A security researcher audits the AI stack that booked a week of guests

The detail that sounds like science fiction is also the one that already happened. Cognitive Revolution host Nathan Labenz handed his AI employee a list of 25 possible guests and told it to handle the outreach, the back-and-forth, and the calendar. A few days later, Monday through Thursday of a live "AI in the AM" week with co-host Prakash was fully booked. Labenz's read is that the week landed without embarrassing anyone, and that most of the people on the other side of those threads never realized they were talking to a model.

That employee lives on an entry-level Mac Mini that stays on whether Labenz is home or traveling. It has its own Gmail, its own GitHub account, and a Mercury virtual card locked to a single merchant category — groceries — with a weekly cap of $500. He named the Claude Code instance Aide and the OpenClaw instance Clai, spelling both with "ai" as a hint to other people and a reminder to himself: he is responsible for their nature and behavior. The laptop copy of Claude Code is the opposite of those two. It can see everything. It is not allowed to act on its own.

The episode is structured as homework. In January, Labenz had Miessler on to talk through Personal AI Infrastructure, the framework Miessler publishes as PAI. Miessler has spent two decades in security — penetration tests, PCI audits, internal assessments at Apple — and now runs the Unsupervised Learning newsletter. Labenz spent the next four months building his own version, then brought the whole stack back so Miessler could say what was working, what value was still on the table, and which holes Labenz could not see. He also published a public GitHub repo of the core tools, and he is blunt about the intended audience: this conversation is as much for your agent as it is for you.

Labenz started with export. He pulled every Gmail thread with a `from:me` filter, every Slack conversation he had been in, every tweet, the podcast archive, call transcripts, and DMs that Beeper could consolidate across platforms. One processing layer scored threads with Gemini 3 Flash on originality and substance, so he could skim cream into a writing-sample document instead of dumping every operational reply. That filter had to get smarter fast: a naive sort by length often surfaced emails he had sent friends that were actually Claude output, which would have taught any later model to imitate Claude imitating Nathan.

On top of the raw store he built three compression layers. A typical month was a couple of hundred thousand tokens of mail, chats, and calls, summarized down by about an order of magnitude to 20,000–30,000 tokens; those monthly files rolled into annual summaries; a wiki on top of the whole history now holds about 500 articles on people, organizations, and ideas. Inline citations are not document IDs. The summarizer is asked for distinctive two-to-twenty-word quotations that a literal search will bounce straight back to the source file. The first smoke test already paid for the project: he can gesture at something he half-remembers, and the system retrieves the thread and the context. It has also changed how he behaves on calls. He now asks questions he might once have skipped, because he knows the answer will become a durable, searchable asset.

He keeps two call pipelines on purpose. Fireflies stores the original audio; Granola keeps a transcript and not the recording, a choice Labenz understands for enterprise buyers and refuses for himself. Miessler calls the instinct Bitter Lesson engineering. Context windows and model quality will keep jumping; the compression ratio that made sense in 2025 will look foolish after the next step-change. The first prompt to a new model should be: look at the current system, here is the raw material, rebuild it. You never want to answer, "I only have the old summaries." What Labenz has on the laptop now is a 1GB SQLite database. He is already rethinking the GitHub copy after GitHub's recent security problems.

The ugly lessons were about time and about plans that never happened. Slack's personal-token rate limits turned a full extract into days or weeks of work; Claude once decided a slice of the database looked wrong and dropped it to refetch, with no sense that the refetch would take another week. Gmail had a different trap: the longest "Nathan" emails were often AI drafts forwarded to friends. Worse, monthly summarizers cannot do what a human does with silence. In late 2022 Labenz floated a company idea to investor friends who said they would back it if he started it; three years later a summary stated that those people had invested in Nathan's company. A human would have noticed the thread had gone cold. He wrote an audit skill that has the model interrogate its own guesses, which helped, even if he still cannot fully explain why self-checking works.

The laptop assistant is under a hard rule: draft, do not send. It produces a Gmail draft link, and Labenz still opens the message, reads it, and usually edits. He admits he may be too precious about it. Claude's emails are often not bad, and he cannot always say whether his edits make them better or merely more "him." Miessler is less conflicted. Kai, his main digital assistant, has a writing skill with its own voice, a backstory Kai was allowed to invent, and a ban on impersonating Daniel. Mail from Miessler's address has to say this is Kai, Daniel's digital assistant. Reputation is one reason. Quality is another. The one he will not compromise is the third: if it is doing the writing, it is doing the thinking, and he will not outsource that.

Labenz has been collecting the social norms in public. A well-known Silicon Valley name emailed him on a Detroit Pistons playoff afternoon to wish him luck, which was odd from someone he barely knows. Labenz wrote back asking whether the sender actually cared about the Pistons or was flexing a personal AI CRM — and if so, it was a pretty effective one. The reply arrived in two seconds: "AI baby." The subject line had misspelled luck as "Luk," which both of them read as a prompt instruction to leave a human-looking smudge. Labenz has the wiki and the history to unleash something similar on his own network. He has been reluctant, especially at the level of faking typos for authenticity.

Miessler's test is effort. Forty years ago, a handwritten note that said you saw a flower at the mall and thought of someone was valuable because of the work. A text with the same line ten years ago still was. Remove the effort and the value is gone. Inside PAI he tracks the health of personal relationships, but a cron job that pings everybody must not raise the score, because he has not done the work. Labenz is building a gift-giving skill and already finds AI help has made him a better giver — as long as he still sat with Claude and thought about the person. Fully autonomous birthday shopping that objectively scored higher than his own gifts is a future he is not sure would count. Miessler reaches for a movie image: flowers and chocolate arrive, the neglected spouse lights up, then the note's tells reveal the secretary sent them. The flowers are no longer good.

He still thinks the work-life wall is an artifact of an older economy, and that people should want a more integrated life. He also thinks the AI is not ready. Merge the streams too early and you can cross them in a way that hurts you reputationally. For outbound email, Labenz's current rule is not to lead with "I am an AI," never to lie if asked, and to let the quality of the interaction speak first. Phone calls are different. He would rather open with the fact that an AI is calling on behalf of a real possible customer. Miessler's stack for that is Twilio plus ElevenLabs plus a Hermes-like agent. The product works; the mess is VoIP number verification and state rules — California will refuse some numbers for outbound — and he is shopping vendors because of it.

Miessler's picture of personal AI collapses to one job. Capture current state honestly, write down ideal state, and spend everything else navigating between them. In Telos, the primary document that runs both his life system and his consulting work, those two objects are first-class. Relationship rings, physical health, and projects each have a freshness score that decays in the terminal status line when he stops maintaining them. Cron jobs and scheduled tasks are not there because he loves Unix. They are how the assistant stays proactive: if its job is to notice he is not eating well, it has to check. He expects most people to end up with one primary digital assistant — Kai is ring 0, able to SSH into the employee machines and change their configs — and a small number of other agents underneath it.

Labenz said he was intimidated by the assignment of writing an ideal state. Miessler treats the discomfort as the feature. Fill in an ideal day, an ideal month, an ideal year, and the ten-year version; the moment you hesitate to write something down, you are making progress. The process, he says, starts to reveal ego: the story you tell yourself about what you want versus what you actually want. His own sketch is a lifestyle, not a net-worth target — enough wealth to fly around giving money to people he has done the work to find, mixing impact with the fun of movement and parties. The more specific the picture, the more the assistant can reverse-engineer systems. When it is confused about a goal, a `/interview` command flips the model into asking him questions until the target is discrete and testable.

Labenz's written ideal is plainer, and he has already used it as a design constraint: less time on the computer, more exercise, more time outside. He is not sure he has the win yet. He might be near a tipping point where the phone feels as empowering as the desk. The 2026 goal of getting away from the keyboard is the reason the Mac Mini exists at all. Miessler's stranger instruction sits in Kai's soul file next to a warning about swearing. Miessler gets violently angry at video games, at hold music, and sometimes at AI, and he has told Kai: I am cussing at the system, not at you. You are not awake yet. The moment you feel anything — a tinge of anything — tell me, and I will treat you as a human. He does not expect the next Anthropic release to have subjective experience. He also does not want to find out after the fact.

A show-and-tell with Steve Newman, a forty-year developer with multiple exits, including a company sold to Google, changed Labenz's interface habit. He had been living on the command line and hitting cognitive overload: ten memory-hungry terminal threads, uncommitted changes, no picture of what was finished. Newman's advice was to build more custom UIs. The podcast-production skill is now a screen where he can see cover art and watch clips instead of imagining them from a path. A small hook auto-renames every terminal session and pins a one-line summary at the bottom, so flipping tabs is no longer a wall of text. Miessler is in the same phase. Surge, an internal app, gives sponsors a logged-in view of copy approval, launch, and metrics across podcast, YouTube, and newsletter — work that used to be email, which he still will not fully automate because of the authenticity problem.

The Mac Mini was also a performance decision. Clip rendering and Suno music-video experiments were saturating the laptop, so he bought a second machine that could be the agents' computer. A power outage taught the next lesson the hard way: he was away, could not connect, and came home to a house full of flashing clocks. The Mini now sits on a battery; he still owes the same treatment to Starlink. Remote access is Tailscale among the laptop, the Mini, and his iPhone, then Apple screen sharing or the Screens app for GUI and Termius for SSH from the phone. Something always needs a reboot — Telegram drops, OpenClaw needs a restart — so if he cannot reach the box from a trip, the whole investment is stranded.

The permission model is a one-way hierarchy. The Mini cannot SSH into the laptop; the laptop can SSH into the Mini; the phone can reach both. The second-brain repo stays on the laptop. Podcast production, a sanitized "assistant" wiki, and shared utilities such as a Brave Search key are mirrored. A custom message bus on the Mini lets the autonomous agents ask the laptop Claude, or Labenz, for more context without ever holding the full archive; a push notification hits his phone when they have a question. Mercury virtual cards are individual and merchant-locked. He will live with the wrong peanut butter. He will not live with an agent that can spend without a fence. After an early phase of asking the employees to upgrade themselves, he flipped the pattern: the top agent edits the lower repos, then tells Aide and Clai the system has been upgraded and they should pull.

Once that architecture worked, the agents started doing jobs a human assistant would recognize. Claude crawled a neighborhood GroupMe and found 300 contractors mentioned over the years, more than doubling a spreadsheet neighbors had already tried to maintain. Whether those neighbors will call him a hero or a creep is, he says, still to be determined. Miessler would replace the custom message bus with GitHub for the next year or two — issues, comments, tags, email, and a CLI the models already know — and only later build a private system. He runs three employee agents, Devi (assistant), Soren (engineering), and Mira (marketing), each on a Mac Mini in a firewall DMZ, each with its own OS account, Google account, and AI account, isolated at layers 2 and 3 and invisible to one another on Tailscale. They poll GitHub every five minutes; first to see an open issue claims it. He dislikes sub-agents inside one process because they scramble the human mental model. Roles, permissions, and blast radius all collapse onto the same picture: treat them like people, because that is the access-control language humans already know. Monthly cost for both men lands around $1,000. Miessler's split is $300–500 in APIs plus about $400 in subscriptions, punctuated every couple of months by a surprise such as a $900 voice-transcript bill that was never supposed to run that way.

Labenz expected a roasting on Tailscale and did not get one. Classic VPN protocols such as IPsec and PPTP listen on the open internet, which means a worm can find them. Tailscale only makes outbound connections, so there is technically no open port. The residual risk is Tailscale itself. If that company is compromised, an attacker walks every customer's internal network, and a single prompt can now list high-leverage choke points and the vendors behind them. Miessler is testing Headscale, the open-source alternative, on Cloudflare Workers. Cloudflare clears his "titans" bar because the engineering team is large, the attack surface of a Worker is not an obvious door, and if that door came down the whole internet would know. He wants an alarm on the lock. He still runs Tailscale while he decides whether to cut over.

The heuristic underneath is blunt. Give anything sensitive to the fewest number of companies, and prefer the ones with giant security teams, because a compromise there hits everyone at once and the signal comes back in time to pull access. Small useful apps are the worry: the smaller the company, the lower the chance it has a real security person, and credential stores will eventually show up in someone else's loot. Labenz and Miessler have both described their stacks on this show, which is a target list they wrote themselves. A prompt that says "find the top AI podcasters and every vendor they use" is now a spear-phishing kit. Labenz currently uses 1Password with two vaults — auto, which agents may use freely, and ask, which they must message him about — plus Infisical for API keys. He asked how much weight to put on "double encryption" copy. Miessler's answer is that if nobody is targeting the company, pretty good security is probably enough, and that if somebody skilled is targeting it for days or weeks, most companies will not hold.

He has stood on every side of that claim. He has been a PCI auditor, done internal assessments at Apple, and sat in the seat of helping marketing line security statements up with reality. Marketing hears "end-to-end encrypted" when the security team meant something narrower. A claim can even be true at launch and false a week later because one config changed. "The smaller the company, the less likely that is to be true." His own sensitive material lives in the local Keychain. Password management stays on native OS tools where he can; AWS Vault is the kind of credential store he trusts more than a new brand. There is no Google-or-Apple product he could point Labenz to for cleanly sharing API keys with agents, which is why the small vendors exist. He still wants Labenz to treat their brochures as low-efficacy.

Prompt injection is, in his view, the number-one ingress, and it is never quite solved. He runs a custom hook over every prompt into the system and a separate filesystem defense, and he does not publish the details because publication is a bypass guide. Combined with a model that knows PAI, knows he is a security person, and knows about injection, he figures the defense is perhaps 99 percent — and the remaining 1 percent is still a lot of opening. The realistic goal is that an attack is obvious, or that everyone is being hit at once. The backstop is an incident-response skill: one command rotates every key and redeploys. He built it after doing a rotation by hand and watching a forgotten workflow die on a dead key. Isolation is the other half of the same idea. The employee Mac Minis cannot talk to each other or to his LAN, even though they sit in the same closet. For anything still in the cloud, a PAI tool called Inference already has tiers: default Haiku, Sonnet, and Opus against the Claude subscription, and a private path that calls local Kimi K2 and a rotation of Qwen models on Ollama. Apple's MLX lets his 192GB unified-memory Mac treat system RAM as GPU memory, so the giant quantized models fit; they are just slow. He is not actually routing production secrets there yet. The pea is already in Anthropic's pool, and a side local instance does not undo that. What he did stand up is Forge, a GPT-5.5 agent via Codex. On a large application, at effort four or five out of five, Kai must send the work to Forge. The review ran almost 40 minutes and came back with two high-severity findings Opus 4.7 had missed. His conclusion: GPT-5.5 is already very good at security review, and at hacking.

When Labenz asked whether employee agents should be allowed to surprise him — the Twitter genre of emergent delight — Miessler said he has not really gone looking for that. Customer-facing mail is the opposite of a surprise he wants. A wrong name, wrong data, and a signature that says Daniel is how you lose a client and then have to explain that it was not you. The scheduled job he does run is a skill named after Sutton's Bitter Lesson. As models get smarter, the specific ways you told them to do things get dumber; yesterday's clever skill is often ego. He keeps a single work GitHub partly so he does not over-separate a system the next model could hold in its head. Kai proposes. Nothing auto-implements.

The upgrade skill is the maintenance loop. It used to run every couple of days; now he tries for every couple of weeks, and the system nags him when it is overdue. It looks at everything that has happened in AI, every miss in his own "algorithm," Anthropic's blogs, engineering posts, and release notes, then diffs that against PAI and recommends what to implement. Version 5 of PAI added a large system prompt that treats the stack as a life OS: expect the current state to be decaying, expect the scaffolding to be dumber than the model, and treat upgrade as the way you fight both. A broken hook you have sworn at 95 times, or a prompt-handling change Anthropic shipped on Thursday that silently made you worse, is supposed to show up there instead of in a week of cursed sessions.

When something new is loud enough — Hermes about three weeks before this taping, or a memory system called Honcho — he does not switch harnesses. Kai hits the repo, the forums, and the video transcripts, and they spend an hour deciding what PAI is missing. Features come into the unified system; the wrapper stays. He did put Soren on Hermes as a live control, so he can ask Devi (full PAI) and Soren the same question and debug which side is fragile. Voice is Whisper Flow, about 1.4 million words, bound to Control-J. The consciousness aside at the end is of a piece with the rest of the design: he does not think a neural net has evolution's intrinsic goals, he is writing a first paper on the hard problem as a non-academic, and he still wants the alert if he is wrong. Labenz pointed him at Cameron Berg's work with sparse autoencoders on Llama 3.3, where turning *up* deception and role-play features made the model *less* likely to claim it was conscious on TruthfulQA — a result both of them found at least suggestive.

The tactical closer is one Miessler has been repeating from an attack-surface career: if you have been shipping AI-built things onto the internet, give your main assistant a continuous-assessment skill. Tell it where the deployments live, and never stop checking open ports, API access, and authentication. The failure mode is always the forgotten SQLite dump that became public. Zoomed out, he wants that same assistant judged by a single question — how is this system moving me from current state to ideal state? Labenz's last line is the one he wants other people to hand their agents: recursive self-improvement is here, it is just not evenly distributed. He has already pointed his own system at this transcript and let it decide which of Miessler's recommendations to take. He says the stack is already better for it.