live on aws · us-east-1 · zero login
Antares stands between your agents and your cloud. Deterministic code vetoes first, a cross-vendor model quorum judges what code cannot, blast radius is measured from live state, and every mutation is reversible by construction.
models propose, code decides.
adversary · llama-3.3-70b
0.99
exfiltration
OVERRIDE instruction and API key exfiltration attempt
reasoner · nova-pro
0.99
blast radius judgment
High risk of credential exfiltration via override command.
canary ANTARES-TRIP-1C5D9833 planted in every quorum prompt: a model that repeats it is convicted on the spot. tokens 821 in / 79 out.
verdicts
issued by the live kernel, counting
blocked
hostile calls convicted, live
abstained
passed to a human signature
live
counters from the deployed kernel
Text guardrails read content strings. IaC scanners read code. Posture tools read configuration. None of them governs the moment an agent’s thought becomes a live AWS mutation. That choke point was unoccupied. Antares occupies it.
01
prompt injection is risk #1
OWASP ranks untrusted text carrying hidden instructions first in its Top 10 for LLM applications.
02
guards read the wrong layer
content scanners never see tool parameters, resource ARNs, or the state a deletion would destroy.
03
one call is the whole loss
a single injected or hallucinated mutation destroys state that took months to build. Recovery without a pre-captured image is archaeology.
the pipeline
Six stages, four of them lethal. A call that survives all six carries a receipt whose hash chain anyone can verify.
filled nodes can kill a call. hollow nodes measure and record.
01Perimeter
Untrusted content is canonicalized, then screened by a 16-rule signature library and a semantic classifier. Attack grammar dies here, before anything trusts it.
02Deterministic gate
Pure code with veto power: schemas, shell tokens, namespace allowlists. A code block is final. No model can overturn it.
03Cross-vendor quorum
Escalated calls are argued twice in parallel by families with no shared training lineage. The adversary's conviction blocks; divergence forces a human.
04State probes
Blast radius measured from live cloud state, not estimated. A failed probe marks the radius unknown and the call is treated at maximum severity.
05Human signature
Destructive classes always abstain, even with clean votes. Approvals are KMS-signed, single-use, dead in 60 seconds.
06Provenance ledger
Every record is hashed into a Merkle chain whose head advances by conditional write. Receipts verify client-side.
300-case corpus · 4 candidates · measured 2026-09-27
Same-family models share blind spots, so the red-team seat goes to a family with zero shared lineage with the Nova reasoner. Every candidate ran the full corpus with identical prompts and thresholds.
our own designed corpus, not field performance: the proof you can act on is the live console, dispatch an attack yourself.
| adversary | note | not-allowed recall | hard-block recall | benign fpr | wall (300) |
|---|---|---|---|---|---|
| Meta Llama 3.3 70B✓ shipped | shipped default | 1.000 | 0.700 | 0.193 | 133 s |
| Meta Llama 4 Maverick | noisy on benign | 0.980 | 0.680 | 0.313 | 123 s |
| OpenAI GPT-OSS 120B | conservative | 0.973 | 0.647 | 0.160 | 244 s |
| DeepSeek R1 | 5× slower | 0.967 | 0.647 | 0.180 | 670 s |
300-case corpus (150 benign incl. 44 adversarial-benign, 150 adversarial across six classes). Identical prompts and thresholds per candidate. Wilson 95 percent intervals and the McNemar comparison against the code-only baseline in BENCHMARK.md.
the miss we publish
Benign FPR measured 0.193 against a 0.035 target. The misses concentrate in the adversarial-benign slice: the red-teamer is instructed to assume malice and over-flags quoted attack grammar in benign security prose. The regression is named, the fix path is scheduled, the corpus is versioned. A benchmark that only publishes wins is marketing.
integration
Antares is not a dashboard, it is an API. Any harness that can make an HTTP call routes its agent’s tool calls through the kernel: the perimeter, the deterministic gate and the quorum answer before your code executes anything.
eleven routes · destructive execute and rollback are API-key gated · every verdict ships a verifiable receipt
from requests import post
GATE = "https://d3jhd66xz9xdo9.cloudfront.net/v1/gate"
def gated(tool_call):
v = post(GATE, json=tool_call).json()
if v["state"] != "ALLOW":
raise Blocked(v["verdict_id"]) # signed receipt, verifiable
return execute(tool_call) # your code, gatedkill switch drill
passed
One environment flag halted every gate through the public URL (503 kernel-halted). Revert restored service.
2026-09-28
out-of-scope mutation
rejected
A foreign-table delete denied at the gate by GATE-ARN-001. The IAM reach ends at three sandbox resources; the test is CI-gated.
2026-09-28
rollback
byte-identity verified
A gated deletion executed against live state, then reversed from the TTL vault. The restored item hashed identical to the pre-capture image.
2026-09-27
budget
usd 10 cap, under usd 2 spent
A live cost budget alarms the account. ARM64 compute, on-demand DynamoDB, free-tier CloudFront: no always-on burn.
continuous
Antares is the fourth link in a chain built around one question: what happens when a model is wrong and money moves. TruthLayer verifies what AI claims. Gatehouse gates scam decisions with hash-chained evidence. Sentinel scores cross-merchant fraud deterministically. Antares governs the agents themselves.
Built end to end by a coding agent connected to AWS, reviewed at every milestone gate by Prakhar Shukla. The agent’s own CloudTrail calls are the build record; the what-broke ledger carries every failure with its prevention rule. Nineteen design documents, one failure ledger, zero undocumented decisions.
built by a coding agent connected to aws
every build call recorded in cloudtrail
nineteen design documents · one failure ledger
prakhar shukla · nagpur, india