AlpacaX

Use case · On our own infrastructure

Patch a critical CVE in minutes, without handing an agent SSH keys or a root password

On our own servers, an AI agent found the exposure and applied the fix. Alpacon held it to one scoped work session and recorded its commands.

from the session's first approval to Apache serving patched PHP
~6min
The agent never held an SSH key or root password
No keys
to assess CVE-2026-98432, a CVSS 9.8 kernel CVE, and put a mitigation in place, about 15 minutes in all
3sessions

With Alpacon: a scoped work session

An AI agent requests a work session through Alpacon. A person approves the sudo list; Alpacon checks and records commands on one web server, and sudo before approval fails.AI agentClaude Code, Codex,and others, on alaptop or in CI1Someone on the team whoapproves the sudo list2Alpaconwork-session gateway3Command record5Your infrastructureWork session1 web server · patch PHP · 1hour · sudo for 9 named patternsWeb serverCloud VPC4On-prem datacenterDatabase, Linux serverKubernetes clusterNode, Nodesudo before approval: failed, not in scope yetAn AI agent requests a work session through Alpacon. A person approves the sudo list; Alpacon checks and records commands on one web server, and sudo before approval fails.AI agentClaude Code, Codex, and others, on alaptop or in CI1Alpaconwork-session gateway3Someone on theteam who approvesthe sudo list25Command record4Your infrastructureWork session1 web server · patch PHP · 1 hour · sudofor 9 named patternsWeb serverCloud VPCOn-prem data centerDatabase, Linux serverKubernetes clusterNode, Nodesudo before approval: failed, not in scopeyet
  1. Request a work session: servers, job, time limit
  2. A person approves
  3. Each command is checked against the session
  4. It runs on the in-scope servers
  5. Commands in the session are recorded
Illustrative layout. In this case the session covered one server.

What happened: a PHP remote-code-execution CVE

  1. 0 min

    Scoped work session

    One server, one hour

    The agent wrote down the job. Someone on the team approved it.

  2. 1 min

    Not in scope yet

    sudo failed

    The session didn't include sudo yet, so the command failed.

  3. 3 min

    Approved by a person

    sudo for a named list

    The agent asked for nine command patterns. Someone on the team approved them.

  4. 5 min

    Checked against scope

    PHP patched

    18 packages upgraded, Apache restarted on patched PHP.

  5. 10–13 min

    Commands recorded

    Origin locked down

    The record shows why each sudo command was allowed.

Who did what, minute by minute

Scroll to see the full timeline →

Minute by minute: 53 agent commands above, Alpacon session scope and 40 recorded sudo checks below. sudo failed at minute 1 because the session had none yet, someone on the team approved a named sudo list at minute 3, and PHP was patched by minute 5.AGENTwhat it ranALPACONwhat it enforced051015202530minutes after the agent's first commandPHP patchedchecks PHP and updatesupgrades 18 PHP packages, restarts Apachelocks the origin to the CDN1 server · 1 hour · no sudosudo for 9 named patterns, commands recordedsudo failed: not in scope yetsomeone on the team approved the sudo list
Each tick is one command from the session record, drawn to scale. Claude Code ran this one; any agent that can run a CLI uses the same path.

CVE-2026-98432 is a use-after-free in the Linux kernel's IPv4 TCP handshake code, rated CVSS 9.8 in its CVE record.

Scroll to see the full timeline →

CVE-2026-98432, a Linux kernel IPv4 TCP use-after-free, CVSS 9.8: three scoped sessions, open 8, 3 and 4 minutes, about 15 minutes in all. The third disabled MPTCP as a precaution; the kernel stays unpatched until a fixed kernel ships.Then CVE-2026-98432, CVSS 9.83 scoped sessions, about 15 minutes in allExposure checksession open 8 minCompromisesession open 3 minMPTCP disabledsession open 4 min

The kernel CVE took three scoped sessions: an exposure check, a check for signs of compromise, then a recheck that put a mitigation in place. No fixed kernel had shipped for the server yet, so as a precaution the agent disabled MPTCP with a persistent sysctl setting; the kernel itself stays unpatched until a fixed kernel ships. About 15 minutes in all.

Our agents' work sessions since June 2026

We run our own infrastructure on Alpacon

work sessions our agents opened
457
commands recorded
4,675
commands refused before they ran
78
median session: access for one job, then it ends
2.3 min

FAQ

Does the agent get root access?

Not standing access. The agent never holds SSH keys or a root password. It gets sudo only inside an approved session, for named commands or for a command Alpacon's risk check allows, with the reason recorded.

What if the agent tries something outside the job?

Alpacon checks each command against the session before it runs. Outside the scope, it is refused or sent to a person.

Which agents work?

Any agent that can run a CLI. Claude Code ran this one.

Playbook: critical CVE response

See it on your servers

  1. Exposure check
  2. Scoped fix
  3. Approval for sudo
  4. Full record
How we patched PHP2Shell in six minutes with an AI agent

On our own infrastructure, October 2026. Times from the Alpacon session record.