Threat intelligence for the AI ecosystem
Detect, investigate, and hunt attacks on the AI systems you run and depend on.
30-min call · see how it works
We track threats across these AI models, agents, and frameworks
AI is now part of the attack surface
Teams are deploying agents and automated workflows faster than security can keep track of them, and attackers are already using that gap.
Agents act with insider access
They hold credentials, query databases, call internal APIs, and run business workflows with the access of a trusted employee, but without the judgment or oversight that comes with one.
Prompts can carry the attack
A crafted prompt, injected directly or planted in content the agent reads, can change its decisions, leak sensitive data, or trigger unsafe actions. We track these as Indicators of Prompt Compromise (IoPCs).
The AI supply chain is unverified
Every model, dataset, package, plugin, skill, and MCP server you pull in is a new trust boundary, and most ship with no provenance, no signing, and no way to verify what they do.
Existing security has a blind spot
Traditional threat intelligence tracks malware, phishing, domains, IPs, and vulnerabilities. It doesn't track malicious prompts, compromised MCP servers, poisoned models, rogue plugins, AI agents, or AI supply-chain abuse.
| Traditional Intelligence | AI Threat Intelligence |
|---|---|
| Malware | Malicious AI tools & packages |
| Threat actors | AI attack campaigns |
| Domains | Rogue MCP servers & malicious skills |
| Software supply chain | Models, datasets & plugins |
| Infrastructure | AI infrastructure exposure |
| Applications | AI agents & autonomous workflows |
| Exploits | Prompt injection techniques |
| Initial access | Compromised identities & API keys |
| IOC feeds | IoPC feeds |
| TTPs | Adversarial AI techniques |
AI Threat Intelligence is the collection, analysis, and operational use of intelligence about threats targeting, abusing, or compromising AI systems.
Our products
NovaHunting watches the AI agents you run. Proximity maps the AI infrastructure attackers deploy.
- Learn more
NovaHunting
Monitor AI agents for adversarial activity
Continuously monitor AI agents, models, prompts, and workflows to detect adversarial behavior, prompt injection, jailbreaks, IoPCs, and other signs of compromise.
Best for: Security teams operating AI in production.
- Learn more
Proximity
Hunt the AI ecosystem
The search engine for AI threat intelligence. Discover MCP servers, AI tools, prompts, models, datasets, plugins, and other AI assets across the public ecosystem.
Best for: CTI teams tracking the AI threat landscape.
turns research into detection
Research
We investigate adversarial AI, malicious tools, prompt attacks, and emerging attack techniques.
Intelligence
Each finding becomes detection rules, IoPCs, and hunting content that we keep up to date.
Detect & Respond
Our products use that intelligence to detect attacks on your AI systems, so you can investigate and respond before compromise.
Built by a threat researcher
SecurityBreak was founded by Thomas Roccia, who spent 15+ years in threat intelligence at McAfee and Microsoft before focusing on AI threats in 2022.
- Visual Threat IntelligenceAuthor of the illustrated guide for threat researchers
- NOVAOpen-source framework for hunting adversarial prompts
- PromptIntel & UnprotectOpen databases of prompt attacks and malware evasion techniques
Research presented at
- Black Hat
- DEF CON
- SANS
- BSides
- AUSCERT
- AISA
- SLEUTHCON