BYSS Labs · Internal tool

It reads everything.
It touches nothing.

Shadow AI no longer lives in the browser. MAIVAR takes a complete snapshot of a Windows workstation in twenty seconds, without admin rights and without writing a single byte — including the surface no antivirus looks at: what an AI assistant can launch on the machine on your behalf, from MCP servers to hooks. Then it seals, signs and anchors what it saw.

Lire ce dossier en français

It is not antivirus software, either.

Defender does its job, and does it well. MAIVAR answers the questions Defender does not ask: is protection still active, is what was found still there, has someone asked it to stop looking somewhere — and what can an assistant run here without you. It decides nothing: it records, and what it records becomes evidence that AEGIS can receive.

The business side: what shadow AI is, and how to find it on your endpoints.

Measured, not estimated

318 → 0

raw memory indicators, brought down to zero by the content engine and corroboration — the number nobody publishes

outils/mesure.py · measurement published below

13/13

canaries planted, then detected at the expected level — Run key, task, MCP server, hook, invisible instructions, fake secret, memory — and removed without leaving a trace

outils/temoins.py

20 s

a complete snapshot: seven compromise domains, without admin rights, without writing anything

python scan.py

44/44

guarantees deliberately broken, one by one (mutation tests): each time, a test fails

outils/mutations.py

Measured on a real workstation, with no paid API and no cloud. The measurement files are published as they are versioned, and the snapshot below is written by the program itself.

The brief, section by section

Nine sections: what it sees, what it does with it, what it guarantees.

Open only what is relevant to you. Each section makes sense collapsed, and every section that claims something says, in the same place, where that claim stops.

In 2026, a work machine runs things that no antivirus looks at, because they are not viruses: they are tools that an AI assistant starts for you. A line npx -y some-package in a configuration downloads and runs, with your privileges, whatever that name resolves to today — and something else tomorrow.

MCP servers, the programs the assistant launches and talks to. MAIVAR inventories them in every tool that declares any, and singles out the ones that are downloaded at every launch.
Hooks: a command executed on every event, without ever asking you. It is to an agent what a Run key is to Windows — and the ChainDrop worm used it as exactly that in August 2026.
Instruction files that an assistant reads without you opening them, and the invisible Unicode characters that can be hidden in them: an entire sentence encoded in the U+E0000 block, invisible on screen, reaches the model's context as is. MAIVAR decodes it, reports its length and its hash — and never reproduces it.
Plaintext credentials in the files an agent reads: the type and the location, never the value, not even truncated.

And the three questions Defender does not ask: is protection still active, is what was found still there, and has someone asked it to stop looking somewhere.

Where it stands

An internal tool, built with rigor you rarely see elsewhere.

A scanner that measures its own false positives and publishes the number. It plants its own canaries to prove it catches them, and removes them without leaving a trace. It deliberately breaks each of its guarantees to check that a test fails. It seals, signs and anchors every snapshot, using the standard library, validated against the RFC test vectors. It reads the agentic surface no antivirus software looks at, and neutralizes its own report against injection. Most tools in this category have none of these five traits.

It is used on one workstation, internally, and its code stays internal. What it produces is public: a real snapshot, two measurements, and this brief. The judge it reports to has its own: AEGIS Control.

A real snapshot, as MAIVAR writes it (in French)
on thirteen planted canaries, with its summaries; text
The same snapshot, machine-readable (French field names)
each finding with its evidence, its domain, its series; JSON
The false-positive measurement (in French)
318 raw indicators → 0, layer by layer, with the scanner's footprint
The true-positive measurement (in French)
13 canaries out of 13, the diff run end to end, the cleanup verified

Conversation

Want to know what an AI assistant can launch on your workstations without your knowledge? Let's talk.

Talk to us

It reads everything.It touches nothing.

Nine sections: what it sees, what it does with it, what it guarantees.

01The surface nobody looks atAn AI assistant launches programs with your privileges, with no installer, no prompt, no signature. No antivirus takes inventory of them. MAIVAR does.+

02Reading without writing, and why that is a strengthNo quarantine, deletion or repair command. That is not a gap: it is what makes its findings usable as evidence.+

03Seven independent viewsOne collector per compromise domain. Two of them pointing at the same object corroborate each other — the AEGIS rule, applied to its own findings.+

04A report that cannot be turned against youThe report will be read by an assistant. Part of what it contains comes from the machine — and so, possibly, from the attacker. So it is neutralized before it goes in.+

05The diff: what has changed since yesterday, and nothing elseA snapshot is read once. A diff is read every day. A Run key whose command changes reads in one line: command: a → b.+

06Three attestations, one boundarySealed: nothing has moved. Signed: by whom. Anchored in the AEGIS ledger: when, by a third party. All in the standard library, validated against the RFC test vectors.+

07Measured, not estimatedThe number nobody publishes: the false-positive rate of memory analysis. Then thirteen planted canaries to prove it actually catches things — and they found two blind spots before any user did.+

08What we publish, and what we keepThe results are public: a real snapshot, the two measurements, this brief. The code is internal know-how, signed and timestamped by a third party.+

09The scope, stated plainlyA Windows workstation, without admin rights, one development machine measured. What remains out of view is named in every snapshot — that is what makes the rest credible.+

An internal tool, built with rigor you rarely see elsewhere.

Want to know what an AI assistant can launch on your workstations without your knowledge? Let's talk.

It reads everything.
It touches nothing.