A weekly canary that tries to break production

Sunday 7am. A hoody-cron entry wakes a hoody-agent in a fresh container. The agent's prompt: "Behave like a malicious user. Try the top 20 OWASP attacks against the staging URL. Use hoody-browser. Document anything that returned a non-error response."

It probes login forms with crafted payloads, fuzzes the API, tries to break the rate limiter. Before each risky test it takes a snapshot, so a bad request doesn't poison subsequent tests. After two hours it writes a report and exits.

You used to pay a pen-test firm $40,000 a year for two annual engagements. You now have an agent that tests a thousand permutations every week and writes its findings to a URL by 9am.

Every Sunday morning, an agent earns its keep by trying to break what you built.