2nd Sight Lab

2nd Sight Lab Security and Technology Research. Pentesting. teriradichel.substack.com

10/05/2026

Look Ma, no hands. Almost.

So yesterday and most of the night I set up a group of autonomous ai 🤖agents to deploy some new resources and monitor logs and fix errors until all the resources are deployed.

It does ok except it randomly decided to drop ram share permissions resources for no apparent reason. I found a few bugs here and there that made me go in and do some prompting and readjusted a few things.

But mostly I’m sitting here staring at it very slowly fix errors, occasionally walking away to wash the dishes and what not.

I use MFA plus IP restrictions on credentials so periodically I have to reauthenticate. Sometimes it gets stuck in a rut. I ask it what it is working on or what is the latest error to fix or why isn’t it done yet.

At times the queue gets hung up with too many errors. I have to clear it. Need to look into that.

Beyond that it’s pretty boring and slow. I have 847 resources deployed, 10 to go…now 8… now stalled again…but it eventually figures it out. 7…

The instances and AMIs take a long time and anything cross account. It was getting stuck on quotas but I have a dedicated project for that now.

6…

4…

3………

2………………..

Stuck on something.

IP Share. Anything cross account, ram, etc.

Oh. I should have removed that. It’s something no longer used. I prune the tracker to match the updated configuration ~ a kind of hokey work around for now.

851 resources. Done.

I’ll log in and try to use the new instances, AMIs. Login through bastion hosts into systems in private networks tomorrow and see if it’s actually correct.

Dramatically improved validations and remediations in reports using AI tools I tested on last engagement. Findings I kne...
09/29/2026

Dramatically improved validations and remediations in reports using AI tools I tested on last engagement. Findings I knew were there but could not prove in past. Improved tools and new coding insights. Subscribe for updates. The more paying subscribers, the more I write!

So exhausting. Finally.AI is my nemesis and my addiction and downfall and my tool to conquer all the things all the same...
09/25/2026

So exhausting. Finally.

AI is my nemesis and my addiction and downfall and my tool to conquer all the things all the same time.

Really killed me this week like three times when I was almost done did something really wonky. I keep finding ways to reign it in. Will be easier when this is complete.

You get to a point where it will take longer to go back so you just have to get it done. I’m so behind and barely slept this week but finally got this thing working.

The main thing right now is to run one or multiple jobs sequentially or in parallel. When I start a or test I can kick them all off at once and easy add new jobs, AI or otherwise.

In the second tab I can view and chat with running agents. In the last tab I can view the hierarchy of AWS infrastructure my little friends deployed earlier.

I use my tracked and deployed infrastructure to specify what resources to use in conjunction with each job.

Soon I will have support for jobs on ec2 infrastructure using the AWS resource manager.

But for now I’m running the rest of the jobs for my current test including reporting jobs to deliver a report. And then I sleep for two days.

09/24/2026

No time finishing a project. But I did finish another big thing today with AI 🤖 after much consternation.

My job runner tui.

The culmination of all the things. ⚙️🤖🔒🧡🛠️

So here’s how it works.

* set up a data source
* add your job data source
* add your job data and repos
* add job groups if you want which contain a hierarchy of which jobs run in which order sequentially or in parallel
* add job configurations for each job - like you can run the same job in different accounts, for different customers, with different AWs IAM roles and add custom parameters for each job at build or run time
* publish your configuration (s)
* build the job container (s)
* if running remote push to AWS ECR
* Run locality local roles and secrets in secrets manager
* run remote on EC2
* monitor running jobs, AI agents, cpu, disk, memory and deployed AWS infrastructure like I wrote about earlier this week.

(The infrastructure project defines where the jobs run and is used to salect the job roles, secrets, and buckets and such in the job configuration)

Oh yes and chat with agents on any platform and soon, my own custom agents with open source models. 😉

Phew.

Done. Ish. A real world AI 🤖 use case.670+ resources.A whole AWS Organization infrastructure.Segregated environments and...
09/21/2026

Done. Ish.

A real world AI 🤖 use case.

670+ resources.

A whole AWS Organization infrastructure.

Segregated environments and easy to add more in minutes.

I had to add additional networking parameters, secrets, ram sharing etc, to get the base of my secure batch job now +AI agent infrastructure. It’s not perfect. The security has not been verified.

I figured out how to let agents fiddle with and test the instances to create AMIs while I was doing other things. I figure out how to get them to monitor and fix issues. At one point Claude Code told me that one of my sessions was longer than listening to Abbey Road four times. OK. So. I could run it nonstop if I was rich.

In the end the agent completing the last collaborator instance was doing crazy things with metadata service and credentials. So I cut it off. It should be deployed and easy to finish but we’ll see. It used my prior tested scripts.

While that’s working I’m running jobs with a bash TUI I wrote with AI. I have plans to change the language but prototyping in bash is faster. And I can tell you that AI agents are way better at writing bash tuis (at least the way I did it) than they are at complex day structures and architectures that involve parallel processing and queues.

The jobs can use the same queue processing logic and reporting I used to get the agents to deploy semi-autonomously and get to the desired state more quickly.

And guess what. I did it without giving them ANY GitHub or AWS credentials, they only got temp instance credentials to create AMIs which will be promptly revoked and set to auto rotate in the future. The instance creation can occur in a private network in the future (when I become a millionaire and can afford all the things to make that happen.) I already know how I can set default passwords without giving agents access but no time.

The other thing is, these are all deterministic, non-AI scripts now so I won’t be burning many tokens if any to deploy new resources and nothing to redeploy existing resources from the code. I can create new resources via some configuration and spend very little in most cases even if I have AI agents help generate the configuration files. And they do t get to mess up the code.

The whole point of this was to launch my pentesting, security research. assessment and reporting tools more quickly. Never enough time in a day and this took way longer than I thought. One of these days I’ll write more about it on my blog

For now, completing a report and some final validations with it all.

https://github.com/2ndSightLab/ai-tracker

98% ~ 350 Resources~ Configure types~ Configure resources~ Deploy in parallel ~ Track statusRefactor:~ resource to resou...
09/03/2026

98%

~ 350 Resources
~ Configure types
~ Configure resources
~ Deploy in parallel
~ Track status

Refactor:
~ resource to resource dependencies (not only types)
~ broke down budgets /networking into individual AWS components

Now the fun part: Jobs.

Or agents, if you like. 🤖

https://github.com/2ndSightLab/ai-tracker

Progress. When I get done I’ll have to deploy a whole AWS organization in a test account and see how fast I can do it. T...
08/25/2026

Progress. When I get done I’ll have to deploy a whole AWS organization in a test account and see how fast I can do it. This is all part of setting up my AI 🤖and pentest sandboxes and job runner.

Fuzzgramming + Brutevibing 🤖~~~~~~~~~~~~~~~~~~~~This thing in building is so complex it’s nearly impossible for me to ke...
08/21/2026

Fuzzgramming + Brutevibing 🤖
~~~~~~~~~~~~~~~~~~~~
This thing in building is so complex it’s nearly impossible for me to keep all the moving parts in my brain. And generally I don’t like overly complex things. But I don’t really see another way to do this and keep it flexible.

Over time I’ve simplified it a ton, but I don’t think it is simple enough. Right now I just need to use it and I’ll figure out if I can simplify it more later.

I did design it so any size organizations can use it, I want to even make it work in a single account. A remote account. A one person account. Whatever you want. For now it uses an organization by default.

But I also designed it so you can divvy out deployment privileges to different parts of your organization with different levels of permission for you know - governance.

So here’s the thing about building with AI. This is a serious app. It has to be logically accurate not vibey. I’ve built banking apps for companies with billions of dollars of assets under management. This app has some hard core logic.

Of course I wouldn’t build a banking app in bash but it was fast and lightweight for a POC. But the core logic is there to migrate the idea to some other language if you must.

So as I ponder my experience…

There’s two sides to this. On the one hand I don’t know half of what’s in it and I’m afraid to look. I will hate it and it will tempt me to immediately want to stop what I’m doing and refactor everything and that could take a lifetime given what happens when you vibe AI code.

On the other hand, I know the core logic and architecture is solid. I could be wrong and I’m sure if someone was paid a bounty they could find a flaw here and there but I think the parallel processing is pretty decent. I built it in such a way that I don’t have to fight with flock and file locks and all that.

I hope it is correct but I am still concerned about one aspect of adding errors to each node in the diagram. I think it’s right but I can’t yet say I’m certain. For some reason the project that updates the diagram data model has been the biggest problem. After getting consistent UI.

But today I got it working right end to end. It ran without the diagram locking up, fast enough, and seems to have the right data.

To the point I can USE IT.

With 5-8 terminal windows open juggling agents I can go like 100 times faster. I’m trying to quantify it in my ai-tracker repo but that’s hard to do.

The challenge is that for a single developer and especially depending on what part of the world you live in the cost is high, but for a company with a solid developer at the wheel output can go way up.

At the same time just when you think you are done, it kicks you in the teeth. It deletes key code, it creates a weird error that is so esoteric I am not even going to try to figure it out and explain it. Sometimes the models just feel haywire.

Those annoying moments are the moments I’m pondering, when you don’t know everything in the code and you don’t even want to look.

But sometimes, like today, the models are stuck and it is your best option. One little fix turned a whole bunch of nodes on my diagram green. Finding atrocious error handling and fixing it opened a flood gate of information to help solve some problems.

Can we overcome those gotchas? I don’t know. I feel like what I’m doing is fuzzgramming with a monolithic graph. I throw things at it over and over until if does down then right path and I get what I want.

Sometimes I have to slow down and literally make it write once line at a time to get it right. Brutevibing.

AI generated code is NOT pretty. It is not going to always be perfect and might generate a lot of noise but in the end you come up with something you couldn’t otherwise that “works” and produces correct outputs.

Still pondering optimizations, but today I got what I wanted. And immediately checked it into got with creds my agents are not allowed to use.

An AI-Generated Diagram of What I Am BuildingWould you like to see why I’m burning so many tokens?Just as I was about to...
08/20/2026

An AI-Generated Diagram of What I Am Building

Would you like to see why I’m burning so many tokens?

Just as I was about to publish this something went haywire. But got it.

AI is so bad a parallel processing but I feel like I brute forced my way there.

So much more to do but this is actually huge.

More details in a later.

Would you like to see why I’m burning so many tokens?

Can’t get role to work with MFA on Claude CodeWhat security would you really like to have for your agent credentials? Lo...
08/19/2026

Can’t get role to work with MFA on Claude Code

What security would you really like to have for your agent credentials? Locked down to a single IP Address? MFA without browser attack surface? Limited to a single user in a single account?

I have an AWS acount. I’m using Claude Code. How can I use my AWS credentials with MFA to access it?

Address

Seattle, WA
31401

Alerts

Be the first to know and let us send you an email when 2nd Sight Lab posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.

Shortcuts

Share