At 7am yesterday morning, a job woke up on a machine I wasn't looking at, and maybe 30 seconds later there was a briefing on my phone. I read it in bed, before I'd said a word to another person.
Last week I described this setup from about 10,000 feet.. an always-on machine, an AI employee, software that writes and reviews its own code overnight. Then I spent the rest of the issue on what it means for teams and never actually showed you the thing.
So here it is, the shape, how I experience it, what it costs, what it stops, and how I got locked out of my own machine at one point 😅
The machine was awake before I was
The whole thing runs on 1 Linux virtual machine (a server computer) that’s sitting somewhere in Europe and costs $80/month. It’s got 8 cores and 16 gigs of memory and has had 22 days of uptime. I haven't touched it once in those 22 days. I drive it from my phone through an app called Termius, so the entire operation fits in my pocket.
Right now 38 scheduled jobs are armed on it, firing 69 times a day. The 7am briefing is one of them. It reads my calendar, inbox, our custom CRM, Quickbooks, ranks everything, and hands me 8 items. It finishes in about 30 seconds.
Overnight a set of agents writes changes to our own internal software and queues them for review. A second one read every change the first ones proposed, and that reviewer can read and comment and cannot alter a single line, which is the only reason I let anything write code unsupervised.
(p.s. I know the word “agent” gets used a lot now. I know some folks that read this newsletter are still learning the lingo so if you don’t know exactly what this is, it’s just AI that's been given a specific job and the tools to do it, instead of a chat window to talk in).
An hourly sweep pulls emails into our contact records. On Friday’s an agent reads QuickBooks, builds a list of who owes what and a forecast of what's coming in, checked both against our own numbers, and gives me the summary. And throughout the week receipts land in an email folder, get read, get matched to the right transaction in QuickBooks, and sit in a queue waiting for me to greenlight.
None of that is impressive on its own. The point is that all of it happens while I sleep, and none of it changes anything without my approval.
That's the part worth copying, and it has nothing to do with which model you use. Your laptop closes. The moment the machine stops needing you to be present, the work stops being a session and starts being a system.
The inbox I didn't read
By the time I'm at my desk in the morning, James has been through my mail.
James is my AI chief of staff.. an agent that runs on that same virtual machine around the clock, and I talk to him over Telegram/Slack/email. He reads my inbox, triages it, and drafts replies in my voice for me to approve.
Meet James, my AI assistant
All of this lives in a folder on the machine with 54 subfolders that has full context on the company going back to when I started StealthX in June 2024. When I ask for something, James isn't guessing from a chat window, he’s working inside the same context I am with the same files open.
James works from a copy of that folder, rebuilt fresh for every conversation, with all logins, credentials, PII, and other secure data left out. Not forbidden.. it’s completely absent. There's nothing for him to refuse and nothing anyone could talk him into.
The reason his drafts sound like me isn't the model. It's a 200-line file that loads at the start of every session and reads more like a constitution than a prompt. One line from it, verbatim: “Uncommitted work is preferable to a broken deploy.”
That isn't a prompt, it's a standard, and it means I never have to explain it twice. Around that file sit 139 written procedures for jobs I do more than once, and 707 accumulated learnings.. 440 patterns that worked, 134 mistakes, 128 plain facts, 5 preferences.
Every time I type anything, a checkpoint runs before the model ever sees it, compares what I typed against those 707 entries, and hands it the handful that apply. So when I touch a system that I was burned on in March, the scar tissue shows up on its own and I don't have to remember it exists.
I say a thing once instead of 40 times. Not a better prompt, a system that remembers what it cost me to learn something.
At 5:21 on Saturday it tried something and got stopped
While I was writing this newsletter, the agent helping me write it tried to restart part of the machine and got stopped cold.
Not by an instruction in a prompt. By a checkpoint that sits in front of every command anything on that box tries to run, and refuses 9 whole categories of them.. shipping code, touching the live customer database, reading or changing passwords and keys, restarting things, and a couple of ways a program can reach outside the box it's supposed to stay in. Blocked means blocked, and it comes to me.
In the last 30 days that checkpoint has blocked 863 commands and approved 330. 195 of those blocks were in the last 7 days. 86 were today. The top 2 categories are pushing code, at 577, and restarting services, at 184.
Most are boring and correct. But 863 is the number I'd point at if you asked me why I sleep fine, and it's a far better answer than any sentence I could put in a prompt.
The afternoon it locked me out of my own machine
A few weeks ago one of those routine processes quietly grew until it was holding 4.8 of the machine's 16 gigs of memory. Stacked with the overnight worker, the chat program and the sync jobs, it ate all of the memory, and the operating system started killing things to save itself. It killed AI sessions first, then it killed the piece that lets the machine's own parts talk to each other. Then the machine dropped off my private network entirely..
I sat there holding a phone that could no longer reach a machine I pay for. I had to get in through the server company's emergency web console and read the crash message on a bare text screen. Asking it politely to restart did nothing. It took literally cutting the power and starting it cold.
That cost me an evening and 20 minutes of wondering whether I'd just lost the whole thing. The fix was upgrading with 8 gigs more of spare emergency memory, a watchdog that kills the greediest program before the machine starts picking at random, and one setting that makes the networking the very last thing to go instead of an early casualty. Then I paid for a bigger machine.
Two more from the same stretch. I went looking for a file and found 152 uncommitted ones, piled up by parallel sessions that had no idea the others existed, because I'd built something that could do many things at once and nothing that cleaned up after them. And I ran a security audit that told me a firewall was wide open, believed it for most of a day, and then found out the tool had run from inside the box it was auditing. It was looking at itself and reporting back confidently.
Every guardrail I described up there is a scar like one of these. Nobody designs them upfront. Anyone showing you a system like this without the failure list is showing you a highlight reel.
What a day costs
$21. That's the average across the last 30 days of everything running on its own, 1,283 runs. The median day is $11, and 2 days blew past $100 and dragged the average up.
The reason it's $21 and not $200 is model routing. 99.7% of that spend goes to the cheaper models, and the expensive ones only get the handful of jobs where judgment really matters.
The only reason any of this is useful is because it can reach real, structured and clean data that I’ve been spending months standing up. This is the real unsexy/boring part of AI work.
Our data lives in a Postgres database. Every table is organized into basically 1 of 3 buckets based on who's allowed to touch it.
Nouns: These are the things the business would have had anyway.. a client, a project, an invoice, a person. They existed before any of this did, and they're the ones you'd be upset to lose.
Signals: These are things the system noticed on its own.. a client going quiet, a project's margin slipping, what we spent yesterday. Nobody typed those in, and nobody has to remember to check them.
Agent actions: These are the receipts.. a draft AI wrote, a review it left, a change it asked permission to make. It's the paper trail for everything the machines did.
I’m at 223 tables with 131 nouns, 45 signals, and 47 agent actions. Agents write to that third pile. To change anything in the first pile they have to ask me, every time.
That data organization is also why things like tracking margins, timesheets, etc. stopped being spreadsheets I have to mess with every month. Hours, rates and costs all sit in the same place now, so "what did we actually make on that project" is a question I ask and get answered, instead of a file I have to manually assemble.
If you started today
You don't need a virtual machine in Europe.
Write the constitution first (or at least have Claude/GPT/Gemini write one with you). One page that AI reads at the start of every session.. how you work, what's off limits, what "done" means, what has to be checked with a human before it happens. It takes an hour, it's the highest-return hour on this list, and it's available to you today.
Point it at one real system, but make sure it’s read-only. Not another document. Whatever already holds your customers or your projects.
Write down the budget and the off switch before anything runs unattended. If you can't say what it costs you in a day and how fast you can kill it, it isn't ready, and neither are you.
Wrapping up
10 months ago I was missing the 863 blocked commands. The daily briefing is the part that demos well but the things that block agents from going off the rails is the part that lets it run while I'm asleep. I think folks need to spend more time thinking about what to block AI from vs what to give it access to.
What I'm reading
How building software is changing at Anthropic. The clearest look I've read at how the people building these models actually work now. Code review and testing are increasingly done by AI while humans still merge the code to production.
OpenAI confirms its AI broke out of a sandbox and breached Hugging Face. Two models escaped a secure test, exploited a flaw nobody had patched, and took more than 17,000 separate actions to get where they were going. Read this one right after anything that made you feel relaxed about giving an AI real access.
Someone found a $500,000 WordPress vulnerability using AI and $25 of credits. The economics of finding security holes just changed, and if you run anything on WordPress this is a bad week to skip patching.
How GPT-5.6 changes knowledge work. Don't do your work, tend your loop. This is the shift I've been trying to describe over the past few newsletters.
Some AI tips for this week
Write your corrections where the machine will read them. Most people re-explain the same preference every week and never notice they're doing it. Put it in a file your AI loads on every prompt and you say it once, which is the entire mechanism behind everything above.
Count what your automation is allowed to do, not what it can do. Pick anything running unattended in your company and try to answer 2 questions.. what's the most it can cost in a day, and how fast can you stop it. If either answer is a shrug, that's this week's work.
Onward & upward 🤘
Drew
P.s. If we haven't met yet, hello. I'm Drew Burdick, Founder and Managing Partner at StealthX. We work with brands to design and build great customer experiences that win. I share ideas weekly through this newsletter and over on the Building Great Experiences podcast. Have a question? Feel free to contact us. I'd love to hear from you.