{K3 security view. A focused beta: six targeted detection classes for Python and configuration files, informed by SPR{K3 vulnerability research.

Source code never leaves your Mac.

What you see in VS Code
unsafe_deserialization.py — mo-fixture S SPR{K3 · FINDINGS HIGH MO-DESER-001 Unsafe deserialization unsafe_deserialization.py:7 safe_deserialization.py ✓ no findings engine Mini Ora 0.3.0 agent 127.0.0.1:7788 upload none 1importpickle 2importsys 4defload_untrusted(path): 5withopen(path,"rb")asfh: 6# data comes from the network 7returnpickle.loads(fh.read()) MO-DESER-001 · Unsafe deserialization Untrusted data reaches pickle.loads(), which can execute arbitrary code on load. CWE-502. Fix: use a schema-validated format (JSON / safetensors) for untrusted input. PROBLEMS 1 error · 0 warnings SPR{K3 Mini Ora · scan complete · 2 files · local only
How it runs on your Mac
YOUR MAC — EVERYTHING BELOW STAYS HERE VS Code extension sprk3-argus · findings view bearer token from ~/.sprk3 Mini Ora agent 127.0.0.1:7788 (loopback) signed · LaunchAgent Your project folder only the folder you authorize read macOS Keychain rule key · device key (ACL: agent only) During scans: no outbound source-code traffic No source, findings, file names or history are sent anywhere. Encrypted rule pack is decrypted in memory with your Keychain key. defend.sprk3.com one-time activation sends: beta token + device public key returns: wrapped rule key HTTPS · setup only never: code · findings file contents · workspace
Download for macOS (.pkg)Learn more & request beta accessInstallation help
Universal (Apple silicon & Intel) · macOS 13+ · VS Code 1.90+ · Beta activation token required · Signed & notarized, Apple Developer ID 6JBK94Z45M · SHA-256 8d666a92…43aa (full)
What we catch

Role-inconsistent sequences

Each event alone may be benign. The structural context is what flags it. That's the difference between an alert and a finding.

How a process breaks its role
ROLE-INCONSISTENT SEQUENCE DECLARED ROLE · TOKENIZER read text tokenize local init emit tensors within role — no alert outbound egress 185.24.x.x:443 after local-init phase the tell the order, not the packet other roles trainer inferencer agent artifact
→
A tokenizer resolves outbound DNS. Tokenizers process text locally. Unexpected network egress means execution has escaped the tokenizer’s declared role.
→
An embedding pipeline enumerates IAM roles. Embeddings compute vectors. Identity enumeration is reconnaissance.
→
An inference node accesses ~/.ssh. Inference serves predictions. SSH key access from an inference process is lateral-movement behavior, not serving behavior.
→
An agent reads credentials outside its workspace. Agents act within a task scope. Reaching for ~/.aws or a token store outside that scope is capability the role never declared.
→
A checkpoint hash changes after deployment. Production artifacts are not expected to mutate post-deployment. When they do, it means substitution or tampering.
→
Download → write → delay → execute. Each step is benign. The sequence doesn’t fit the process’s role.
Proof of detection

One role-inconsistent chain

What actually happened, in order
ONE ROLE-INCONSISTENT CHAINimportmistralaioutbound83.142.xwrite/tmp/*.pyz⚑ flagged hereimport → outbound → write = the tellgeo-check1-in-6 gatedicerandomrm -rf /destroywould have followed — process already flaggedFlagged on the chain — not the package name.

May 2026. A PyPI package named mistralai appears on the public registry. 244,000 downloads in 18 hours. The name matches a major AI vendor. The package imports normally.

On import, it opens an outbound connection to 83.142.209.194. Downloads a payload to /tmp/transformers.pyz. Checks geolocation. Rolls a 1-in-6 random gate. Fires rm -rf /.

Five events. Each one individually benign. An import. A network call. A file write. A conditional check. A delete.

The sequence doesn’t fit any legitimate role. No ML library downloads an executable on import, gates on geography, then rolls dice before touching the filesystem. Signature tools see five benign events. Observe sees one role-inconsistent chain — import → outbound → payload write — and flags it on that chain, not on the package name.

We don’t need to recognize this malware. Import plus outbound connection plus payload write is the tell. In our own replay of this attack, Observe alerted on that chain.

Based on CVE-2026-45321 (Mini Shai-Hulud). Publicly documented supply chain attack targeting ML infrastructure.

Our approach

System physics,
not better signatures

Traditional security asks: "Does this match a known bad thing?"

SPR{K3 asks: "Is this behavior possible under legitimate intent?"

We define the physics of valid behavior across AI infrastructure. Violations aren't alerts. They're role-inconsistent sequences — orderings no legitimate workload produces.

Order matters. Timing matters. Staging matters. Most AI security tooling evaluates isolated events. We evaluate the structural trajectory.

Physics layer
What "valid" means
Trust flow
Data crosses trust boundaries only through verified channels
Provenance
Every artifact has attestable lineage to a known origin
Execution ordering
Operations follow causal sequences consistent with declared intent
Capability acquisition
Components access only resources required by their function
Economic behavior
If it costs more than it should, it is doing more than it should
Intelligence architecture

Five layers of one system

Not a feature list. A unified model of what valid behavior looks like — and five ways to detect when it breaks.

Five detectors, one model
ONE MODEL · FIVE DETECTORS01Behavioral integrityresource & capability anomalies no workload produces02Runtime trusthow components actually behave, live — not how they claim to03Temporal intelligencesequence over time: drift, mutation, slow-burn chains04Provenance & lineagewhere an artifact came from, and whether its chain is intact05Adaptive scoringexploit-informed ranking; noisy hypotheses decay
01
Behavioral Integrity
Resource behavior reveals hidden intent. Economic impossibility, capability acquisition anomalies, structural violations no legitimate workload produces. Poisoning, sandbagging, drift.
02
Runtime Trust
Agent mesh, process monitoring, orchestration boundaries. Continuous observation of how components actually behave — not how they claim to.
03
Temporal Intelligence
Trust isn't a snapshot, it's a trajectory. Persistence tracking, mutation detection, convergence modeling. Sequence matters more than any single event.
04
Provenance & Lineage
Checkpoint integrity, supply chain trust, static scanning. Where did this artifact come from, and has anything in its chain been compromised?
05
Adaptive Intelligence
Proprietary runtime intelligence, exploit-informed scoring, and adaptive noise reduction. Detection hypotheses that consistently identify real threats survive. Those that generate noise decay. Higher signal, fewer alerts.

Most AI security monitors prompts and policies.
We monitor the infrastructure beneath them.

Traditional AI security tools inspect prompts and models. We watch the infrastructure paths that execute them — where the artifact can be legitimate, the model can work perfectly, and the exploit is still latent. That's why sequence detection matters before the payload activates.

Where others look, where we look
WHERE OTHERS LOOK — WHERE WE LOOKWHAT MOST AI SECURITY WATCHESpromptsmodelspoliciesthe visible layerthe artifact can be legitimate, the model can work — and the exploit is still latentWHAT SPR{K3 DEFEND WATCHES · THE INFRASTRUCTURE BENEATHprocess lineageorchestration trustmodel loadegresstorch.load / pickle · execution order · where systems fail silently
◇
Offense feeds defense. Every vulnerability we discover becomes a detection pattern. 14 CVEs and counting — not threat reports about what could happen, but proof of what we found.
⚑
Instruction file scanning. AI coding agents read behavioral instructions from project files. CLAUDE.md, .cursorrules, .mcp.json — checked into repos, loaded on trust. Nobody reads them. We scan them. Try it free — sign up to scan more.
⊙
Model loading safety. ML frameworks load models through deserialization — torch.load, pickle, trust_remote_code. Each is a code execution path. Try it free — sign up to scan more.
◈
Model cognitive health (BrainGuard). Detects model and agent degradation, poisoning, and capability drift over time — before it becomes permanent.
▣
Cross-repository correlation. Correlates findings across repositories to surface coordinated attacks a single-repo scan treats as isolated bugs.
⬡
LLM-generated code detection. Flags code carrying the statistical signature of machine generation, not a human author.
◎
Preservation intelligence. Tells recurring, load-bearing patterns apart from genuine issues, so hardening doesn’t break what works.
△
Temporal trajectory. Tracks behavior over time — drift, mutation velocity, convergence — to catch slow-burn changes a point-in-time scan misses.
▢
Plugin integrity. Verifies agent-framework plugins — hash pinning, signature validation, allowlisting — where the frameworks themselves ship none.
Why this matters

Trust is now an operational signal.

AI infrastructure evolves while running. Models update, agents orchestrate each other, checkpoints propagate across pipelines, and trust assumptions shift with every deployment.

Traditional security tools were designed for systems that hold still between scans. AI systems don't. The result: invisible trust failures — orchestration drift, silent lineage corruption, behavioral degradation that compounds undetected.

SPR{K3 was built for infrastructure that changes continuously — providing the same operational visibility into trust that you already expect for uptime, latency, and throughput.

Zero interference

Observe by default. Enforce is a separate switch — off.

Observe is never in your data path. No inline proxy, no request interception, no added latency. It reads process, path and destination metadata, scores what it sees, and surfaces role-inconsistent sequences. Acting on them is a separate switch — Enforce — which ships off. If you turn it on, it runs only the actions you define.

Where Observe sits
OBSERVE IS NOT IN THE DATA PATH pip torch.load agent runtime your work runs at full speed — no inline proxy, no interception, zero latency metadata tap OBSERVE · default reads process · path · destination · timing metadata only — no file contents, no packet bodies scores & surfaces role-inconsistent sequences you turn it on ENFORCE · opt-in OFF acts only on the actions you list in controls.json
→
Passive observation. The agent reads process tables and event streams. It never modifies, intercepts, or injects into your runtime.
→
No inline path. Defend is not a proxy, not a firewall, not a gateway. Nothing in your data path touches it. Zero latency impact.
→
Enforce is off by default. Observe logs, scores and surfaces role-inconsistent sequences. Turn Enforce on and it acts only on the actions you list in controls.json — nothing else.
→
Uninstall in seconds. One command removes the agent completely. No kernel drivers, no boot-time hooks, no residual services.
Your data, your machines

Privacy-first. Mostly local.

What stays vs. what leaves
STAYS ON YOUR MACHINEfile contents — code, data, models, docscredentials, tokens, API keys, env varspacket bodies — no capture, no inspectionprompts & conversationsdetection runs client-sidemetadata onlySERVER SEESprocess namepathdestinationtimingthat’s it.
No file contentsWe never read your code, data, models, or documents.
No credentialsWe never see passwords, tokens, API keys, or env vars.
No network sniffingWe don't capture or inspect your connections.
Metadata onlyProcess names and event types. That's it.
Local firstYour code, models, and conversations never leave your machine.
Defend AgentsAll detection runs client-side. Server sees metadata only.
Why Defend

Security you can run on the machine you actually work on

Most endpoint security is built for fleets of corporate laptops and servers. Defend is built for the developer box, the build host, the inference node — the machines where AI infrastructure actually runs, and where a single bad import can end your day.

→
Quiet by design. Defend doesn't bury you in alerts. It stays silent until it sees a role-inconsistent sequence, then tells you exactly what fired and why — in one line you can act on, not a dashboard you have to triage.
→
Useful from install, sharper every day. From the moment you connect, Observe surfaces destructive operations and known role-inconsistent chains — reporting only, since Enforce ships off. Then it learns your machine: over the first days it tunes to what's normal for you, so routine work stops tripping alerts and genuine novelty stands out.
→
Built for dev machines — macOS, Linux, and Windows. Not a repackaged enterprise EDR. Defend runs light — low CPU, tens of MB of RAM — and understands ML toolchains: torch.load, pickle, distributed workers, agent meshes. The places generic tools are blind.
→
Enforce is opt-in. Your work runs freely — no inline proxy, no interception, no latency. Observe surfaces role-inconsistent sequences; nothing is acted on until you turn Enforce on, and then only on the actions you’ve listed.
→
Offense-grade detection. The patterns that protect you come from the same research that found 14 CVEs across NVIDIA and confirmed findings at Meta, Microsoft, Amazon, Google, and Intel. You're defended by what we break, not by a threat feed.
→
Trust you can verify. Apple-notarized on macOS (Team 6JBK94Z45M), signed installers, runs locally, sends metadata only, uninstalls in one command. Nothing about how it works is hidden from you — including a private local view of exactly what it learned about your machine.
Where we monitor

Trust transitions across your AI stack

Every boundary where data, models, or instructions pass between components is a trust transition. We monitor them.

◈
Models
behavioral drift
◇
Agents
orchestration trust
▣
Vector DBs
provenance integrity
⬡
Checkpoints
lineage verification
◉
CI/CD Pipelines
supply chain trust
△
Training Workers
sync integrity
▢
Registries
artifact trust
◎
Runtime APIs
request integrity
Track record

Built on real vulnerability research

Offensive research turned into production defense — continuously. Vulnerability discoveries feed directly into new detection patterns. Deployments generate signal that sharpens the next scan. One closed loop, no manual handoff.

14
CVEs across
NVIDIA bulletins
verify →
11
Mini Ora rules
across 6 classes
6
Workstations
running Observe

We’ve run Observe on our own 6 workstations — 4 Macs, 2 Windows — for 3–4 months: zero blocks of normal work, it fires on the attack replays we run against it, and Enforce stays off unless we turn it on.

Confirmed findings at NVIDIA, Microsoft, Amazon, Google, Meta, HuggingFace and Intel. Only the NVIDIA acknowledgements are a public page (linked above); the others are vendor-confirmed reports.

Resources

Industry context

The problem space SPR{K3 operates in, validated by major frameworks and industry research.

Industry

CVE-to-exploit window: 10 hours in 2026

Why manual red-to-blue handoffs can't keep pace with modern exploit timelines.

Framework

NIST AI Risk Management Framework

The US federal standard for AI risk governance.

Framework

MITRE ATLAS

Adversarial threat landscape for AI systems. TTPs mapped across the ML lifecycle.

Verification

NVIDIA Acknowledgements Page

Dan Aridor, SPR{K3 — listed across three NVIDIA security bulletins. Verify independently.

Research & Insights

From our blog

Field notes from the intersection of offensive research and AI defense.

Research

244,000 Downloads in 18 Hours

The model repository is the new attack surface.

Analysis

Gaming Already Solved Your AI Security Problem

You just don't know it yet.

Analysis

The Allowlist Fallacy

Why “trusted environment” is the most dangerous assumption in AI security.

Product

SPR{K3 Defend

Built exclusively for AI infrastructure.

Research

The Scanner Was the Weapon

When the security tool itself becomes the attack vector.

Dan Aridor, Founder

Dan Aridor

Founder, SPR{K3 Security Research

14 CVEs across NVIDIA bulletins — listed on the NVIDIA Product Security Acknowledgements.

More about the team →

Disclaimers

Beta software

SPR{K3 Defend is beta software provided "as is" without warranty of any kind, express or implied, including but not limited to the warranties of merchantability, fitness for a particular purpose, and non-infringement.

No guaranteed security

Detection patterns reduce risk but do not guarantee the identification of all vulnerabilities. SPR{K3 is not responsible for undetected vulnerabilities or actions taken based on scan results.

Informational only

Findings are provided for informational purposes and do not constitute legal, compliance, or professional security advice. For critical infrastructure, consult a qualified security professional.

Compliance reports

NIST AI RMF compliance reports assist your compliance process. They do not replace a qualified auditor's assessment and should not be relied upon as standalone certification.

Service provider

Dan Aridor Holdings Ltd (ח.פ. 513416164), 1 Bar Ilan Street, Bat Yam, Israel. For questions, cancellations, or complaints, contact support@sprk3.com.

Governing law

Use of SPR{K3 services is governed by our Terms of Service and Privacy Policy, under the laws of the State of Israel.

Cancellation rights

Under the Israeli Consumer Protection Law (5741-1981, Section 14C), you may cancel a distance selling transaction within 14 days of purchase or receipt of this disclosure, whichever is later. Cancellation fee: the lesser of 5% of the transaction price or NIS 100. Senior citizens (65+), new immigrants, and persons with disabilities may cancel within 4 months. Cancellation by email to support@sprk3.com.

Choose your entry point
◈

Verify trust at rest

Scan your codebase and model artifacts for supply chain risks, unsafe deserialization, and lineage gaps.

Static scanning — provenance, integrity, known vulnerabilities
Learn more →
◇

Monitor trust in motion

Detect orchestration drift, prompt injection, and tool misuse across your agent runtime.

Agent monitoring — trust scoring, heartbeat, relay detection
Agent degradation — reasoning decline, hallucination spikes, capability loss
Runtime defense — process-level visibility, anomaly detection
Learn more →
▣

Observe trust continuously

Full trust observability across your AI infrastructure. Static, runtime, and behavioral — one continuous signal.

All layers — behavioral integrity, runtime trust, temporal intelligence
BrainGuard — model health, degradation, drift tracking
View engagement options →
◆

Scan inside VS Code

SPR{K3 Mini Ora for VS Code — Beta. Local static analysis for unsafe deserialization, unsafe model loading, remote model code, dynamic execution, shell injection and hard-coded secrets. Scans never leave your Mac.

Start free

Get your API key

Email in, key out — no payment, no verification. One key unlocks both static scanning and the runtime agent.