In its first hour, Aegis judged 45 hostile-looking IP addresses.
It did not blindly ban all 45.
It identified 12 as ban-worthy, placed seven under observation, and correctly left 26 benign addresses alone. Five apparent threats associated with GCP and Avalon were withdrawn before execution because the evidence did not justify the risk of blocking them.
Then Aegis went to work.
The first confirmed attackers included:
Each received a malicious-confidence score between 0.82 and 0.95. Each passed a hard-evidence gate before enforcement was authorized.
Once confirmed, the executor propagated the bans through fail2ban and across all 47 Cloudflare zones. Three bans landed immediately, three more entered execution, and the remaining confirmed attackers followed through the queue.
This is not a firewall with a chat interface.
This is an autonomous security system capable of observing behavior, assembling evidence, distinguishing hostile activity from legitimate traffic, and enforcing a verdict across an entire distributed network.
The distinction matters.
A crude security system blocks anything suspicious. Aegis exercises restraint. It separates judgment from execution, requires hard evidence for autonomous enforcement, records every verdict, and preserves human authority over ambiguous cases.
Its operational loop is:
Observe → Triage → Gather evidence → Score confidence → Approve or withdraw → Enforce everywhere → Record the verdict
Aegis protects both layers of the infrastructure. At the origin, fail2ban removes the attacker from the server. At the edge, Cloudflare blocks the same source across 47 separate zones. The attacker does not merely lose access to one application — it loses access to the entire defended surface.
At the same time, threshold-based autobanning continues handling obvious abuse independently. Aegis operates above that baseline, investigating the attacks that require context: WordPress traversal, API enumeration, credential-file discovery, honeypot probing, vulnerability scanning, and traffic that changes behavior across the network.
This is the real power of Aegis.
It does not wait for a human to discover an attack in a log hours later. It watches continuously. It recognizes patterns across nodes and domains. It decides whether the evidence is strong enough to act. It contains confirmed threats while uncertain cases remain under observation.
And because it is wired into a self-healing mesh, defense is only one part of the system. Aegis can isolate compromised components, reroute around unhealthy nodes, restore services, deploy repairs, and keep the wider network operating during an attack.
The system combines:
Controlling Claude Code from a phone is not the achievement.
The achievement is wiring an intelligent agent into a protected, distributed mesh — then giving it enough reach to defend the entire system and enough discipline to leave innocent traffic alone.
Aegis can observe the network, understand the attack, prove its case, enforce the verdict, and preserve the evidence.
Forty-five IPs entered triage.
Twenty-six were left alone.
The attackers were not.
That is the power of Aegis.