Autonomous Threat Cognition: On-Device Language-Model Reasoning for Endpoint Threat Interpretation

Abstract

Autonomous Threat Cognition (ATC) is the application of on-device language-model reasoning to security telemetry at the endpoint, executed locally within the security agent immediately after a detection fires. Rather than exfiltrating telemetry to cloud inference, ATC keeps reasoning co-located with the data, enabling threat interpretation in sovereign, air-gapped, and regulated environments where data cannot leave the host. This paper defines ATC, introduces the ATC Capability Model (a six-level spectrum, ATC-0 through ATC-5, that separates threat interpretation from response authority), and presents Nebula Sentinel, an open Rust reference implementation. A central design principle runs throughout: model output is treated as advisory enrichment that modulates confidence within bounded limits, never as an authority that governs response actions. Response remains deterministic, mode-gated, and reversible by design; reasoning-driven autonomous response is built but deliberately disabled pending the safety conditions the paper enumerates. The work also introduces GOSSIP, a decentralized protocol for propagating indicators of compromise across an agent fleet while gating executable detection rules behind human review. The paper reports operational findings from months of development and testing — including the compute and energy cost of sustained on-device inference — and is explicit about scope: it establishes architectural viability and a working, honestly-bounded implementation rather than a controlled empirical evaluation. Its contribution is to name, formalize, and demonstrate on-device threat cognition, and to argue that the responsible level of autonomy in security systems is the one their components can be shown to support.