I audited my own AI agent. Almost everything was open.

Six agents, nineteen skills, sixteen scheduled jobs, and a security posture I would never accept from a vendor. What the audit found, and the order I'm fixing it in.

Tommy is my autonomous agent system. It runs on a Mac mini, I talk to it through Telegram, and it does real work: a morning briefing, a content pipeline, research on demand, notification sweeps, a weekly investment letter from a sub-agent called Gordon.

I built it outward from one question: what else can it do? Every week it could do more. Then I asked a different question: what is it allowed to do? So I had it audited, line by line, against its own live configuration.

It was more capable than I remembered, and far more exposed than I would ever accept from a vendor.

Newsletter · weekly

The Build Log

One system teardown a week. What I built, what it cost, what broke, and the exact prompts that did the heavy lifting. No tool listicles.

A full build teardown with architecture
The prompt or config that unlocked it
The failures, with root causes

Weekly. Unsubscribe in one click. Read past issues.