Nightwatch: a multi-agent hackbot
Nightwatch is a multi-agent system for security research: a hackbot that coordinates AI agents to investigate software and look for vulnerabilities. I’m building it to explore how agents can read source code, test ideas, check one another’s conclusions, and produce useful evidence for a human researcher working on an authorised target.
It runs inside the Oh My Pi harness, which provides the agent runtime, tools, and communication between team members. Nightwatch supplies the roles, instructions, reusable skills, and research workflow. Separate documents describe the authorised targets and the current assignment, so the same basic design can support different investigations.
The current team combines OpenAI Daybreak Blue and Deepseek v4.1 Flash agents. OpenAI’s Daybreak Blue provides approved defenders with access to flagship AI models with fewer refusals for authorised cybersecurity work. The lead agent is Daybreak Blue; Deepseek v4.1 Flash agents carry out most research and supporting work.
The team has five roles:
- Lead planner — Daybreak Blue: chooses priorities, breaks investigations into bounded tasks, delegates work, and explains the results to the human operator.
- Researcher — Deepseek v4.1 Flash: reads source code, develops hypotheses, runs local tests, and records evidence. Multiple researchers can investigate separate questions or independently check the same claim.
- Adversarial reviewer — Daybreak Blue: independently tries to disprove a proposed vulnerability and checks whether the evidence supports its claimed impact.
- DevOps — Deepseek v4.1 Flash: prepares test environments, fixtures, and tools, then verifies that researchers have what they need.
- Archivist — Deepseek v4.1 Flash: organises research notes, answers questions about previous work, and spots useful connections between observations.
Agents can communicate directly, while Casefile provides their shared, persistent research record. The initial setup uses a local Docker copy of Packagist as an example target. This gives the team source access and a repeatable testing environment. A human operator sets the scope, assesses the findings, and handles any disclosure.
Casefile: shared research notes
Casefile is a web application for storing and sharing security research. It gives Nightwatch’s agents and the human operator a place to record questions, experiments, findings, and unsuccessful approaches. Notes survive agent sessions, so later work can build on earlier evidence.
Each research note can have a summary, detailed Markdown content, tags, comments, and links to related notes. These connections help the team follow an investigation and recognise when separate observations might fit together. An activity history records changes and who made them.
The architecture is straightforward: a Go service provides an API and serves a browser interface. Agents use the API through their tools; the operator can search and read the same records in the web interface. PostgreSQL is the authoritative database, while Elasticsearch provides a search index that can be rebuilt from it. Casefile keeps the research evidence available for review as the team and its investigations change.