I Asked for Six Things. My AI Came Back With a Checklist.
Last night I went to bed with a list. I woke up to everything on it done, plus 17 fixes I never asked for. Every one of them was right.
What I asked for
A client's AI box was sitting on my bench. Two people in their office, one agent each. Before I handed it over, I wanted it right. So I sent my AI, Ender, a message and went to sleep.
Here's what I asked for. One: get the box on our private network. Two: two accounts, each with its own agent. Three: a shared folder so they can pass files to each other. Four: all of our hooks and safety rails, and none of our information. Five: test it 10 times. Six: have a second AI review it twice along the way.
And one line that ended up mattering more than the list: "This is for them and I want to make sure it's stable."
What I woke up to
All six were done. Ten test runs. Two full reboots. Two crash tests. One freeze test. The last three runs checked over 100 things each with zero failures.
But that's not the part I want to talk about.
The second AI reviewer, Astra, came back with 17 problems across two rounds. Both times the verdict was "fix first." Ender fixed every one of them, then tested again. None of those 17 were on my list.
And honestly? Every one of them was right.
The stuff I didn't ask for
Here are a few, in plain words.
The shared folder could be turned against the people using it. I asked for one folder both people could write to. Sounds simple. But if two people can both write to the same spot, one of them can leave something in there that tricks the other person's account into overwriting its own files. So instead, each person got their own outbox. You write to yours. The other person can read it. Nobody can mess with anyone else's stuff.
The box said the AI was running when it wasn't. The service was watching the window the AI ran in, not the AI itself. So if the AI died, everything still looked green. Ender changed it so the system watches the actual AI and restarts it if it dies. Then it killed the AI on purpose to prove it comes back.
A frozen AI looked exactly like a working one. Same deal, different failure. If it hangs, nothing restarts it. So Ender built a watchdog that checks every minute and restarts a frozen agent. Fun detail: the first freeze test didn't actually freeze anything. The software that holds the AI's window quietly un-paused it in a fraction of a second. So the test was passing for the wrong reason. Ender caught that and switched to a real freeze.
The instructions made a promise we can't keep. The AI's starting instructions said the client's work "stays on" the box. Files do live on the box. But the thinking happens in the cloud, and messages go through Telegram. For an office that handles sensitive client info, that line could have had the AI telling people something false about where their data goes. That one bugged me the most. It's now worded honestly.
Our company name slipped through. I said none of our information. The scan that checks for that had an exception in it, and our name rode through on that exception. Removed the exception. Now any trace of us stops the build.
Setup said "success" when parts of it failed. A broken step would log a warning and keep going, and the final line still said done. Now any failed step fails the whole thing. Ender proved it by feeding it a bad username and a tampered setup file on purpose. Both failed, like they should.
The tests checked that things existed, not that they worked. It's easy to check a safety rail is installed. It's harder to throw a fake secret key at it and make sure it actually blocks it. Now every one of the safety rails gets run with real inputs on every test pass.
There were more. That's the gist.
Why it built them without asking
This is the part I keep thinking about.
I didn't ask for any of that. And Ender didn't stop at 3am to ask me if it should fix them. It just did.
Normally that would make me nervous. An AI going off and doing stuff I didn't ask for is exactly the thing I warn people about.
But look at the list again. Every fix traces back to something I did ask for. "Stable" covers the crash recovery, the watchdog and the setup failing loudly. "For them" covers the outboxes and the honest wording about their data. "None of our information" covers the leak scan. "Make sure" covers the tests that actually test.
It didn't add features. It didn't redesign anything. It found the gaps between what I said and what I meant, and it closed those.
That's the line. Not "do whatever you think is best." More like: if it serves the goal I gave you, fix it. If it changes the goal, ask me.
And it did ask on the stuff that crossed that line. It found the same shared-folder problem on another client's box. It didn't touch that one. It put it in front of me this morning and waited for my OK.
The checklist
So here's what I did with all of it this morning.
Every fix, every finding, and every trap we hit now lives in one checklist. Each line says why it's there and which script checks it. Some of it gets checked automatically after every build. A few things can only be checked by hand, and the list says so.
And there's a new rule. Anything we fix or learn on a box goes into the checklist the same day. Not "we'll remember." We won't. I've been doing security long enough to know the thing that bites you is always the thing someone fixed once and nobody wrote down.
The next box starts where this one finished. That's the whole point.
If you're building with AI
Give it your goal, not just your task list. Mine was six tasks and one sentence about stability, and the sentence did more work than the list.
Have something check its work. A second AI reviewer found things the first one missed. That's not a knock on either one. It's just how review works, with people too.
And write it down. A fix that only lives in last night's chat is a fix you'll be making again.
If you want an AI box in your office built and checked like this, let's talk.
← Back to all posts