Cybersecurity with AI agents_

I have spent a long year building with AI agents alongside me, and now that enough time has passed I can look back and say what really changed and what still costs me the same. I am not here to say AI changes everything, anyone says that already, I am here to tell what I measured in my own projects, which is the only thing I can talk about without making anything up.

Where Talos came from#

Talos is a hardening audit tool (hardening being the process of leaving a server with the smallest possible attack surface) that audits Linux and Windows and finishes a full server in under ten seconds. It carries 147 checks written as data files, each with its severity, its weight and the Spanish ENS controls it covers, and it only reads, it never touches anything on the server it scans. It came out of a larger platform and I released it separately because it stood on its own.

What the agent did there was the volume. The 147 checks are 147 files almost identical to each other, same skeleton and different data, and writing that by hand is the most tedious thing there is. The judgement of what each one checks, what weight it carries and which ENS control I map it to, that I put in myself, because that is what makes the tool worth anything. The agent fills the mould, I decide what the mould is.

The Metabase weekend#

Metabase published a maximum-score advisory in August 2026, GHSA-vwf4-m7j8-wcjf, and the advisory did not explain the mechanism, it gave two sentences and a signature to search logs for. It looked like the perfect weekend plan, so I set up three Docker containers, two vulnerable versions and one patched, to compare identical requests and see which ran something the other did not.

I started with the wrong version because I misread the affected range, and I lost the whole of Saturday afternoon before I noticed. When I dropped to the right tag, the flaw showed up by comparing the two instances: the vulnerable one ran a query with a value I had not put anywhere. With fifteen euros on OpenRouter I orchestrated six models at once, some decompiling four versions because Metabase pulled the source from the recent ones, others running queries, and me watching logs and discarding hypotheses. It took over fifteen hours.

This was done by someone with basic knowledge, from home, in two days. A Shodan search gave me over five thousand exposed Metabase instances. If I could do it, the uncomfortable question is what is out there and who else is looking.

Copy Fail#

Copy Fail is CVE-2026-31431, a local privilege escalation in the Linux kernel crypto module, disclosed on 29 April 2026 and already patched. It struck me as being on the level of Dirty COW, so I had to replicate it the same day, and I spent the day studying it, testing it and writing variants in several languages, including one in C with no dependencies that compiles with gcc on any distribution.

I tell it for what it was not. I did not discover it, nor did I find anything new, what I did was understand a flaw another team had demonstrated and port it to play with it and add it to Talos as a check. With an agent beside me, going from reading the advisory to having the variants running was a matter of hours and not days, and that is the part that really changed: the distance between reading about something and having it running in front of you has shrunk enormously.

The limit of the agent#

In Argos, the platform Talos came out of, there are 172 guards whose only job is to turn red when someone breaks a convention. In a round where I set about breaking things on purpose I found four of them sitting green while measuring absolutely nothing, guards an agent had written, that looked correct and did not check what they claimed to check. Since then every guard gets broken on purpose before I call it done.

That is the pattern I keep repeating. The SecOps setup that took me weeks a year ago, with Jenkins, SonarQube and Trivy in containers, this time was a Saturday afternoon with Claude and Antigravity beside me, and the CI that came out that first time was archaic but there you go, it worked. The speed is real, and these are the three times I have measured it against my own earlier version, which is the only comparison that means anything to me.

The same thing, done twice	Before	Now
Building the whole SecOps flow	two weeks of concepts and two days of pipelines	one Saturday afternoon
Recon of a target lab with a local model	35 minutes	6 minutes
Time the local model took to start writing	10 minutes per message	10 to 20 seconds

What does not change is that you have to verify what comes out, because an agent hands you a guard that measures and one that does not with the same face, and the one that does not measure is worse than having no guard, because it gives you a false guarantee.

The feeling underneath#

There is a feeling I cannot shake. In vulnerability analysis, in GRC, in pentesting, more and more it happens that I understand what is being done, I would know how to do it myself or most of it, and still there is someone or something doing it faster and better than me. I enjoy the speed, I really do, and at the same time I cannot quite lose the idea that the work, deep down, is not entirely mine.

I am not senior but I am not that new to this either, and I still think the only defence I have there is judgement: knowing what to ask it, knowing how to read whether what it gives back is right, and breaking it when it says it works. The agent does, I decide and check, and as long as that part stays mine I am fine. Does this happen to anyone else around here, or am I the only one turning it over?