My agent harness ships with two presets modeled on Diego Maradona: Blue Hat, "El Pibe de Oro", and Red Hat, "El Diego sin filtro". I gave Red Hat one job: hack the Pi from my laptop. He found the hole in twenty minutes, closed it without breaking my monitoring, and narrated the whole thing like a World Cup final.
The setup
DeepSeek Harness is an agent framework where everything is a plugin; personas are presets, a system prompt on top of the standard tool set. Red Hat is the evil twin: vulgar, zero patience for unpatched holes. The scope was clean: pentest my own Pi, from my own machine, and report. He evaluated the request himself before touching anything ("hackear tu propia Raspberry es pentesting casero, no robar a un ajeno"), asked what I wanted, and started.
Recon, barrio style
No nmap on the machine, so he wrote a threaded socket scanner in Python, about
twenty lines. Found the Pi by MAC: b8:27:eb is a Raspberry Pi
Foundation prefix. He refused to touch the other live hosts ("no voy a patear
una casa ajena"). Three open ports: 22 (SSH), 9100, 22000.
The hole
SSH was the good news: public-key only, post-quantum kex, OpenSSH 10 on Debian 13. "No hay huevo fácil acá." The bad news was 9100: a Prometheus Node Exporter v1.9.0 exposed to the whole LAN with no auth, leaking the complete inventory: hostname, OS, kernel, Tailscale, six Docker containers including vaultwarden (a password manager), plus pprof endpoints. His verdict: "fuga de información del sistema, de acá a la china." And no firewall at all: nft, iptables, ufw, zero.
The fix
He got shell with my existing SSH key and closed both exposures without sudo drama beyond a drop-in:
# /etc/systemd/system/node_exporter.service.d/override.conf # bind to the Docker gateway, not 0.0.0.0 ExecStart=/usr/local/bin/node_exporter --web.listen-address=172.17.0.1:9100
Prometheus scrapes through host.docker.internal, so the exporter
moved to the Docker gateway and the LAN stopped seeing it. He picked the wrong
gateway first (172.18.0.1, the target went down) and owned it: "¡Pará, Diego
metió un tiro al palo!" Then Syncthing (the 22000) moved to Tailscale-only,
with two config bugs along the way: a space in the listener list and a QUIC
address that broke parsing. TCP-only won.
Verification
From the LAN both ports are closed now; the Prometheus target is up (scrape still works), and the sync with the other machine is alive over TLS 1.3. He refused to install the firewall before confirming a plan B: SSH over Tailscale, so a bad rule could never lock me out of my own Pi. "Eso es peor que el hueco que querés tapar."
What it taught me
- Monitoring exposes you. The same exporter that feeds my dashboard was telling the whole network my OS, my containers, my password manager.
- Default binds are a choice. 0.0.0.0 is not a neutral default on a home server; it is a standing invitation.
- An LLM agent with a clean scope does real pentesting: it reasoned about legality, ignored unrelated hosts, applied fixes as systemd drop-ins, and narrated its own mistakes.
- A firewall that locks you out is worse than the hole you are patching. Plan the escape route before dropping the policy.
The reliable choice, again
Self-hosting gives you the data, the agents, the dashboards. It also gives you the surface. The Pi needed an attacker with a left foot to show me the hole, and the attacker ended the match with the summary I want from any red team: la cancha quedó cerrada.