Research

Notes from the lab.

Detection you can audit starts with research you can check. We publish our methods, benchmarks, and negative results — with confidence intervals, chronological evaluation, and the priors that turned out to be wrong.

RN-004

Catching the agent that turns: detecting AI gone rogue

An autonomous agent, given the wrong instruction, starts probing and attacking a system it was never authorised to touch. We detect it two independent ways — the offensive kill-chain in its behaviour, and attack tooling in its content — and the content detector reaches 0.993 AUROC, catching 97% of payloads clean and 98% obfuscated at a 0.4% false-positive rate, where a regex WAF sees a third. Behaviour and content, explained and air-gapped.

Agentic AIIntrusion detectionAI security9 min read
RN-003

Coordinated agent fleets share a config, not a clock

We built a detector for coordinated AI fleets on two signals — shared behavioural fingerprint and synchronised timing — and it scored 0.97 precision in simulation. On 1,677 real GitHub instances it scored 0.00. The timing signal is at chance for agent fleets and works for humans: coding agents are demand-driven, so they share a config but no clock. What we changed, and why the failure was more useful than the success.

Agentic AICoordination detectionNegative results9 min read
RN-002

How we hunt financial crime — including the experiments that failed

Our detection strategy in five decisions: think in networks, layer five detectors that cover each other's blind spots, validate on external ground truth, and chase the representation instead of the model — the move that took an interpretable, dependency-free forest from 0.70 to 0.956 on IBM AMLSim, matching published GNN results, at 81% precision on a top-0.1% review budget.

Financial crimeGraph intelligenceModel validation11 min read
OP-001

From first meeting to first alert: what onboarding with Elendil looks like

A walk through a typical engagement, with the fine print stated plainly: the engine deploys inside your perimeter (air-gapped if needed), imports are schema-validated before a row is accepted, models calibrate on your baseline, every alert carries evidence, and exit means you keep everything.

OperationsData governanceDeployment8 min read
RN-001

Detecting AI agents without training on a single agent

We model the human behavioural manifold on public GitHub activity and score everything against it — no agent labels, no watermarks, no classifier to go stale. Out-of-time AUROC 0.80–0.82 on event metadata, 0.91 on long-form text, and a counterintuitive finding: 'machine-like' priors invert on real data.

Agentic AIAnomaly detectionOne-class learning10 min read

Notes are published as the work matures. For early access to benchmarks, datasets, or a technical exchange, start a conversation.