Alan Wells (@alanwells) on X

Alan Wells, writing from a three-person team, spent seven days fending off an active cyber attack on one of their products. His main argument is that a "software factory" is becoming basic equipment. By that he means automated coding infrastructure that can ship fixes fast enough to keep up with automated attackers. His team got through the attack because they had spent a few months building theirs before the trouble started. The minimum he recommends is a cloud coding server with read-only access to all logs and observability services. With that in place, you can get reasonable situational awareness with a prompt, run monitoring loops, and let coding agents test fixes against the attack patterns you actually observed. He also argues that a shared coding server enables multiplayer incident response. Everyone can see every session, jump in when needed, and fork shared session links, which he says carries far more information than re-explaining the situation over and over. The setup he describes is modest. His team uses an opencode server, a forked version of compound engineering tuned for automated workflows, and a Slack agent that handles scheduled jobs. He says you don't need Ramp, Stripe, or Uber-scale resources to do this. The real cost was time. To get the validation systems working well enough to ship pull requests without human code review, his team stopped new product development for about six weeks. He admits that was painful at the time but says the velocity gain afterward made it worthwhile. He also has practical advice on access to the AI labs' cyber programs. Know-your-customer approval for Anthropic's and OpenAI's defensive cyber programs is now quick, but it took his team a day, which felt long during the incident. His advice is to apply before you need it. Getting access to Anthropic's Mythos model let his team run deeper analysis, moving them from reactive mitigation to proactive patching. His regret is that they didn't do it a few weeks earlier.