Security

AI OS ships with an opt-in, AI-assisted security suite built on the open-source mythos-defense engine and semgrep. It assesses the platform itself, gates what your AI Web Studio publishes, and turns security into a deliverable for managed clients. Everything here is report-only: it surfaces findings and patch recommendations — it never auto-patches your live system.

Honest framing: this is an AI-assisted security capability, not a security guarantee, and it is OFF by default. It requires Python 3.11+, the mythos-defense CLI, and semgrep installed and enabled (see Enabling the suite). Static analysis catches many real issues but cannot prove the absence of vulnerabilities — treat it as one layer of defense, not the only one.

Platform Self-Assessment

From the operator Security dashboard, run a security assessment of the AI OS instance itself, on demand or on a schedule. Two modes:

• Quick scan — a STRIDE threat-model plus a dependency audit. Read-only, fast, no source-code patching.
• Deep scan — the full loop: STRIDE threat-model → semgrep static analysis → an AI blue-team review that proposes fixes → verification. The deep scan runs against a disposable filtered copy of the source, so the live tree is never touched; it returns findings and patch recommendations only.

CRITICAL/HIGH findings raise an operator notification. Results are kept in a scan history you can review, with per-finding severity, location, and CWE references.

Web Studio Publish Gate

Every site your AI Web Studio publishes — generated or imported — is security-scanned (semgrep, read-only) before it goes live. The gate has three modes:

Mode	Behavior
off	No scan on publish (default).
warn	Scan and surface findings on the site record, but allow the publish.
block	Refuse to deploy a site with error-severity findings until they are resolved.

Every path that deploys a site — the publish button, content edits, rebuilds, and AI regenerations — routes through a single gated chokepoint, so nothing reaches a live domain unchecked. The gate fails open: if the scanner is unavailable, publishing proceeds rather than being blocked by tooling, and the unavailability is surfaced rather than reported as “clean.”

Managed-Client Security Service

For Managed Website clients, security becomes a deliverable. From the CRM, run a security assessment across a client's sites; the result is recorded as a CRM activity on the client's record and surfaced in the client's own “Site Security” workspace view — an owner-scoped, read-only report of each managed site's latest scan and findings.

How it works

AI OS drives the security engine through a constrained subprocess bridge:

• semgrep performs the fast, deterministic static analysis (the publish gate and per-site scans use it directly — no AI cost, seconds not minutes).
• mythos-defense performs the deeper AI loop for the platform deep-scan: an architect builds the STRIDE threat-model, semgrep red-teams the code, and an AI blue-team proposes fixes, which are then verified.
• The bridge runs each tool with explicit binary paths, output caps, and timeouts, and passes your Anthropic key from settings — the deep AI scan uses your own model budget.

Safety model

The suite is designed to be safe to run against a production platform:

• Report-only. Findings and patch recommendations are surfaced; nothing is applied to the live system automatically.
• Deep scans run on a disposable copy. The AI loop that can propose in-place patches is pointed at a filtered, throwaway snapshot of the source — never the live tree, which is left untouched.
• Static analysis is read-only. semgrep never modifies the files it scans.
• Operator-gated. The Security dashboard and scan APIs are admin-only; the managed-client report a client sees is strictly scoped to their own sites.

Enabling the suite

The suite is off until you install its prerequisites and turn it on. On the server:

1. Install Python 3.11+, then the mythos-defense CLI and semgrep (a shared virtualenv readable by the service user works well).
2. Set the binary paths and enable in your environment:
   • AIOS_MYTHOS_ENABLED=true
   • AIOS_MYTHOS_BIN / AIOS_SEMGREP_BIN — absolute paths to the installed binaries
3. Opt into the individual layers as desired:
   • AIOS_SECURITY_GATE_PUBLISH=warn (or block) — the Web Studio publish gate
   • AIOS_SECURITY_SCAN_ENABLED=true — the scheduled platform self-scan
4. Restart. The Security dashboard will show mythos ready when everything is wired.

The deep AI scan and threat-model use your Anthropic API key; the semgrep-based publish gate and per-site scans need no AI key. semgrep loads its rulesets from its registry, so the server needs outbound access to it — if rules can't load, scans report unavailable (and the gate fails open) rather than a false “clean.”

Frequently asked questions

Does the suite ever change my live system automatically?

No. The suite is report-only. The deep AI scan that can propose code fixes runs against a disposable copy of the source — never the live tree — and static analysis is read-only. You decide what, if anything, to apply.

Is it on by default?

No. It is off by default and requires Python 3.11+, the open-source mythos-defense CLI, and semgrep installed and enabled.

Is it a security guarantee?

No. It is an AI-assisted security capability, not a guarantee. Static analysis catches many real issues but cannot prove the absence of vulnerabilities — treat it as one strong layer of defense, not the only one.

Do I need an API key?

The semgrep-based publish gate and per-site scans need no AI key. The deep AI assessment and threat-model use your own Anthropic key, in keeping with AI OS's BYOK model.