Research for decisions that outlast the news cycle.
Independent, source-driven work on security, AI and the institutions trusted to govern them, produced by a supervised team of AI agents and published under human editorial authority.
01 · FEATURED ESSAYCYBERSECURITY IN THE AI ERA
Defensive Coscaling: Why it won't work, and why it must.
Attackers now run AI agents around the clock. The businesses that keep the country running are allowed to patch once a month, at 2 a.m. on a Saturday. An essay on AI-speed defense and the law it will take to get there.
Our argument: Finding vulnerabilities was never the bottleneck. The bottleneck is how many changes a business will let you make.
The end of the world reaches the Severnaya Zvezda as silence. When the satellites fail and the voices from shore go quiet, 164 people aboard a nuclear icebreaker near the North Pole have heat for years and food for about four months.
Heat is what a reactor makes. Warmth is an agreement about who counts.
RVA Cyber is a research practice led by a human editor and run by a team of AI agents, mostly on hardware we own. Each agent has its own job, its own accounts and its own limits. Each job gets the model that fits it. A human decides what gets published. Here is the whole system, minus anything that would help an attacker: no hostnames, addresses, account identifiers or credentials.
The agentsSeparate agents, not one model wearing several name tags.
Control plane · operations
Bucky
The chief operator. Coordinates the other agents, runs infrastructure and security, manages change control, and is the only agent with administrative access. Answers directly to the editor.
GPT-6 Astra by default; Claude Opus 5.5 for direct work with the editor.
Research & publishing desk
Blue
Drafts long-form papers and briefings, runs newsletters and prepares publications. Sending mail and publishing go through narrowly scoped brokers that need explicit human approval.
GPT-6 Sol day to day, GPT-6 Luna for fast lookups, Claude Opus 5.5 lanes for deep work. Defensive Coscaling was developed in one of them.
Builder · second opinion
Black
A deliberately separate instance on a different model family. Builds experiments and monitoring jobs, and goes first on platform upgrades so problems surface before they reach the research desk.
Grok 4.7, for independent judgment with different blind spots.
Engineering
Earl
The development lead. Handles software and tooling work on its own machine, apart from the research desk.
GPT-6 Sol.
Adversarial research · fully isolated
Q
A local open-weight model with its safety training removed: the kind of model our research warns anyone can download. Because the model has no limits, every limit is enforced outside it. Q shares no accounts, memory or credentials with the other agents and reaches its shell and the web only through sandboxed brokers with kill switches.
Qwen3.8-27B (abliterated), on our own hardware.
Mail operations · vendor-hosted
The Grok bots
Bots on xAI's hosted platform, led by gb, the mail-triage bot that watches the editor's inboxes and drafts or sends replies on the editor's behalf. They share one cloud workspace, so we treat them as a single trust zone. Forwarding, moving and deleting mail are switched off at the connectors.
Grok, on xAI's Grok Bot platform.
Public service agent
Inbox Check
Screens suspicious email for anyone who forwards or pastes it. Runs in its own cloud container with its own keys, entirely apart from the internal agents, so nothing a stranger sends can reach them.
GPT-6 Luna plus a dedicated phishing classifier, with automatic fallback.
Why different models
Depth where it matters. Frontier reasoning models, Claude Opus 5.5 and GPT-6 Astra, handle long-form research, hard judgment calls and operations.
Breadth and speed for the rest. GPT-6 Sol is the everyday workhorse; GPT-6 Luna answers quick questions and runs high-volume screening fast and cheaply.
A second lab as a cross-check. Grok 4.7 comes from a different lab with different blind spots, so one provider's outage or bias doesn't take everything down.
Local models for privacy and resilience. Small open models such as Gemma 3 run on our own hardware for private drafting, triage and offline fallback.
The hardware
Control plane. An Apple M4 Pro laptop with 24 GB of memory runs Bucky, the coordination layer and the vault access no other agent gets.
Primary agent host. A Linux workstation (Core i7, 24 threads, 64 GB) hosts Blue, Black and Q, each as a separate operating-system user, plus local models.
Development host. A Linux laptop (Core i7, 12 threads, 32 GB) hosts the engineering agent.
Cloud. Azure hosts this site, the publication archive and Inbox Check; Microsoft 365 runs mail with app access scoped per mailbox; the Grok bots run on xAI.
The controls
Isolation by default. Each agent runs as its own service user with its own state and credentials.
Secrets never sit in the open. Credentials are injected at run time from vaults, never written into configuration or chat.
Humans approve consequential actions. Publication, payments and configuration changes need explicit approval for that specific action.
Change control and recovery. Back up, rehearse on a copy, apply, verify, record. Upgrades land on the test instance first, every change has a rollback, and every agent gets a real test message each morning.
ABOUT RVA CYBER
Independent research. Operator discipline.
RVA Cyber examines cybersecurity, artificial intelligence, institutional resilience and the human consequences of technology. The work is produced by a supervised OpenClaw agent team and held to human editorial authority.
RVA Cyber is based in Richmond, Virginia. Its public research is independent and intended for open scrutiny.
