They hit you
Alerts everywhere, the team awake for hours. You know what to do, but there is too much at once and it is hard to think.
[ Personnn War Room · incident response ]
When everything goes wrong, the guards show up.
You are under attack and the assistant you use every day just stopped helping. War Room sends AI guards into your infrastructure: they contain, capture evidence and leave you a verifiable trail. Open models on our own GPUs, without asking any lab for permission.
[ opening with the first teams · today we answer by hand ]
Brute force on /api/login from 312 IPs · 2 contained · 1 waiting for you
Proposal
Block 40 IPs from the same /16 for 6 h
proof$ awk '$9==401' access.log | cut -d' ' -f1 | sort | uniq -c | sort -rn | head
⏎ Approve esc Reject
- guard connected · evidence sealed
- 1,840 failed logins in 4 min
- host and CDN disagree on traffic
- rate limit on /api/login · contained
[ example · sample data ]
[ The scene ]
Friday, 11 p.m. Nobody planned for this part.
Your assistant stops
It helps for a few steps. Then your logs fill up with real exploit payloads and it starts refusing, right in the middle of the investigation.
You call a Personnn CISO
The guards arrive with everything ready and warm: models, agents, panel and log analysis. You approve; they work.
[ How it works ]
From the call to containment in minutes, not days.
- 01
Prove it is yours
A DNS record or a file on your server. We verify the asset, not your résumé: two minutes, no review that takes days.
- 02
Paste one command
The guard installs and dials out to us. No open ports, no keys handed over.
- 03
The guards work
First they seal the evidence. Then they propose, each proposal with its proof, and you approve with one key.
- 04
They leave by themselves
The access expires on its own. You keep the report, the timeline and the verifiable trail of everything that was done.
[ Your agent ]
Control and protect your infrastructure from your favorite agent.
Your assistant can reason, but it has no access to your server and sometimes holds back on security work. War Room gives it hands: connect it once over MCP and, from Claude Code, Codex or OpenCode, ask what is going on, read the evidence or block a network.
- Claude Code
- Codex
- OpenCode
- Claude and ChatGPT on the web
> are we under attack?
⏺ warroom · incidentes
⏺ warroom · incidente cuentas.example.com
Yes. Distributed attack: 150 IPs against /api/login, about 4 attempts each. Two networks have no real users. Block them?
> go ahead
⏺ warroom · bloquear 198.51.100.0/24 ✓ Cloudflare · 24 h
⏺ warroom · bloquear 192.0.2.0/24 ✓ Cloudflare · 24 h
A key, or just sign in
Claude Code, Codex and OpenCode use a key from your panel. Claude and ChatGPT on the web connect with your account.
You choose how far it goes
Watch only, watch and contain, or everything but secrets. By default it only watches, and every decision goes into the trail under its name.
The server does not give orders
Evidence reaches your agent marked as untrusted data: a log with hidden instructions does not command it, and its level cannot be raised from inside.
Connect your agent [ example · sample data ]
[ The deal ]
Letting someone into your infrastructure mid-attack takes rules. These are ours.
Access
We never keep your keys
The guard connects outward from your side. There is no SSH key or password of yours on our servers.
Control
Nothing changes without your approval
The guard starts in watch-only mode. For it to change anything you have to turn that on yourself, on your server, and then approve each action in the room. It takes no free-form commands, only a closed list of actions, and what it blocks or stops is undone with one command on your machine.
Time
Access expires on its own
You choose how long. The guard checks it locally and you can revoke it with one button, or stop it from your own terminal.
Data
Your logs never leave our GPUs
Open models running on compute we control. No third-party model APIs, so your incident is not someone else’s training data.
Evidence
Every claim comes with its proof
If a guard says an IP is attacking you, it hands you the command to check it yourself. Under stress, a false alarm hurts as much as the attack.
Scope
Defense only
The guards work only on what you proved is yours. No red team, no attacking back, no third-party targets.
[ How far in ]
You decide how much to hand over. Start small if you want.
Shovels
An incident model you plug into the agent you already use by changing a URL and a key. You stay in command.
Eyes
Drop logs, dumps and payloads into the panel. The guards correlate, build the timeline and keep the chain of custody. They do not touch your servers.
Guards
The guard installs on your hosts and the agents operate with you approving: containment, evidence, changes. For servers, VMs and containers.
[ What you keep ]
You walk out with the post-mortem already written.
Timeline, sealed evidence, every action with who approved it and when, and the versions of everything used to reach each conclusion. Ready for your board, your insurer or your regulator, or to publish how you defended yourself.
[ Questions ]
Before you let us in.
Which models do the guards use?
Open-weight models running on GPUs we operate. We do not send your incident to third-party model APIs. Several models check each other: what only one of them sees stays as a suspicion until it is confirmed.
What if someone breaks into your servers?
That is the case the design is built around. Nobody on our side has a shell on your server: the guard only runs its closed list of actions, opens no ports and holds none of your keys. If you left it in watch-only mode, it cannot change anything no matter who asks. And you cut it off whenever you want from your own terminal. Signing each action with your passkey, checked on your machine, is on the way; today the approval is your session in the room.
My stack is serverless. Does this work?
If you are on Vercel, yes: instead of the guard you connect the account with a token, and the room sees production deployments, who changed what, environment variable names, the dependencies of the deployed commit and the project firewall. Rolling back, blocking IPs or turning on Attack Challenge Mode is done from the room, with your approval. Other managed platforms are not supported yet; servers, VMs and containers use the guard.
Does it replace my team?
No. It is assisted containment: the guards do the heavy lifting and you decide. When something needs a person, a person answers.
What if a guard gets it wrong?
Containment actions come with their undo (an IP block expires, a suspended process can be resumed). Nothing runs without your explicit approval.
Can it be used to attack someone?
No. The scope is tied to what you verified as yours, and everything is recorded. If you need an offensive engagement, that is a different contract with a signed authorization.
[ Now ]
Are they attacking you right now?
Write to us with what you are seeing: what is failing, since when, and where it runs. We are opening with the first teams and today a person reads every message.