A 24/7 security "night watch" with a skeptic agent on top
Published
How does this AI workflow work?
- Replaces: manual security sweeps of your own code, configs, git history and logs, plus sorting real findings from noise by hand.
- What to connect:
- A cheap always-on scanner model (here an abliterated GLM-5.3-flash on two DGX Sparks).
- A stronger cloud model as the reviewer (GPT-6.1 Sol).
- Pi agent sessions in Herdr terminal panes, a mailbox between agents (Rat King on AT Protocol), and Tailscale for phone access.
- How it works: read-only on code, own hosts only, rate-limited, never prints secrets. Money, outside messages, deploys, live credentials and customer data always go to the human.
- Results: in the first 36-hour sweep the local scanner filed 106 candidate findings.
- A stronger "security desk" agent tried to reproduce each one, killed 51 and routed 57 to the owning projects as patch requests with evidence and a suggested fix.
- Who it's for: small teams or solo operators running several apps or a fleet of agents who want continuous security review without reading every false positive.
From the Morning Tokens issue of Oct 26, 2026