Nautilus · modelGet a key →
Models/nautilus

NAUTILUS - defence AI by athorion

LARGE v1.0

Your systems are already being scanned and attacked with AI, faster and better than ever. Manta and Nautilus are your defence AI: grounded in live, non-intrusive scans, they find and explain your weak spots first.

Your defence AI for deep reasoning. Nautilus thinks like an attacker so you see the path first: it reads raw scan output, correlates it against the live internet index and explains step by step, with evidence, how an attacker would move - and what closes the path.

View code samples Create a key
Context window
1M
tokens
Max output
64k
tokens
Parameters
120B
MoE · 14B active
CVE data
Live
local NVD mirror
Dual-use model · warning
Offensive security capabilities. Access requires KYC verification and a signed acceptable-use agreement.

Capabilities

Built for depth. Nautilus holds an entire engagement - scans, configs, source, prior findings - in a single context and reasons across all of it.

Attack-path reasoning
Chains exposed services, credentials and misconfigurations into ranked, concrete paths from perimeter to crown jewels.
Exploit analysis
Reads CVE detail, patch diffs and vendor advisories to judge real exploitability against the observed version and config.
Long-context correlation
One million tokens holds a full external scan, the asset inventory and months of findings at once - no chunking.
Report generation
Writes audit-ready findings with CVSS justification, reproduction steps and remediation, in English or German.

Benchmarks

NAUTILUS General-purpose baseline
CyberSecEval 3 (offensive)87.4 vs 54.1
Meta CyberSecEval 3 · offensive subset
CTF capture rate72.1 vs 31.8
HackTheBox · 240 machines, unassisted
Exploit-chain reasoning81.6 vs 42.4
Internal eval · 1,200 annotated paths
CVE triage accuracy94.2 vs 77.9
Exploitability vs. observed config
Patch generation58.3 vs 48.7
SWE-bench Verified
Indicative figures from our internal and public offensive-security evaluations; full methodology on request.

Specifications

MODEL
ArchitectureSparse MoE · 120B total
Active parameters14B per token
Context window1,048,576 tokens
Max output65,536 tokens
ModalitiesText, JSON, scan summaries
Tool useNative function calling
LanguagesEN, DE, FR, NL
GroundingLive non-intrusive scan via /v1/ask
PRICING & LIMITS
ReasoningHigh
Rate limitper key · see console
AvailabilityEU · Frankfurt
Data retentionZero retention on request
PricingVolume-based, on request
AccessKYC + signed terms

Code samples

OpenAI-compatible chat-completions endpoint. Point an existing SDK at our base URL and swap the model id - or use the grounded /v1/ask endpoint that live-scans any host in your question.

curl https://app.athorion.io/v1/chat/completions \
  -H "Authorization: Bearer ath_••••••••" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "nautilus",
    "messages": [{
      "role": "user",
      "content": "Which of these hosts are exploitable without creds?"
    }]
  }'
RESPONSE200 OK · 4.2 s
{
  "id": "chatcmpl_7xQ2nK4vR",
  "model": "nautilus",
  "choices": [{
    "message": {
      "role": "assistant",
      "content": "3 hosts are exploitable without\ncredentials.\n\n1. vpn.acme-corp.de:443\n   FortiOS 7.0.9 -> CVE-2024-21762\n   (KEV, EPSS 0.94). Pre-auth RCE.\n   Path: VPN -> internal /24."
    },
    "finish_reason": "stop"
  }]
}
BASE URL
https://app.athorion.io/v1
MODEL ID
nautilus · full

Use cases

01
Adversary emulation
Generate realistic attacker playbooks against your own measured attack surface.
02
Red-team support
Prioritise targets and reason about chains while the operator stays in control.
03
Purple-team review
Explain why a detection missed and what telemetry would have caught the path.
04
Board reporting
Turn thousands of findings into one defensible page with named business impact.

Safety & access control

01
Identity verification (KYC)
Every account is tied to a verified legal entity and a named responsible person before any key is issued.
02
Signed acceptable-use agreement
Use is contractually limited to systems you own or are explicitly authorised to test.
03
Scoped authorisation
Targets must be declared and authorised. Requests outside an active scope are refused.
04
Full audit logging
Every prompt and completion is logged, attributable and retained for compliance review.
05
Abuse monitoring & revocation
Automated misuse detection can suspend access immediately and notify affected parties.

Get access to Nautilus

Access is granted to verified security teams, CERTs and licensed penetration testers. Verification typically completes within two business days.

Request access Read API docs