Once attacks are automated with AI, defense needs the same level of automation. Chitos is a sovereignty-first security audit engine: it probes the same checklists an attacker would use, verifies each finding once more with AI, and is designed so that a customer's code and data never leave their own network.

Why an AI security audit now

In autumn 2026, seven financial institutions in Korea were breached by a single open-source AI penetration tool, and roughly 65,000 customer records were exfiltrated. The attack path was not exotic: SQL injection in a peripheral web application, authentication bypass, and bulk personal-data harvesting through sequential record access. What changed was speed and autonomy. Once an attack runs itself, the defense has to run itself too.

That is the question Chitos starts from.

The three layers of Chitos

Chitos is not a single scanner. It works in three layers.

Autonomous audit agent: it reads the reconnaissance output and forms its own audit hypotheses.…