About

We're quietly building detection for the next generation of subtle attacks; think xzutils, but spiked with AI nightmare-fuel.

We've built a factory that continuously mints locally-runnable AI models based on the latest attacks and research articles: cleave extracts capabilities, azoth classifies them, and scan is our local scanning tool. Analysis runs on your hardware with no cloud scanner or API key; bundles and referenced artifacts can be fetched when you want current, supply-chain-aware results. Everything is Apache 2.0.

News

• 2026-08-05 Precompiled binaries and a one-line installer Atomdrift Scan now ships prebuilt binaries for eight Linux architectures, macOS, the BSDs, Solaris/illumos, Android, and Windows — with a new installer at install.atomdrift.org that verifies what it downloads before it replaces anything. Testers welcome.
• 2026-08-04 cleave & Scan v2.5.0: quiet failures get loud, and cleave lands on Windows Files that used to produce no verdict at all — a truncated archive, a half-written gzip, a member that failed to scan — now say so. Plus ISO analysis, verified Mach-O signatures, five seconds off every cold start, and first builds for Windows, DragonFlyBSD, NetBSD, illumos/OmniOS and Solaris 11.4.

All news →

Projects

• scan stable
  ClamAV-style local scanner for AI-powered malware detection. Runs azoth and other open models against capabilities extracted by cleave — across binaries, scripts, and source.
• azoth stable
  Open ONNX model bundle for general malware detection. A routed ensemble over cleave-extracted capabilities across more than 100 recognized file and container types; runs on CPU.
• cleave stable
  Static analysis and capability extraction for source, binaries, bytecode, packages, archives, documents, and deployment configuration.
• stng stable
  Modern string extraction for binary analysis — all of the good stuff, none of the garbage. Useful for initial triage, C2 enumeration, credential extraction, and signature development.
• filefacts stable
  Rust library that reads a file and returns ML-ready facts for security pipelines — package identity, binary provenance, source AST features, strings, symbols, metrics, and structured errors in one cached parse.
• c.diff DESIGN PHASE
  Context-driven molecular drift detection. Tracks how code atoms shift across versions and dependencies.