Self-immunizing infrastructure operations

Infrastructure that survives its own attacks.

Mithridate is a two-team, human-gated operations fleet that continuously attacks the systems it defends — in bounded, supervised doses — so what stays running has already survived the attack.

The king who swallowed poison every day could not be poisoned. Mithridate does the same to infrastructure: a red team probes the authorized scope, a blue team detects and repairs, and a human authorizes every consequential move. The default response to any event is code, not a model call.

View the repository Learn more

scroll to learn more↓

What it is

An operations fleet that poisons itself on purpose.

Nine agents — a Manager and eight specialized workers across two teams — detect faults, adversarially probe their own infrastructure, classify what they find, ask a human when it matters, act within a recorded authority, verify their own work, and record what happened. Every step is a typed record, so the whole loop replays from the audit trail rather than from a chat log.

Named for Mithridates VI of Pontus and the practice of mithridatism — building immunity by surviving controlled, sub-lethal doses. The red team is the sub-lethal dose.

Two teams

One attacks. One defends. They meet only through a human.

The teams never hand work to each other directly. They meet at a human-approved remediation path and through an engagement record that lets the blue team tell a sanctioned red-team exercise from a real intrusion.

▲ Red team

Adversarial discovery against the authorized scope.

Scout — passive threat intel (NVD, CISA KEV); never touches a target.
Prober (leader) — active recon; confirms exposures; re-attacks to prove a fix.
Striker — gated exploitation; runs only inside an authorized engagement.

▲ Blue team

Detection and gated remediation of the estate.

Sentinel — continuous mechanical detection; observes, never judges.
Analyst (leader) — classifies, deconflicts, finds root cause.
Medic — the only agent that changes anything, on an approved decision.
Reporter — evidence and numbered incident records.

The loop

Three human gates, and a fix that verifies itself.

Offensive discovery reaches remediation through the same human-gated path as an operational fault — there is no faster, less-supervised route for security actions.

Scout finds → [GATE: authorize recon] → Prober confirms → [GATE: authorize attack] → Striker exploits
↳ Sentinel detects in parallel → Analyst deconflicts as sanctioned via the engagement record (which also hands over the vuln)
→ Medic proposes → [GATE: authorize fix] → Medic applies & verifies → Prober re-attacks (patched?) → Reporter records INC-2026-NNNN

Why it holds

Four subtractions that make self-poisoning safe.

Detection never invokes an LLM.The default response to an event is code. Judgment enters only once a structured finding already exists — where a per-invocation model call is least affordable.

Verification is the detection code, run again.Not a second implementation that agrees with the first — the same skill that raised the finding, re-executed against the changed system. An action cannot report a success it did not measure.

The agent with the most authority has the least perception.The Manager holds the human channel and relays every approval, and cannot observe a host at all. An agent that can both see and decide can talk itself into things.

One write-holder that cannot authorize itself.Exactly one agent holds change credentials, and it acts only on a decision it did not write. A constitution its holder cannot edit means a prompt injection stops being able to survive the session.

Live

Watch the fleet operate.

The dashboard shows the running fleet, the systems under operation, and every incident, engagement and weekly summary as the loop produces them.

Open the dashboard Read the code