AI guardrails designed to stop hackers are now blocking defenders, and Orion-1 aims to fill the gap

General-purpose AI models are becoming a growing problem for security teams, since the same skills also help attackers. Artemis Security wants to close that gap with a purpose-built model.

US startup Artemis Security has launched Orion-1, a model designed to investigate and respond to attacks on corporate networks on its own, beating Claude Opus 5.5 and GPT-6 Sol on the company's own benchmark. Orion-1 processes log data from auth services, cloud setups, corporate endpoints, SaaS apps, and network gear, then connects individual signals like a corporate account login, new cloud permissions, and a freshly created email inbox rule to tie them back to a single attacker. Once it has a picture of what happened, the model assigns a confidence score, locks in a verdict, and recommends or kicks off a response.

General-purpose models lose track when they're fed billions of events, according to Artemis, or they flag harmless but odd activity as an attack. Artemis fine-tuned Orion-1 on tasks drawn from its own security operations, including spotting suspicious patterns in log data, hunting for known attack techniques, writing new detection rules, and containing live attacks. No customer data was used during training, the company says. Artemis calls Orion-1 a "Frontier Foundation Model" but only describes this fine-tuning in its blog post, and it's unclear whether the company built on top of an existing model from another provider.

Artemis built its own benchmark to measure trust in security decisions

Artemis reports results across five tasks and tested Grok 4.7 and Kimi K3 alongside Opus 5.5 and GPT-6 Sol. The biggest gap shows up in attack reconstruction, where Orion-1 scored 80.8 compared to 58.3 for the next-best model.

Guardrails meant for attackers are blocking defenders too

AI News Without the Hype – Curated by Humans

Subscribe now