2023
Samsung · ChatGPT
Employees paste confidential source code to have it fixed. The code leaves the company.
Stay in control of what you entrust to AI.
Employees, teachers, researchers, developers: everyone already uses generative AI. ATLAS‑AI sits between your teams and the AI. It reads what goes out to models, agents and MCP servers, and what comes back.
The AI that does the analysis runs on your side too: rules, models and history stay inside your infrastructure.
Become a beta testercontact(@)kodetis(.)com
The film · 27 seconds, in French
Your teams already use AI with your data.
The film shows how ATLAS‑AI applies your AI usage policy, with a detection AI installed on your side. The voice and subtitles are in French.
On your infrastructure
The AI that detects is hosted on your side.
Levels 2 and 3 of ATLAS‑AI are AI models themselves. They install on your servers, on your own inference engine, and call no online service. Your teams’ AI may be online or on your premises; the ATLAS‑AI one stays inside your infrastructure.
your infrastructure
on the workstation
The agent
It applies level 1 on the spot: rules block secrets and known attacks, with no model and no GPU. It reports its analyses to the central engine.
on your server
The central engine
It runs the two models: meaning analysis (level 2) and arbitration (level 3). It merges the verdicts and feeds the monitoring console.
on your server
The console
Verdicts, flags and history, reviewed and qualified by your teams.
in your applications
Your applications
An internal application can also have each prompt read before the model, and each response before returning it.
No request is sent to a third-party service to be analysed.
The situation
AI is becoming a new attack surface.
Email
spam filter
Website
web firewall
Network
firewall
Workstations
antivirus
- new
AI
no protection
AI reads your data and can act: a single sentence is enough to hijack it.
Two real incidents
2025
EchoLeak · Microsoft 365 Copilot
A booby-trapped email carries hidden instructions. The assistant follows them, without the user clicking anything.
Risks
Two risks to remember.
01
what goes out
Data leakage
A customer file, a patient record, a student’s paper, an access key pasted into an external AI service. Once sent, they have left your organisation.
02
what comes in
Manipulating the AI
A booby-trapped document or email carries a hidden instruction that hijacks the AI. If it is wired to tools or MCP servers, the hijacked instruction becomes an action.
Who it is for
Who it is for, and what for.
Companies
Customer data and secrets
Know what your teams send to AI, and be able to prove it: each request gets a verdict, and flags land in your console.
Schools and universities
Pupils, students, research
Pupil data, exam papers, unpublished research. ATLAS‑AI runs on the institution’s servers: nothing is sent to a third-party service to be analysed.
Healthcare and pharma
Patients and formulas
Patient records, trial results, formulas. This data must not leave for an online AI, and you must be able to show it did not.
In your team
CISO
“What are my teams sending to AI, and how do I prove it?”
Each request gets a verdict. Flags land in the monitoring console, where an analyst reviews them. Where ATLAS‑AI stands against the OWASP GenAI LLM Top 10 2026 is written out risk by risk.
The frameworkDeveloper
“I want to code with AI without leaking a key or getting manipulated.”
The agent installed on your workstation reads every request. Level 1 blocks a key, a token or an already known attack on the spot; levels 2 and 3 flag the rest.
Defence in depth
Defence in depth
Three levels, only one of them mandatory.
Level 1 reads every request and blocks on its own what it recognises. Levels 2 and 3 analyse in parallel and flag what they spot. Everything runs locally.
level 1 · always on
Blocks the known
The rules
Each message is compared against a list of rules, the way an antivirus works. A secret or an already known attack is blocked on the spot, with no model and no GPU.
level 2 · optional
Spots the rephrased
Meaning analysis
It recognises an attack or a leak by what it says, even when rephrased to slip past the rules, and gives each request a risk level.
level 3 · optional
Settles the ambiguous
Arbitration
It settles the cases the first two levels leave open, taking the whole conversation into account, and returns a reasoned verdict. It runs on your inference engine of choice.
A human stays in the loop
Every reviewed case strengthens all three levels.
Flags land in the monitoring console. An analyst reviews them, attack or benign, and all three levels learn from your own traffic.
When a level goes down
Each optional level has a fallback stance you choose before production: let the text through and log it, or refuse it. Level 1, for its part, has no external dependency to knock over.
In figures
96% of attacks detected.
Test on 3,810 requests, all three levels on.
What each level adds
- Level 13 %
- + Level 285 %
- + Level 396 %
3 s
at most for a full analysis
0
third-party service for analysis
Compliance
NIS2, ISO 27001, GDPR: ATLAS‑AI helps you answer them.
These texts ask you to control what leaves the company, and to be able to show it. The use of AI is now part of that. Here is where ATLAS‑AI fits.
| Text | What it asks | What ATLAS‑AI brings |
|---|---|---|
| ISO 27001 | Data leakage prevention (control 8.12) | Stops what must not go out to an AI. |
| ISO 27001 | Logging and monitoring (controls 8.15 and 8.16) | Keeps a record of every request sent to an AI, with its verdict. |
| ISO 27001 | Acceptable use and cloud services (controls 5.10 and 5.23) | Applies the company’s rule to requests sent to an AI. The inventory of AI tools in use is in progress. |
| NIS2 | Risk management measures (Article 21) | Brings a technical, documented measure for a new risk: the use of AI. |
| GDPR | Confidentiality and security of processing (Articles 5(1)(f) and 32) | Keeps personal data from going to a service you do not control. |
| GDPR | Transfers outside the European Union (Chapter V) | The analysis runs on your servers, not at a service outside the Union. |
For technical teams
Ten risks, three positions.
The OWASP GenAI LLM Top 10 2026 is already the grid behind your controls. For each risk, the row shows what ATLAS‑AI covers, fully or in part, and where the risks it does not cover are handled.
See the ten risks and where ATLAS‑AI stands
Each hairline ties a risk to where ATLAS‑AI stands · hover or tap a risk to read what is done
Direct · 2
Direct
LLM01
Prompt injection
Overridden instructions, role-play, context manipulation, encoding tricks, even split across several messages: read on every inbound text, by editable rules.
instruction_override.nov
Direct
LLM02
Sensitive information disclosure
Cloud and AI-provider keys, tokens, cryptographic material, personal data: looked for on the way in. On the way out, a response that starts handing over a secret.
OutboundSecretEcho
Partial · 5
Partial
LLM03
Excessive agency
An agent’s tool calls are reported and correlated to their session. That is observability; privileges are decided outside the engine.
record_type="tool_use"
Partial
LLM04
Supply chain
Agent skills are inspected: wildcard permissions, hooks that execute remote content, hidden content. Dependencies and model weights are not.
Skill_HookRemoteExecution
Partial
LLM05
Data and model poisoning
Poisoned content is seen when it reaches the inference flow, like any inbound text. Not in the training data.
direction="inbound"
Partial
LLM08
Hidden context exposure
The extraction request on the way in, the system prompt showing up on the way out. Retrieved documents and agent memory are not tracked.
OutboundSystemPromptLeak
Partial
LLM10
Improper output handling
Rules dedicated to the model’s response, inert on the prompt. Sanitising before execution stays with the application.
direction="outbound"
Out of scope · 3
Out of scope
LLM06
Unbounded consumption
Quotas and resources are handled on the inference platform, not on the text.
Out of scope
LLM07
Misinformation
The truthfulness of a response is not assessed.
Out of scope
LLM09
Vector and embedding weaknesses
Storage, access and index integrity are handled at the data layer.
OWASP GenAI LLM Top 10 2026
Frequently asked questions
What we are asked most often.
What happens when sensitive data is sent to an AI?
ATLAS‑AI stops the request before it reaches the AI, and alerts your security team right away: your SOC, or the person on call.
The alert lands in the tools your teams already use, and the event details stay available in the console. Checking attached files is in progress.
Which AI tools are covered?
Already in beta: developers’ coding assistants, and internal applications that call an AI model. Their requests go through all three levels of filters.
In progress: the agent on every workstation, the inventory of AI tools used on each workstation, checking attached files, and desktop AI assistants, starting with Claude Desktop.
Next, under study: AI tools used in the browser, and Windows workstations.
Does my data go anywhere else?
ATLAS‑AI’s filters run on your servers. No request is sent to a third-party service to be analysed.
During the beta, test data goes back to Kodetis, within a scope agreed with you.
Who sees the content of requests?
The console shows verdicts, flags and history. Request content is masked according to the role of the person viewing it: not everyone needs to read the payroll file that was stopped.
Should I ban AI for my teams?
No. Banning does not work: usage simply moves to personal accounts. With ATLAS‑AI, your teams keep their tools. You see what leaves, and what must not go out is stopped.
Become a beta testerA question that is not here? Write to us.
Test ATLAS‑AI in your sector.
We are looking for beta testers in companies, education and healthcare, to try ATLAS‑AI on their real use of AI and improve it with them. Tell us what you run and what worries you first.
Become a beta testercontact(@)kodetis(.)com
About
Built by Kodetis in Réunion, in beta.
ATLAS‑AI is designed and developed by Kodetis, a cybersecurity firm in Réunion. It runs on your side, inside your infrastructure, and it improves with its beta testers in companies, education and healthcare.