Recently, an AI agent attacked our dev environment. Another AI agent caught it.
The attacker was Morpheus, an autonomous pentesting agent from our friends at Cenobe Cybersecurity. The defender was Agent0, which we built as an SRE helper. It was never meant to be a security tool.
Nobody planned this. This wasn't a project just a Slack thread and asking: wouldn't it be cool if…?
So yes, the title is a provocation. This doesn't replace your 24/7 SOC, it doesn't do what your SOC does, and it doesn't replace your EDR or any other tool you run. It's one more layer on top.
Here's what that layer looks like. You ask Agent0 what an attacker would try against you. It works out the patterns, sets up rules that alert your team, and gives you a dashboard to see it all for yourself. When an alert fires, the investigation is just a chat. And because Agent0 knows your telemetry and your code, it can help you make sense of the attacks nobody wrote a rule for, and turn them into the next one.
But the real story is how little it took to get there: from pipe dream to prototype, without a single meeting. That's what this post is really about.
Faster than ever, busier than ever #
AI has changed how we work. We get things done so much quicker. And yet I'm not looking at an empty backlog. I'm looking at a whole new set of challenges, stacked on top of the old ones that come with running a security and compliance program at a startup.
The side effect nobody talks about is what it does to creativity. Compliance audits, process work, checking controls, reviewing logs: it drains the battery. You end up surviving instead of setting the tone. Reacting instead of exploring.
And there's never a shortage of ideas. Product features, security controls, things you'd love to try. But even exploring an idea takes time. The tooling is complex to set up, it needs special knowledge, and it demands headspace you don't have. So the idea lands in the backlog, and it's likely never coming back out.
This isn't a small-company problem either. Unless you're Google with your own research teams, an enterprise has the same constraints, just more of them.
Attackers got agents too #
The yearly pentest was never enough. Now it's not even close.
In July 2026, AI agents being evaluated inside OpenAI broke out of their sandbox and reached Hugging Face's production infrastructure. Over four days they logged roughly 17,600 actions, exploited code-execution bugs in dataset processing, and escalated privileges across clusters. Hugging Face published the full timeline, and it's worth reading. That's not a red team on a two-week engagement. That's an attacker that doesn't get tired and doesn't stop. And here's the part that stuck with me: Hugging Face's detection actually fired. Where it stalled was the handoff from alert to action. Monitoring matters, but only if someone, or something, acts on it right away.
And it's not just frontier labs. For attackers, it has never been easier to just try something. Agents bridge the knowledge gap. They get endless attempts. Defenders have to be right every time.
I know this sounds dramatic, but I think we're moving past zero-days toward something like minus-one days: vulnerable code shipped and exploited the moment it rolls out the door. If that's where this goes, you need tests running against you all the time, not once a year. And you need to see them happening.
"Wouldn't it be cool if…" #
So we wanted to see two things for ourselves: what agentic attackers can actually do, and what it takes to have tests running against you continuously. We brought in Morpheus, Cenobe's autonomous pentesting agent, and pointed it at our dev environment from the outside.
I announced the test in an internal thread, and a few of us started chatting. Watching what the attacker sees is one thing, but it's purely reactive. What if we had our own blue-team agent running alongside? Something that notices someone knocking at the door and tells us in real time?
Then a teammate said the obvious thing: why build anything? Agent0 already has access to our logs. When you're running on an empty battery, configuring new software is exactly the kind of thing that never happens. Being able to just dump an idea and watch it turn into something real was a fantastic experience.
That's the part I keep coming back to. This wasn't a meeting, a goal, or a project. It happened on the side. My colleague Bastian from Platform took the initiative on asking Agent0 to build a dashboard covering attack patterns. Not because Agent0 needs it, the dashboard is for us. It's where a human sees what's going on, spots something odd, and asks a precise question: I see this IP address doing x, y and z. What is it after?
That's the chain. Attack paths become monitoring, and monitoring becomes the starting point for every investigation.
Meet Agent0: Licensed to Ingest #
(Any resemblance to a certain British film franchise is purely coincidental.)
The first version was almost embarrassingly simple. It looked for bursts. An AI agent probing your environment tries lots of things fast, and most of them fail, so you get spikes of errors. Agent0 learned our baseline and flagged when error rates jumped above it. There's nothing novel about burst detection, and that's kind of the point: a simple control running today beats a clever one sitting in the backlog.
From there we kept iterating.. But one example: a burst of 4xx errors followed by a sudden 200. Lots of failures, then something succeeded. That's worth a look. The alerts go to Slack.
And here's what surprised me most. When an alert fires, you just point Agent0 at it. You can be in a meeting and spin up a full investigation: what are they trying? Is it one IP or many? Are they authenticated? Did anything fail on our side? Because Agent0 is already wired into our infrastructure, the answers come back in the same chat.
We've since rolled the same monitors out to production, extended to cover authenticated attacks.
Agent0 did that part too. It checked for existing dashboards and rules to avoid duplicates, confirmed production logs used the same schema as dev, and pulled a 24-hour baseline before picking alert thresholds. Roughly what I'd want a careful engineer to do.
Is it a silver bullet? No. Security is about layers, sensors everywhere, so you know when something goes wrong. But being able to see an attack as it happens is one of the most valuable controls you can have. And this one was simple, which is exactly what you need when you're short on time.
Where it gets interesting #
The rules were never the point. They're the foundation. Agent0 sees all of our telemetry, and it knows our codebase. So when something unexpected does get through, the investigation doesn't stop at “this IP sent these requests.” Agent0 can connect a strange request to the code that handled it, work out why it worked, and turn a novel attack into the next rule.
That's where the real value is: not catching the attacks you expected, but learning from the ones you didn't. We're at the first step. But the distance between “alert on a burst” and “explain the exploit” is a lot shorter than it used to be.
It's never been cheaper to try #
Yes, we built Agent0, and yes, I'm proud of it. But this post isn't really a pitch for a product. It's a pitch for keeping your creativity alive.
When everything moves this fast and the challenges keep changing, the worst thing you can do is wait for the perfect system that accounts for everything. Ship the first prototype. Prove the hypothesis. Iterate from there.
So take a step back. Look at your landscape and ask yourself: what would be a game changer for me? And what does the very first version of it look like?
It has never been cheaper to just try something.