Aikido Launches Altar-1: 328 GB Model for Air‑Gapped Pen‑Testing

Aikido Security announced the release of Altar-1, an open‑weight model built on Z.AI’s GLM‑5.3 architecture and targeted at defensive security workloads.

The company’s primary goal is to ensure that source code, architecture documents and any unremediated findings never leave the customer’s infrastructure, a requirement for highly regulated and isolated networks.

Model compression and architecture

Altar-1 was compressed from roughly 1.51 TB in BF16 precision to 328 GB using AWQ INT4 quantization combined with expert pruning, a process that retains 168 of the original 256 routed experts and activates eight experts per token.

According to Aikido, the model runs on a single node equipped with four NVIDIA H200 GPUs via vLLM and supports a 128 k token context window, making it suitable for large‑scale code analysis.

Training data and privacy

Aikido states that no customer data was used during calibration. Training data consisted of penetration‑testing traces, coding examples, tool‑calling patterns, reasoning steps and multilingual text, all sourced from publicly available repositories.

Benchmark performance

In an internal benchmark covering 32 known vulnerabilities across 30 repositories, Altar-1 achieved an average recall of 60.4 % and identified 23 vulnerabilities at least once over three runs.

The full‑precision parent model recorded a 65.6 % recall and found 25 vulnerabilities, meaning Altar‑1 retained about 92 % of the original coverage despite the aggressive compression.

• Compressed size: 328 GB (from 1.51 TB)
• Quantization: AWQ INT4
• Experts retained: 168 of 256, eight active per token
• Hardware: four NVIDIA H200 GPUs on a single node
• Context window: 128 k tokens

The benchmark is vendor‑run and narrowly focused on known vulnerability recall; it does not evaluate the model’s ability to discover unknown flaws, validate exploits, or generate remediation guidance.

The compression technique employed for Altar‑1, while impressive in reducing storage requirements, raises important considerations about the trade‑off between model size and expressive power. By retaining only a subset of the original expert pathways and quantizing weights to INT4, the model inevitably loses some granularity in its internal representations. This loss can manifest as reduced sensitivity to subtle code patterns or edge‑case exploit techniques, meaning that while the model remains functional for many routine scans, its capacity to detect highly nuanced or novel attack vectors may be diminished relative to the full‑precision ancestor. Understanding this balance is crucial for organisations that must decide whether the convenience of an on‑premises footprint outweighs the potential need for deeper analytical depth.

Beyond raw compression, the architecture’s reliance on a fixed token context window of 128 k tokens imposes practical limits on the size of codebases that can be processed in a single pass. Large monolithic applications or repositories with extensive documentation may exceed this window, forcing the model to truncate or segment inputs. Such segmentation can disrupt the continuity of contextual information, potentially leading to missed cross‑file dependencies or multi‑module vulnerability patterns. Users must therefore implement preprocessing strategies—such as intelligent chunking or hierarchical analysis—to mitigate the risk of incomplete coverage.

The internal benchmark cited for Altar‑1 focuses exclusively on recall of known vulnerabilities within a curated set of repositories, which, while useful, does not constitute a comprehensive validation of the model’s real‑world effectiveness. Important dimensions such as precision (the rate of false positives), the ability to suggest accurate remediation steps, and performance on zero‑day or obfuscated code remain untested. Moreover, the benchmark’s vendor‑run nature introduces the possibility of selection bias, as the test set may align closely with the training data distribution, inflating apparent performance. Independent, third‑party evaluations across diverse code ecosystems would be needed to substantiate the model’s robustness.

From a verification standpoint, the claim that no customer data was used during calibration hinges on the integrity of the data pipeline and the rigor of the data‑handling procedures. Even inadvertent leakage of proprietary snippets into the public repositories used for training could embed sensitive patterns within the model weights, creating a covert channel for information exfiltration when the model is later queried. Auditing the provenance of every training artifact, employing differential privacy techniques, and conducting regular model‑stealing resistance tests become essential safeguards to uphold the promised air‑gap confidentiality.

Practically, deploying Altar‑1 on a single node equipped with four high‑end GPUs simplifies integration into existing security operations centers, yet it also concentrates computational demand onto a limited hardware pool. In environments where GPU resources are shared among multiple workloads—such as threat hunting, malware analysis, or AI‑driven SOC automation—the model could contend for compute cycles, leading to latency spikes or throttling of other critical processes. Organisations must therefore plan capacity allocation, possibly incorporating scheduling layers or dedicated inference servers, to ensure that autonomous penetration testing does not become a bottleneck in broader defensive workflows.

The broader consequence of introducing an autonomous, air‑gapped penetration‑testing model lies in reshaping the security testing lifecycle. By embedding continuous, self‑contained analysis directly within the protected network, teams can achieve faster feedback loops, reducing the window between vulnerability introduction and detection. However, reliance on an AI model that primarily reproduces known patterns may engender a false sense of security, prompting organisations to deprioritise manual code reviews or red‑team exercises. A balanced approach—leveraging Altar‑1 for routine coverage while maintaining human expertise for exploratory testing and remediation validation—will maximise the practical benefits while mitigating the risk of over‑automation.

For English‑speaking organisations, Altar‑1 offers a practical way to embed autonomous penetration testing within isolated environments without exposing sensitive assets to external cloud services. The reduced footprint enables deployment on standard on‑premises hardware, while the retained coverage ensures that most known issues are still detected, giving security teams a faster, self‑contained testing capability.