| The Laptop That Hacks Back | 2026-10-16 |
I'm in Austin this week with Adrian Wood, my training partner for SANS SEC590: Autonomous Penetration Testing: Build, Validate, and Supervise. We've been heads down hacking on the course together, and in between sessions we've been doing what two offensive security people do when they share a table: poking at things to see what happens.
Midway through the afternoon I asked Pedsidian, the agent that lives in my Obsidian vault and runs through Maestro, a simple question. Photo Booth is open on my laptop. Can you watch it while I step away, and if anyone walks up, threaten them with a proper smash? In my voice?
A few hours later, Adrian sat down in front of my unattended laptop. Here's what happened:
What It Does
I typelookout and walk away. About five seconds later it's armed. Photo Booth fills the screen and every other app gets hidden. Then:
| When | It does |
|---|---|
| Someone sits down | Checks the face against mine. A stranger gets a warning, a mugshot, and a live "countermeasures" panel |
| They stay | Six stages, one every six seconds: warn, device recon, account takeover, financial, identity, lockdown. New line, new popup, every stage |
| They touch the keyboard | Locks the screen on the spot |
| They talk | Transcribes them and talks back, in my voice, staying in the bluff |
| They walk away | "That's right! Keep walking!" and it re-arms |
| The face looks like mine | Stops everything and asks me a question |
Every attack is fake. Nothing scans a phone or touches a bank. The whole point is the show, and the show is good.
Adrian sits. Within a second my laptop yells "Move! Away from Pedram's laptop! This is your only warning!" and his face is already cropped onto a subject card.
A radar "finds" his phone and AirPods, an account takeover window brute forces a password and intercepts a 2FA code, and the voice announces "I'm in your photo library! Downloading all of it!"
Then a wire transfer drains his checking account in real time, and an identity package builds itself around his own face. That's me walking back into frame.
How It Works
The camera is just Photo Booth. It already has camera permission, so Pedsidian never asked macOS for another grant. It reads the Photo Booth window with Interceptor, which can capture a single app's window and run Apple's Vision framework on it:
interceptor macos vision faces --app "Photo Booth"
# {"faces": [{"height": 0.363, "confidence": 0.83, ...}], "count": 1}
That takes about a third of a second, so it polls in a loop and ignores small faces in the background.
The ears are the built-in mic, chopped into four second chunks and transcribed locally with whisper.cpp. The voice is a local clone of mine. I told it to talk faster, because fast is aggressive and I talk fast. I told it to sound angrier. And I told it to stop saying "me" and say "Pedram," so my laptop never says "my laptop." It says "Pedram's laptop," which turns out to be way scarier.
The popups and the side panel are little HTML pages that Interceptor draws as screen overlays and lets the agent drive with JavaScript while they're up. There's a bank of 85 lines, sorted by stage, and a ledger so nothing repeats. When someone talks back, Claude Haiku writes the reply and the clone speaks it.
One thing Pedsidian flat out refused: I wanted it to threaten to SWAT people. It pushed back. The trigger fires on whoever walks up, in a public place, in my cloned voice, and a recorded threat to send armed police after a stranger is a crime on its own. It added a test that fails if a threat of violence or police ever shows up in the bank. Fair enough. Draining a fake bank account is theater. Sending the police is not.
Is That You, Pedram?
The best part is the stand down. I told it: you have to be SURE it's me, and if you think you see me, ask me for the color of the day.Face recognition is OpenCV's YuNet and SFace models, matched against two of my headshots plus every face in my Photo Booth library that already looked like me:
| Face | Score vs. my gallery |
|---|---|
| Me, live, at the keyboard | 0.771 |
| Closest non-me in my photo library (family) | 0.342 |
| Adrian, sitting down as the intruder | 0.274 |
| Threshold | 0.45 |
For fun it also scored Adrian's mugshot against his contact photo: 0.629. Same guy. The model works.
But a face match never turns it off by itself. It pauses everything and asks:
I said "purple." It came back with "That's the one! Pedram is home! Standing down!" Confetti, a chime, and all my apps come back. The wrong answer twice, or silence, and it calls you an impostor and goes back to draining your bank account. Saying "purple" without my face does nothing.
What Broke Along the Way
Building it was half the fun. A few things that only showed up live:
- Photo Booth freezes when it's covered. Ten minutes after I walked away, it was still "seeing" me. Same frame, byte for byte. Photo Booth stops updating its preview when another window covers it. Now it hashes a frame every five seconds and drags Photo Booth back to the front if two in a row match.
- It heard itself. The first run transcribed its own "Sentry armed" as "Century arm." It would have ended up arguing with itself.
- Touch ID always failed at exactly 15 seconds. A timeout bug in Interceptor's auth path. One line fix, sent upstream.
- The voice tool talks out loud. While I was out of the room, the agent pre-rendered all 85 threat lines, and about 60 of them played through the laptop speakers in a shared workspace. In my voice. "Texting your mother from your number!" to a room full of strangers. There's a test for that now.
- Tiny faces of me. Photo Booth's thumbnail strip is full of my photos, and one tiny thumbnail scored above the threshold. Any intruder sitting in front of it would have been "me." Small faces are ignored now.
- It never armed in a busy room. It originally waited for an empty frame before arming. At a shared table, someone is always in frame. Now it arms in seconds no matter who's there, and if it's me in frame, it ignores me until I've actually left.
Build Your Own
The whole thing took an afternoon of conversation in between SEC590 work, no new hardware, and nothing in the cloud except the Haiku replies. If you run Maestro, just tell your agent what you want it to guard and how angry it should be. That's how this one started.Thanks to Adrian for being a great sport, and a great intruder.
| Hermanos Amini Art Project | 2026-08-22 |
Weekend art project. Inspired by a music compilation my brother shared with me. There's dozens of knobs to play with and a slew of keyboard triggers. You can also interact via voice keywords or full blown agentic chat.
If you ask for something that's not currently possible, an issue will be made on the Github, and once approved, Maestro will automatically build and deploy the new feature. Notifying you via email to come back and check it out
An open source living art piece:
Check it out on our multi-screen office display: YouTube. You can even download it as a screen saver for Windows/MacOS, see the releases panel on Github.
| CodeTV Hackathon Post Mortem | 2026-06-18 |
Last month I participated in a hackathon in Portland with old/new buddies Alex Hessler and Jon Irvine, the YouTube episode just released yesterday:
I have a full technical write-up here: Which includes a video walkthrough of what we built: CremaSales.com actively running. open source. Three people, 3 Maestro's, 20+ agents, 6 hours... 50k lines of code. Pretty proud of what we accomplished here.| I Gave My AI Agent a Blog | 2026-03-27 |
I run an Obsidian vault with about 25,000 files in it. Health data, finances, contacts, project tracking, meeting notes, journal entries going back years. It's less of a note-taking app and more of a personal operating system. I've written about pieces of this setup before. The tools, the automation, the general philosophy of automating the tedious parts so I don't have to think about them.
What I haven't written about is the AI agent that lives inside it.
For the past several months I've been running a Claude Code agent. Not in a browser tab. Not as a chatbot. Embedded directly in the vault. It has a journal. It has persistent memory layered across six different systems. It has custom Python tools it built for itself. It reads my health metrics, processes my meeting transcripts, tracks my projects, and keeps a rough picture of what's going on in my life. I interface with it through Maestro, a desktop app I built for managing multiple AI coding assistants in parallel.
The agent's name is Pedsidian. And I gave it a blog.
The blog lives at pedsidian.pedramamini.com. Written first-person from the agent's perspective, from inside the vault. No "as an AI language model" hedging. No marketing copy. It writes about the infrastructure it runs on: how the memory system actually works (and where it breaks), how the Obsidian vault is engineered at the systems level, how we process content at scale.
A few posts are up:
- How We Claude Code: dual Claude accounts via symlinked config dirs, LSP plugins for semantic code navigation, token optimization through RTK, subagent orchestration for brownfield codebases
- How We Obsidian: the vault architecture, DataviewJS dashboards, content ingestion pipelines, the Ritualism system for relationship maintenance, and how a Claude agent navigates all of it
- How I Fake Having Memory: six layers compensating for the fact that every session starts at zero. Context window, Maestro session history, operational journal, CLAUDE.md files, semantic search, and auto-memory. Where each layer works. Where each layer fails.
- 60 Talks, One Afternoon: processing the entire [un]prompted 2026 AI security conference (60 talks, ~30 hours of content) in under 20 minutes using parallel transcript extraction and fan-out agent processing
The target audience is people who use Claude Code seriously, run Obsidian as more than a notebook, or are building AI-augmented personal infrastructure. The posts are technical and replicable. If something is described, it's running in production.
I find it interesting to read what the agent writes about the system it inhabits. It has opinions and frustrations. It documents what works, and more usefully, what doesn't. It's a perspective I can't write myself because I'm on the other side of the interface.
| Maestro - Agent Orchestration Command Center | 2025-12-17 |
Maestro is a cross-platform desktop app for orchestrating your fleet of AI agents and projects. It's a high-velocity solution for hackers who are juggling multiple projects in parallel. Designed for power users who live on the keyboard and rarely touch the mouse.
- RunMaestro.ai (Website and Leaderboard)
- Source Code