---
title: "A 24/7 security \"night watch\" with a skeptic agent on top"
date: 2026-10-26
url: "https://morningtokens.com/workflows/a-24-7-security-night-watch/"
source: "https://x.com/joelhooks/status/2114410421226557534"
issue: "https://morningtokens.com/issues/2026-10-26/"
---

# A 24/7 security "night watch" with a skeptic agent on top

## How does this AI workflow work?

- **Replaces:** manual security sweeps of your own code, configs, git history and logs, plus sorting real findings from noise by hand.
- **What to connect:**
  - A cheap always-on scanner model (here an abliterated GLM-5.3-flash on two DGX Sparks).
  - A stronger cloud model as the reviewer (GPT-6.1 Sol).
  - Pi agent sessions in Herdr terminal panes, a mailbox between agents (Rat King on AT Protocol), and Tailscale for phone access.
- **How it works:** read-only on code, own hosts only, rate-limited, never prints secrets. Money, outside messages, deploys, live credentials and customer data always go to the human.
- **Results:** in the first 36-hour sweep the local scanner filed **106** candidate findings.
  - A stronger "security desk" agent tried to reproduce each one, killed **51** and routed **57** to the owning projects as patch requests with evidence and a suggested fix.
- **Who it's for:** small teams or solo operators running several apps or a fleet of agents who want continuous security review without reading every false positive.

Source: https://x.com/joelhooks/status/2114410421226557534

From the Morning Tokens issue of 2026-10-26: https://morningtokens.com/issues/2026-10-26/