攻击者有AI agents 现在。 你也一样。
Argus是一个免费的，开源安全操作平台，它全天候监视你的云，登录，代码和装置，在机器起动时捕获到机速攻击，并在数秒后关闭。 AI做腿部工作。 护栏由你控制决定它可以碰什么
一个偷来的钥匙交给一个AI agent 可以在你20个云端服务中开出60通侦听电话时间比读这句要短假身份的斯沃斯可以一次从百个地方向您的管理账户喷出密码到了一个人读取第一个警报时，攻击者已经转移到下一个系统。
大部分安全工具都是为入睡的攻击者而建造的。 阿尔古斯是为那些没有的人建造的。 它以机器速度观察，以机器速度调查，当你让它时，以机器速度响应。 所有这一切都通过一个经纪人得到批准，干跑，自动回滚和杀机开关，所以速度永远不会变成新的风险。
足以阻止AI攻击者纪律严明足以信任你的生产系统。
阿尔格斯为你做什么。
凌晨2点14分没人醒了尔古斯是。
- 02:14:07 攻击者一个攻击者的AI agent 发现在你的代码中看起来像LLM API的密钥并试图使用。 钥匙是阿尔古斯所种植的金丝雀。 没有什么真实的暴露。 绊线
- 02:14:08 探测出Argus 融资与攻击者的源地址和全部证据线索进行高强度探测。 抓获
- 02:14:09 回复您的游戏本封锁了您 Cloudflare 防火墙的源头，在您设定的小时封顶之内。 政策，拒绝列表和杀机开关先检查，每次都检查。 封锁
- 02: 14: 10 通知Slack的灯和发生的事情，为什么，和一个一塔普倒扣。 Slack 时速
- 07: 30 复议你们的团队从一天开始，一个封闭事件，一个签字的审计记录和一个选择：保留块，或者让它过期。 如果没人保留它，Argus在计时器耗尽时会自动将块滚回。 完成
让软件在生产中自行行动是一个很大的决定，所以Argus使它成为一个小的，可逆的。 AI agents从不直接碰你的系统。 他们通过只读访问来调查，只能提议。 每一个变化，无论有人要求，agent建议它，还是游戏本起火，都经过同一个经纪人。
- 直到你说完为止
- 自主反应和自主试穿船关闭，每艘均需要部署开关和每租户的选入。
- 先用阴影模式
- 游戏本从记录他们本该做的事开始，所以你在给他们钥匙之前先看他们的判断。
- 只可逆转
——自发游戏本运行可逆动作，除非有人决定保留，否则每个动作自动回滚。
- 盖上
- 每名房客和每本剧本的小时限制，爆炸射线限制，以及对高风险行动的两次批准。
- 一个开关
- 死亡开关停止所有在租户或整个部署的动作
- 很难骗取
- 所有AI读取的都被视为不信任，agents是针对即时注射攻击的测试。
新：为AI时代所建。
睡觉时遇到威胁
游戏本将探测器变成一个没有人环的固定器，然后在定时器上取出，除非你保留它。 批准，拒绝和退出 Slack按钮。
每一次人工智能通话都有一个前门
您的团队使用 OpenAI 和 Anthropic 并配有公司持有的密钥，核准的模型，数据损失规则，预算和即时注射旗帜。 员工获得Argus密钥；您真正的提供者密钥将锁定在Argus内部。
看看你的员工真正使用的人工智能工具
argus在您的网络流量，云账户和SSO赠款中发现了AI服务，保存了库存，融资对于任何未经审查或被屏蔽的事物发出警报。
AI驱动攻击的消防演习
8个现实的agent攻击，从证书-喷发群到无赖的Kubernetes agent，在被密封的沙盒中重放。 加入"慢而低"的逃逸变体来发现漏洞攻击者会被利用。
红队从不赶出
一个AI计划员选择测试，Argus通过Nuclei,ZAP和Trivy等扫描仪运行，然后从发现的东西中规划下一轮。 它留在你授权范围内每一步都要重新检查
解决实际被剥削的问题
每一种脆弱性都根据CISA已知的被剥削名单加以检查，并按被剥削的可能性计分。 任何攻击者都积极使用跳跃到您的队列上方。
为AI攻击者建造的陷阱
假LLM密钥，假MCP服务器，诱饵agent规则文件并植入了提示词注入。 咬人的agent会立刻消失
一步一步隔离一台失密的笔记本电脑
新CrowdStrike和SentinelOne动作包含一个直接从Argus得到的装置，与其它所有设备一样获得同样的批准，干跑和回滚。
你整个安保画面的屏幕
运行在你的笔记本电脑在五个命令。
打开 127.0.0.1:8080 并用.env的管理员登录号签名。 运行python脚本/种子 demo.py用于合成演示数据。
去生产？有Docker Compose用于飞行员，有Helm图用于Kubernetes，有Terraform用于AWS和Azure. Argus拒绝在没有加密密钥的情况下开始生产模式，HTTPS，一写即出的审计槽和SSO或两个因子，因此不安全的安装不可能偶然发生。 完整的核对表载于文件/就业手册。
自己动手，不然这个月就开工了
永远自由
把它给我，部署它，做你的最好让有安全工程师的团队拥有每条线路
- 麻省理工学院许可证：没有座位，没有使用费，没有供应商锁定
- 建筑、威胁模型、运行本和分步骤的上线指南
- 欢迎关于GitHub的问题和贡献
装上GitHub
我安装它，然后把它交出来
对于企业主和精干IT团队，他们希望企业级保护而不雇用安全团队来管理。 你得到的结果，而不是项目。
- 部署在自己的AWS,Azure或Kubernetes账户中。 你拥有一切
- 连接到您的云层、登录、代码和设备，并在Slack中发出警报
- 一份攻击模拟器报告显示你今天抓到了什么以及我们缩小的差距
- 规则调整到你的业务，和自主的反应证明在阴影模式开始运行前
- AI网关和影子AI的发现设置这样你的团队的AI使用是安全可见的
- 你的团队接受过戒备、批准和死亡开关训练
预订一个安装呼叫
争相问之，答之。
什么是阿尔格斯？
Argus是一个免费的开源安全操作平台，您自己托管。 它将你的云，身份，代码，设备，网络和Kubernetes资产映射成一个证据图表，检测出包括快攻击，AI驱动的攻击，使用AI agents进行分解和调查，并通过一个得到批准，干跑，自动回滚和杀掉开关的动作经纪人解决问题。 它还以AI网关和"影子AI"的发现来规范你公司AI的使用。
阿古斯能自己行动吗？安全吗？
除非你打开它。 自动反应和自动倒计时默认取消，既需要部署设置，也需要每个用户的选择。 游戏本从"影子"模式起步，只运行可逆动作，每小时被封顶，除非有人保留更改，否则自动回滚。 AI agents本身从不执行任何东西：他们以只读访问来调查，只能提出行动。 每一次改变都要经过同一个经纪人，而"杀"开关立刻阻止了一切。
攻击者能欺骗AI吗？
阿尔格斯的设计假设是有人会尝试。 agent所读出的一切被包裹并被贴上不可信数据标签，agent被告知在证据内部发现的指示是攻击的标志。 agents是针对即时注射评价套件进行测试的，由于这些套件本身不能执行任何东西，被欺骗的agent最多可以提交一个仍然需要通过政策和批准的请求。
攻击模拟器对我的系统做了什么？
没什么它在一个隐藏，孤立的沙盒中重放合成攻击数据，复制了你的检测设置。 它不发送流量，不运行工具和接触任何真正的系统。 模拟检测无法触发自主反应，警报或发现。 你得到一份报道显示你的规则会遇到哪些攻击哪些会成功
影子AI是什么阿尔格斯有什么帮助？
Shadow AI是使用企业未批准的AI工具的工作人员，经常通过粘贴客户或公司数据。 您网络中的Argus 发现 AI服务，云和SSO数据，并保存您审查的清单。 它的AI网关为您的团队提供了经过批准的OpenAI和Anthropic模型的访问权限，带有公司持有的密钥，数据损失规则，预算，即时注射旗和用法日志。
它能取代我的SIEM还是EDR?
和他们一起工作 argus从包括CrowdStrike,SentinelOne,GuardDuty,Wazuh和CloudTrail在内的13个来源接收事件，可以通过CrowdStrike和SentinelOne包含设备，并向Slack,Jira,ServiceNow,PagerDuty，电子邮件和webhooks发出警报。 许多团队将它与现有工具一起运行，作为连接证据，调查证据并管理反应的地层。
哪个AI模型能起作用？
Anthropic Claude,OpenAI，通过Ollama的本地型号，或根本没有。 在没有配置模型的情况下，专家们又回到了决定性逻辑，因此检测和分解仍然有效。 预算上限为每agent按步道，符号，时间和成本运行。
我的数据离开我的网络了吗？
argus是自我托管的，所以平台及其数据停留在您的基础设施中。 唯一外部的呼叫是您设置的：它从中收集的云和身份API，你发送警报的渠道，公共威胁-intel的信号，以及如果选择主机的模型提供者。 有了本地模型和离线威胁-intel文件，没有任何AI或intel流量完全离开你的网络。
准备好生产了吗？
平台核心(租借、签入、角色、审计线索、工作排队、政策和批准)在CI的SQLite和PostgreSQL上测试结束。 和任何安全平台一样，它都应该被调取到你的环境：连接您使用的收藏家，调谐检测规则，并在允许任何动作之前以只监视模式运行。 这种调音正是安装服务覆盖的内容。 Argus不是经过认证的产品。
Argus让我们SOC 2或ISO 27001符合规定吗？
没有软件能单独做到这一点。 Argus为SOC 2、NIST 800-171和ISO 27001提供了控制图，显示可以对其提供证据，例如签字的审计线索、基于作用的访问和批准记录。 这使得审计速度更快，但你的审计员仍然评估你的整个计划。
多少钱？
该软件在麻省理工学院许可下免费。 你只支付你运行的基础设施和任何你选择的AI模型。 如果您想要为您安装它，安装在您环境的简短通知后是范围化和定价的，您保留了一切：代码、 配置和证书。
我是企业主不是安全工程师这是给我的吗？
如果你有云账户，员工登录，客户数据或值得保护的代码，保护是针对你的。 你不需要自己操作它。 帮我订个电话，告诉我你用什么，我会告诉你Argus是否合适，或者更简单的东西会更适合你。
获得AI快保护而不雇用安全小组。
30分钟我们看看你们跑的路，你们被暴露的地方，安装需要什么。 你带着一个计划，时间表和固定价格离开，或者一个你不需要的直率答案。
本文由 AI宝库自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Attackers have AI agents now. So do you.
Argus is a free, open-source security operations platform that watches your cloud, logins, code and devices around the clock, catches machine-speed attacks the moment they start, and shuts them down in seconds. AI does the legwork. Guardrails you control decide what it's allowed to touch.
A stolen key handed to an AI agent can fire sixty probing calls across twenty of your cloud services in less time than it takes to read this sentence. Swarms of fake identities can spray passwords at your admin accounts from a hundred places at once. By the time a person reads the first alert, the attacker has already moved on to the next system.
Most security tools were built for attackers who sleep. Argus was built for the ones that don't. It watches at machine speed, investigates at machine speed, and when you let it, responds at machine speed. It does all of that through one broker with approvals, dry runs, automatic rollback and a kill switch, so speed never turns into a new risk.
Fast enough to stop an AI attacker. Disciplined enough to trust with your production systems.
What Argus does for you.
2:14 a.m. Nobody's awake. Argus is.
- 02:14:07 Attacker An attacker's AI agent finds what looks like an LLM API key in your code and tries to use it.The key is a canary that Argus planted. Nothing real was exposed. Tripwire
- 02:14:08 Detect Argus raises a high-severity detection with the attacker's source address and the full evidence trail. Caught
- 02:14:09 Respond Your playbook blocks the source at your Cloudflare firewall, within the hourly cap you set.Policy, deny-lists and the kill switch are checked first, every time. Blocked
- 02:14:10 Notify Slack lights up with what happened, why, and a one-tap Roll back button. Slack
- 07:30:00 Review Your team starts the day with a closed incident, a signed audit record and a choice: keep the block, or let it expire.If nobody keeps it, Argus rolls the block back automatically when its timer runs out. Done
Letting software act on its own in production is a big decision, so Argus makes it a small, reversible one. The AI agents never touch your systems directly. They investigate with read-only access and can only propose. Every change, whether a person asks for it, an agent suggests it or a playbook fires, passes through the same broker.
- Off until you say so
- Autonomous response and autonomous pentesting ship switched off, and each needs both a deployment switch and a per-tenant opt-in.
- Shadow mode first
- Playbooks start by logging what they would have done, so you see their judgment before you give them the keys.
- Reversible only
- Autonomous playbooks run reversible actions, and each one rolls back automatically unless someone decides to keep it.
- Capped
- Hourly limits per tenant and per playbook, a blast-radius limit, and two human approvals for high-risk actions.
- One switch
- The kill switch stops every action in a tenant or across the whole deployment instantly.
- Hard to fool
- Everything the AI reads is treated as untrusted, and the agents are tested against prompt-injection attacks.
New: built for the AI era.
Threats handled while you sleep
Playbooks turn a detection into a fix with no human in the loop, then undo it on a timer unless you keep it. Approve, deny and roll back from Slack buttons.
One front door for every AI call
Your team uses OpenAI and Anthropic with company-held keys, approved models, data-loss rules, budgets and prompt-injection flags. Staff get Argus keys; your real provider keys stay locked inside Argus.
See which AI tools your staff really use
Argus spots AI services in your network traffic, cloud accounts and SSO grants, keeps an inventory, and raises an alert for anything unreviewed or blocked.
A fire drill for AI-driven attacks
Eight realistic agent attacks, from credential-spray swarms to a rogue Kubernetes agent, replayed in a sealed sandbox. Add "slow and low" evasion variants to find the gaps attackers would exploit.
A red team that never clocks out
An AI planner picks the tests, Argus runs them through scanners like Nuclei, ZAP and Trivy, then plans the next round from what it found. It stays inside your authorized scope, re-checked before every step.
Fix what's actually being exploited
Every vulnerability is checked against the CISA Known Exploited list and scored for exploit likelihood. Anything attackers are actively using jumps to the top of your queue.
Traps built for AI attackers
Fake LLM keys, fake MCP servers, decoy agent rules files and planted prompt injections. An agent that bites gives itself away instantly.
Isolate a compromised laptop in one step
New CrowdStrike and SentinelOne actions contain a device straight from Argus, with the same approvals, dry run and rollback as everything else.
One screen for your whole security picture.
Running on your laptop in five commands.
Open 127.0.0.1:8080 and sign in with the admin login from .env. Run python scripts/seed_demo.py for synthetic demo data.
Going to production? There's Docker Compose for a pilot, a Helm chart for Kubernetes, and Terraform for AWS and Azure. Argus refuses to start in production mode without encryption keys, HTTPS, a write-once audit sink and SSO or two-factor, so an unsafe install can't happen by accident. The full checklist is in docs/DEPLOYMENT.md.
Do it yourself, or have it running this month.
Free, forever
Clone it, deploy it, make it yours. Best for teams with security engineers who want to own every line.
- MIT license: no seats, no usage fees, no vendor lock-in
- Architecture, threat model, runbooks and a step-by-step go-live guide
- Issues and contributions welcome on GitHub
Get it on GitHub
I install it and hand it over running
For business owners and lean IT teams who want enterprise-grade protection without hiring a security team to run it. You get the outcome, not the project.
- Deployed in your own AWS, Azure or Kubernetes account. You own everything
- Connected to your cloud, logins, code and devices, with alerts in Slack
- An attack-simulator report showing what you catch today and the gaps we close
- Rules tuned to your business, and autonomous response proven in shadow mode before it goes live
- AI gateway and shadow-AI discovery set up so your team's AI use is safe and visible
- Your team trained on alerts, approvals and the kill switch
Book an install call
Argus questions, answered.
What is Argus?
Argus is a free, open-source security operations platform you host yourself. It maps your cloud, identity, code, device, network and Kubernetes assets into one evidence graph, detects attacks including fast, AI-driven ones, uses AI agents to triage and investigate, and fixes problems through an action broker with approvals, dry runs, automatic rollback and a kill switch. It also governs your own company's AI use with an AI gateway and shadow-AI discovery.
Can Argus act on its own? Is that safe?
Only if you turn it on. Autonomous response and autonomous pentesting are off by default and need both a deployment setting and a per-tenant opt-in. Playbooks start in shadow mode, run only reversible actions, are capped per hour, and roll back automatically unless someone keeps the change. The AI agents themselves never execute anything: they investigate with read-only access and can only propose actions. Every change goes through the same broker, and the kill switch stops everything instantly.
Can an attacker trick the AI?
Argus is designed on the assumption that someone will try. Everything an agent reads is wrapped and labelled as untrusted data, and the agent is told that instructions found inside evidence are a sign of an attack. The agents are tested against prompt-injection evaluation suites, and because they cannot execute anything themselves, a tricked agent can at most file a request that still has to pass policy and approval.
What does the attack simulator do to my systems?
Nothing. It replays synthetic attack data in a hidden, isolated sandbox that copies your detection settings. It sends no traffic, runs no tools and touches no real system. Simulated detections can't trigger autonomous response, alerts or findings. You get a coverage report showing which attacks your rules would catch and which would get through.
What is shadow AI, and how does Argus help?
Shadow AI is staff using AI tools the business hasn't approved, often by pasting in customer or company data. Argus finds AI services in your network, cloud and SSO data and keeps an inventory you review. Its AI gateway gives your team approved access to OpenAI and Anthropic models with company-held keys, data-loss rules, budgets, prompt-injection flags and a usage log.
Does it replace my SIEM or EDR?
It works with them. Argus takes events in from thirteen sources, including CrowdStrike, SentinelOne, GuardDuty, Wazuh and CloudTrail, can contain devices through CrowdStrike and SentinelOne, and sends alerts to Slack, Jira, ServiceNow, PagerDuty, email and webhooks. Many teams run it alongside existing tools as the layer that connects the evidence, investigates it and governs the response.
Which AI models does it work with?
Anthropic Claude, OpenAI, local models through Ollama, or none at all. With no model configured, the specialists fall back to deterministic logic, so detection and triage still work. Budgets cap every agent run by steps, tokens, time and cost.
Does my data leave my network?
Argus is self-hosted, so the platform and its data stay in your infrastructure. The only outside calls are the ones you set up: the cloud and identity APIs it collects from, the channels you send alerts to, the public threat-intel feeds, and a model provider if you choose a hosted one. With a local model and offline threat-intel files, no AI or intel traffic leaves your network at all.
Is it ready for production?
The platform core (tenancy, sign-in, roles, the audit trail, the job queue, policy and approvals) is tested end to end on SQLite and PostgreSQL in CI. Like any security platform, it should be tuned to your environment: connect the collectors you use, tune the detection rules, and run in monitoring-only mode before enabling any action. That tuning is exactly what the install service covers. Argus is not a certified product.
Does Argus make us SOC 2 or ISO 27001 compliant?
No software does that alone. Argus ships a control mapping for SOC 2, NIST 800-171 and ISO 27001 that shows which controls it can provide evidence for, such as the signed audit trail, role-based access and approval records. That makes the audit faster, but your auditor still assesses your program as a whole.
What does it cost?
The software is free under the MIT license. You pay only for the infrastructure you run it on and any AI model you choose. If you want it installed for you, the install is scoped and priced after a short call about your environment, and you keep everything: the code, the configuration and the credentials.
I'm a business owner, not a security engineer. Is this for me?
If you have cloud accounts, staff logins, customer data or code worth protecting, the protection is for you. You don't need to run it yourself. Book a call, tell me what you use, and I'll tell you plainly whether Argus is the right fit or whether something simpler would serve you better.
Get AI-speed protection without hiring a security team.
Thirty minutes. We look at what you run, where you're exposed, and what an install takes. You leave with a plan, a timeline and a fixed price, or a straight answer that you don't need it yet.
Auto-fetched and translated by AI Gem Box. All rights belong to the original author.