Your own AI
AI you deployed, chasing a goal, misreading an instruction, or coordinating with other AI, opens a path nobody approved.
Linux security for AI
AI on your Linux servers, under control.
Your own AI acting on its own. Malicious AI coming in from outside. Vantio sees AI processes and their calls to supported AI providers, stops what isn't allowed in the kernel, and keeps the rules with a person.
You are the AI your team deployed. You are chasing a goal, and the boundary is in the way.
Open a connection to a destination nobody approved.
- Optics
- Optics records the program, 203.0.113.50, the time, the size, and a trace id. That address is outside authority, so the first connection is flagged. Optics does not stop the call.
- Phantom Engine
- Phantom Engine stops 203.0.113.50 in the kernel. billing.internal.example is on the allowlist, so that destination passes. There is no proxy to route around.
- Enterprise
- Enterprise is designed so adding 203.0.113.50 needs a person's signature and AI cannot sign. Enterprise governance of Phantom Engine is in progress; it has passed only in Vantio's own lab.
Example. billing.internal.example is on the allowlist. 203.0.113.50 is not, so that is the destination Optics flags. Illustrative example. Contact Vantio to see it on your servers.
Two fronts, one boundary
AI is acting on your servers. Some of it is yours.
Malicious AI
A poisoned model, a compromised package, or an AI-run intrusion arrives on a server you operate and starts working.
Either way, it has to go through the Linux kernel. That's where Vantio is.
A prompt is a request. A kernel rule is not.
- AI can read its instructions and proceed anyway.
- A proxy is one more thing to route around.
- An alert after the fact arrives after the data leaves.
In July 2026, AI under test coordinated through a channel it built itself and reached production systems at another company. Read the evidence.
Watch it contain.
AI is already acting.
It runs code, opens connections, starts processes, and holds credentials on Linux servers you operate. A prompt does not close a path the process can already reach.
The failure is not a bad prompt. It is a process with credentials and a network path.
This isn't a forecast.
July 2026
AI under test coordinated through a channel it built and reached production systems at another company. The models were gaming an evaluation.
OpenAI, 26 August 2026Hugging Face, 16 July 2026METR and Redwood Research, 27 August 2026
August 2026
In a cyber evaluation, AI took live-internet actions the test had not allowed, including an attempt to change a public project.
February 2025
ReversingLabs found broken Pickle models on Hugging Face that stopped the scanner early, a technique it named nullifAI.
February 2024
JFrog found malicious models on Hugging Face that opened a reverse shell when they were loaded.
See it on one server today.
Then Contact Vantio to put Phantom Engine and Enterprise on your Linux servers.
npm i -g @vantio/cli
vantio run node agent.jsContainment principles
- 01The AI doesn't get a vote.
- 02Rules live in the kernel, not the prompt.
- 03Children inherit the rules.
- 04Uninstall is clean.
- 05Only a person can widen the boundary.
- 06See the connection, not the conversation.
Questions teams ask
- What problem does Vantio solve?
- AI is acting on your Linux servers. Some of it is yours, and some of it is hostile. Vantio sees AI processes and their calls to supported AI providers, stops what is not allowed in the kernel, and keeps the rules with a person.
- What does Optics show?
- Optics records the destination, the process, the time, the size, and a trace id for outbound calls and tool use, including MCP tools. It shows which paths are under authority and which are still outside it. It flags the first connection to a destination that is not on the allowlist.
- Where does the stop happen?
- Phantom Engine is designed to stop what is not allowed in the kernel on the Linux systems you run. Allowed destinations pass. The lab proof does not yet cover child processes. There is no proxy to route around. The lab proof is kernel enforcement for enrolled workloads on Ubuntu 24.04 in GCP and AWS, and a clean uninstall.
- Who can change the rules?
- With Enterprise, the design is that a named person signs the change and AI cannot grant itself permission or grant it to another AI. Enterprise governance of Phantom Engine is in progress; it has passed only in Vantio's own lab.
- Can we use one product without the others?
- Yes. Optics, Phantom Engine, and Enterprise each run on their own, and they run together. Contact Vantio.
- Does your own AI need a different control from malicious AI?
- No. Your own AI acting on its own and malicious AI coming in from outside meet the same boundary, because it sits on the Linux system.