- Artemis Security launched Orion-1, a defense-focused AI model in private preview, and says it beat rivals on a benchmark Artemis built itself.
- The Decoder reports that guardrails blocked Hugging Face's analysis of an AI attack in July, as providers shift to restricted defender-only access.
- Ask vendors for independent tests on your own data, and check where your security team's AI tools have refused to help.
A safety filter cannot see who is typing. That is the problem behind a small, telling episode from July. The Decoder reports that Hugging Face set out to examine an attack on its own infrastructure that was carried out autonomously by AI. The team used commercial frontier models. Their guardrails refused to work on the attack data at all. Hugging Face then switched to GLM 5.2, an open-weight model, running on its own servers.
The attacker and the defender ask the same questions of the same logs. A filter built to stop the first can also stop the second. The lesson here is that access to AI security help increasingly depends on who the provider believes you are, not only on what the model can do.
Providers are splitting access into tiers
The Decoder reports that providers keep tightening the cyber abilities of their general models. In OpenAI's view, Astra is the first of its models that may reach the top cyber-risk category. That category covers models able to design and launch attacks unaided. Anthropic's Claude Opus 5.5 hands most security work to an earlier model, Opus 4.8.
Defenders are offered special versions instead. OpenAI gives its less restricted GPT-5.5-Cyber to verified defenders. Anthropic's most capable model, Claude Mythos 5, reaches defenders through the Claude Security scanner and partner security products. The Decoder reports these as parallel moves. It does not say the Hugging Face case caused them. A team without verified status faces the cautious general model, or must run its own open-weight model, as Hugging Face did.
What Artemis offers to fill the gap
Artemis Security, a US startup, has released Orion-1, a model it trained for defensive work. So far it is in private preview, offered to a small number of Artemis customers. Artemis says it post-trained the model on threat detection, threat hunting, writing detection rules, investigation and incident response. It says it used no customer data.
The mechanism is the useful part. Real intrusions seldom announce themselves with one loud signal. More often a single intruder leaves faint marks across several systems, each harmless alone. Artemis's own example is an Okta sign-in, an AWS role change and a new mailbox rule in Google Workspace. Read together, they describe one actor.
Orion-1 is built to draw that link. Artemis maps each customer's users, AI agents, devices, SaaS apps, network activity and cloud systems. That map tells the model what normal looks like in that environment. The model then gives a verdict with a confidence level and recommends or triggers a response.
Artemis also describes the pressure on defenders. It says activity it classed as suspicious or malicious and boosted by AI grew 268% from April to August 2026. That figure covers only the environments Artemis defends.
A benchmark the vendor wrote and scored
Artemis also built the yardstick. Its Decision-Grade Readiness benchmark gives each model the same trigger, environment and tools. Every task has a known answer. Some contain no attack, and some hold harmless data that looks malicious. Models are scored on the verdict and on whether their evidence supports it. That design tests for false alarms, which matters.
Now the limits. Artemis claims Orion-1 outscored GPT-6 Sol and Claude Opus 5.5 on threat detection, investigation and attack reconstruction. The Decoder adds that Grok 4.7 and Kimi K3 were tested too. Attack reconstruction showed the widest margin: 80.8 for Orion-1 against 58.3 for the next-best model.
The Decoder points out three gaps. Claude Mythos 5 and GPT-6 Astra, the strongest models from Anthropic and OpenAI, are missing from the comparison. Because Opus 5.5 passes security work to Opus 4.8, its scores may mostly reflect the older model. And Artemis calls Orion-1 a "Frontier Foundation Model" while describing only post-training. The Decoder says it is unclear whether Artemis built on another provider's model.
Artemis came out of stealth in April. The Decoder says its funding totals $70 million across a seed round and a Series A, announced about six months after the company was founded. The results cited in the sources come from Artemis's own benchmark. Neither source mentions an independent test.
What to ask before you buy or build
First, ask your security team where AI tools have already refused to help. Count the investigations that stalled. That is your real cost of the guardrail problem.
Second, find out whether your organization qualifies for the restricted defender tiers the providers offer, and who applies.
Third, ask any vendor to show results from a test it did not write, on the models that matter. Ask for results on your own data, including cases with no attack.
Fourth, check the autonomy settings. Per Artemis, the customer decides how much the model may do alone, one action type at a time. Steps with high impact wait for a person's approval by default. Confirm that default in your contract.
Orion-1 may well be good. The broader point stands either way. When the rules that restrain attackers also restrain defenders, defense becomes something you may have to qualify for.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Artemis Security.
