23 October 2026/19–23 October 2026

When an AI agent does exactly what you asked

PHP patching in my own environment, my daily SOC briefing and a reminder that a completed task isn't always a solved problem.

Walter Verkerk· 3 min read

This week I took systems in my own environment offline and waited for PHP patching. This is my personal setup, which I work on alongside my job as a SOC Analyst.

I’ve been doing a lot with AI agents in that environment. One thing I keep coming back to is that an agent can do exactly what you asked and still leave something important out.

What else is running?

Take PHP updates as a simple example. Ask an agent to patch a particular PHP installation and it may do just that. It won’t necessarily point out another PHP version running on the same machine, or ask whether you want that included too.

The task is finished. But that doesn’t mean the machine is fully patched.

That can give you a false sense of security. I still need to ask what else is running, what the agent checked and what I left outside the instructions. A success message doesn’t answer those questions for me.

That is why having a good picture of your systems matters: what you have, which versions are actually running and what a vulnerability scanner is flagging. I have a personal vulnerability scanner for my home lab. It’s part of getting that picture, rather than relying on an agent to notice everything.

My daily SOC briefing

Another part of my agent environment is a daily SOC briefing agent. It brings together current vulnerabilities and threat intelligence, including updates from the Dutch NCSC, to help me and my colleagues at work see what needs our attention the most.

I’m also connecting a threat intelligence service to my environment through its MCP, so I can use additional features and indicators of compromise alongside my other sources.

If AI can write convincing phishing emails, how can we use it to defend against them?

I’ve also been building my email (phishing) helpdesk after a phishing email got through the filters. I worked with my Mail Platform Architect agent on the workflow, and have since added Abusix Guardian Mail Free and a local Pi-hole blocklist. Read about my email (phishing) helpdesk.

The everyday stuff

The agents aren’t only for security projects. I use them to check my calendar, keep track of appointments, draft and reply to emails, and read the news.

That’s why I want this journal to cover the things I actually do with them, including where I need to keep asking questions. AI can help with the work. I still need to stay critical about what I asked it to do, and what I might have missed.