Deep Dive

Attacker AI vs Defender AI: Inside Daniel Miessler's LifeOS and the ISA Document

✍️ Daniel Miessler 🎙️ Interviewed by David Ondrej ⏱️ 71 min 📅 September 2026

1.The Cold Open: "It's About to Get Really Easy to Hack Anyone"0:00

Daniel Miessler opens with the line he clearly wants to land first: it's about to get really easy to hack anyone. Not because the attackers get smarter, but because open-weight models with no alignment whatsoever are converging on the intelligence of the frontier. "As smart as Soul or Fable or Mythos or whatever," he says, listing the top-of-the-line models as casually as you'd name cereal brands.

Miessler is the creator of Fabric, the open-source AI framework with more than 44,000 GitHub stars, and spent over 25 years in cybersecurity — including security work at Apple. David Ondrej invited him on to show how he actually builds software with agents, and Miessler spent the first minute showing his own system: a dashboard he calls LifeOS that unifies everything he owns, everything he's shipping, his attack-surface map, his central memory, and every input that flows into his life.

The frame for the whole interview: Miessler is not here to demo a tool. He's here to argue that the people who win the next few years are the ones who (a) understand their own business deeply enough to hand it to an AI, and (b) treat their own attack surface as something an automated system hammers on every hour.

2.Attacker AI vs Defender AI1:08

Asked where AI and security are headed, he doesn't hedge: "a pretty bad place, actually. It's basically going to be attacker AI against defender AI." The whole game, he says, is how good is your AI stack — how thorough, how fast, how intelligent are the models you run. "And if you're a defender and you're not doing this stuff, you're just going to get beat."

That reframes the cost of building software: one of the main line items becomes how many tokens you burn trying to hack yourself. He predicts the balance shifts toward the models themselves over time, with the harness mattering slightly less — but "every company will have to have it."

The uncomfortable practical question: most people don't have a billion-dollar company or unrestricted access to frontier models. His answer for the "typical person with a normal budget": combine lab models (OpenAI, Anthropic) with obliterated open-source models, and move toward running more of it internally — because depending on one or two vendors who "can kind of see everything" is a liability, not a convenience. He cites Alex Karp's argument that model inference has to come inside the company.

3.The Dependency Trap: When Claude Becomes the Company5:14

This is the section where Miessler's argument gets sharp. The "dependence problem" isn't just token spend or data retention — it's a slow, invisible migration of institutional memory into a model.

"Carol's been there for 18 years and Carol just knows how everything works. So Claude comes in and downloads all Carol's information, and Carol leaves. Then Alex leaves, and Raj leaves. Pretty soon Claude is the thing that understands the business the most."

He ties it to The Phoenix Project — the classic story of the one person everyone depends on who could get hit by a bus. In this version, the bus factor doesn't disappear when the human leaves; it moves onto a model you rent. "The prospect of cancelling Anthropic or OpenAI when the whole business runs on it — you really can't. It's become the operating system for your entire business."

He also punctures "zero data retention": people think "they don't train on my data and don't sell it to third parties" is the end of the story. It isn't. The vendor can still look at it, make product decisions from it, and steer you in ways that never show up in a privacy policy. The dependency has multiple angles, and the data angle is only one of them.

4.Describe Your Business — or Lose It7:25

Asked what a 20-to-100-person company should actually do, Miessler's answer is not "buy GPUs" first. It's articulate the business. "You need full contextual understanding of your business. You need to know how everything works, and be able to describe how everything works."

He points to the gap he sees everywhere: super-advanced banks have every process fully documented, with every change traceable to a decision — so they can hand the whole thing to an AI and say "here's how the company works." Most companies can't. "If you don't have that context yourself, you can't even start an AI project."

The reframe: the danger isn't that the AI is dangerous. "What's dangerous is the fact that they don't understand their business." The first step is boring and unglamorous — build context stores, SOPs, work streams and workflows (mostly human-run at first). Once that's articulated, only then do you ask "what models can we build?" The middle step for compute is renting dedicated GPUs from a different provider than your AI vendor — de-risking by splitting the parties that hold your data.

5.Bunker: Hack Yourself First12:44

For individuals, his prescription is the same instinct applied to personal life: he calls it Bunker. "I don't have anything out there that I don't understand. As soon as I build anything and put it online, it goes into Bunker and has automated checks running against it."

Step one is OSINT on yourself: run agents that continuously scour the internet and data brokers for "what does the internet know about me?" — services like DeleteMe or Incogni — then clean up the social media and posts you left behind. His reasoning is blunt: with an unaligned open-source model, "Hey, David is getting more views than me, I really don't like him — go into his background and find everything that could hurt him, and run a Twitter campaign" is just a request, no different from "find me good coffee beans."

The core instinct: "Figure out what your attack surface is." Bunker is the automation of that — every deploy gets checked, and his production systems run roughly 1,500 assert checks per hour. If you're a founder or a visible person, assume the model treating your career as a task exists, and work backward from that.

6.LifeOS: A General Harness, Not a Coding Tool15:25

Now the system itself. LifeOS started as P.A.I. (Personal AI Infrastructure) a few months after Claude Code shipped, around July 2025, and got renamed when it outgrew the name. The key design choice: it's not a coding harness — it's a general harness for his whole life.

The prime directive is what he calls "general hill-climbing towards euphoric surprise": for any task you give it, move from current state to ideal state. The reason it can do that with almost no prompting is what he stores in it:

LifeOS component	What it holds
Telos	Mission, goals, strategies, narratives, challenges — the whole direction of his life
150+ skills	56 public, the rest private (underscored). Small, light skills that describe "what ideal looks like" — preferences, not instructions
Central memory	Karpathy's wiki-loom + honcho-style features, plus a Cortex that receives parsed inputs
Inputs	Twitter bookmarks, voice, anything captured — auto-parsed and filed into memory
Attack surface	Everything deployed, with checks running against it (Bunker)
Shipping tracker	Every project and how fast it's shipping, unified in one place

The "bitter lesson" framing comes up immediately: the skills don't describe how to do something — they describe the ideal state of the output, and get out of the model's way. His digital assistant is named Kai, and it always has the Telos loaded, so any task arrives with the destination already known.

The Jarvis onboarding: his whole premise comes from science fiction — in Her, the system boots up and reads the protagonist's entire life before asking "what do you want to work on?" LifeOS is the attempt to build that ingest step for real. "The interface between us and the world is about to change because we're going to be talking to our agent, and our agent is going to be doing things against APIs." He wrote about this in a book back in 2016.

7.Nothing Hits the Floor22:45

He wears a small device — the B computer — that records him talking on walks. He shows it pulling a summary of recent conversations from his "life log" API in real time, with a skill that retrieves just the headlines so he never has to say "by the way, I have this context." The interview itself gets ingested live.

The principle: "I don't have anything that ever hits the floor." No idea, no conversation, no bookmark gets dropped — everything is captured and already flowing into LifeOS, not waiting somewhere to be fetched back. He's been running the manual version for 25 years — a space pen and index cards, straight out of Getting Things Done's "never trust your brain for anything, always write it down." Now it's automated: a private "work" repo that his agents auto-parse into GitHub work items.

The skill worth stealing: capturing context is becoming the core human skill. Ondrej's version is the same instinct — voice-memo a team conversation and upload the file instead of re-prompting for five minutes. Miessler's bet is that as models and harnesses get better, the highest-leverage human move is entering the right context, not writing the prompt. But he adds the warning: be careful with agents that "auto-do" — you don't want a conversation about offensive security to get misread as a task and executed.

8.Human 2.0: The Three-Step Prescription29:01

Half the interview is Miessler being almost a coach rather than an engineer. His goal is to transition people from "Human 2.0" — the corporate world where you optimize for Mrs. Johnson liking your slides and a 1% raise after three years — into a world where you wake up and decide what you want to build. The catch: "as work starts being taken away from us, we have to have a direction, or we're just going to have a lack of meaning."

His prescription, three steps:

#	Step	What it means
1	Deeply understand the world	Full-stack reality, from atoms up through biology, psychology, politics. He reads 20–50 books a year — "if I stop reading I stop being smart."
2	Want something	Introspect on who you are and how the world should be different. "You have to actually want things."
3	Deeply learn AI	Get really good at it — this is how you make the world different.

The scariest scenario he's seen: showing people everything his agents can do, then asking "what would you do with all this power?" and hearing "I don't know" or "can it pick a better show on Netflix?" He doesn't blame them — "I blame the whole system, all of society, for training people to not be ambitious." On why AI won't just invent its own desires: "we're a mech suit with evolution on the inside pulling the levers." Desires are evolution's dopamine system; the model has the neural net but no reason to want anything. Baking in desire would be "a hack, and dangerous."

He also refuses the "more or less jobs?" binary. "Violently both." Most current jobs go away and a UBI floor appears; meanwhile the top 10% — armed with agents that are effectively millions more workers — produce an explosion of new products and services. A K-shaped split. And his one genuinely hopeful outlier: if ambition and agency turn out to be partly biological, then a lab figures out the difference and ships a pill for it — "a 15-point IQ gain for everyone," or empathy, and the whole game changes.

9.The Jev-Powered Model Router54:00

The last twenty minutes are a live walkthrough of how he actually works. His harness is a heavily modified Herdr running LifeOS, with a custom model router driven by Jev. On prompt submit, Jev classifies the request and routes it by intelligence tier and token cost.

Tier	OpenAI model	Used for
Astra	Opus-class (top)	Highest-intelligence work
Soul	High tier	Serious reasoning
Terra	Mid tier	Routine tasks
Luna	Cheap tier	Bulk — "a whole bunch of SDKs and JSON"

He runs Anthropic models for a different slice of the work, and can watch all his agents light up in a status line as the router fires. His take on Jev's value is a clean reframe: an LLM answers with text, but a lot of what we ask doesn't need a sentence — it needs a decision. "Jev can do the same thing if you pre-design the questions and the options." The mini-step that unlocks it is coming up with a good list of choices.

Where Jev plugs in: he asked LifeOS "where are we doing things that don't require a text answer, but a decision?" and the answer came back as the hook system (is this prompt injection? is this dangerous?), the model router, and — most importantly — the eval system. He'd already built an equivalent pre-Jev: a system called AARA that auto-tagged every mistake and complaint (when he starts cussing, it flags "something we need to fix").

10.The ISA: One Document That Is the Code57:13

The deepest idea in the interview is the ISA — Ideal State Articulation. Where other workflows scatter specs, plan documents, skill files and tests across a repo, Miessler collapses them into a single document per project.

The ISA contains: the problem, the vision, the articulation of what he wants, every decision made along the way, and the individual build steps. The twist he stresses hardest: the steps for building are the same steps for the testing harness. The test harness and the build plan are identical. Any change updates the ISA first, builds the code, then checks the code still matches the ISA. Code and ISA mirror each other.

He demoed it on Surface, his news-reading app that parses 5,300 sources and objectively rates every piece of content regardless of author. Each individual step can carry an ISC (Ideal State Criteria) — a granular criterion with its own eval attached — and he wants Jev to answer "is this criterion granular enough? if not, break it further."

Two more details matter. First, his CLAUDE.md is only a routing system — pointers to where things live — because the actual instructions live in the system prompt, with progressive loading of skills, operational rules, and the identities of "Kai" (assistant) and himself (principal). Second, the eval system is the basis of everything: deterministic asserts on one side, and judgment evals (rubric, or a two-option tournament) on the other — and both judgment forms are, in his words, "perfect for Jev."

The lineage matters: this all traces back to Fabric, his 2024 project of structured prompts designed to "get our desires into the thing." The ISA is Fabric's prompt-structure idea promoted to a whole system. The failure mode it targets is precise: "the reason AI fails is we have not properly transferred our brain into the AI. When you have a problem, it's because you had something in your brain that was not in the document." If an ISA isn't articulated enough, it won't start building — it keeps interviewing you until it's about 80% "full," an idea he credits to Matt.

Key Takeaways

Security is now attacker AI vs defender AI — and the scoreboard is "how good is your AI stack." The defender who isn't automating loses.
The dependency trap is a memory problem: institutional knowledge migrates into a rented model, and then you can't cancel the vendor — the "operating system for your business."
Before models, articulate the business. Most companies can't describe how they work, so they can't even start an AI project.
Bunker is the individual's answer: know your attack surface, run automated checks, and treat "someone wants to hurt my reputation" as a request an unaligned model will happily accept.
LifeOS is a general harness, not a coding tool — skills describe ideal states (preferences), not procedures, and the model gets out of the way.
Nothing hits the floor. Capture everything (wearable, bookmarks, voice) and route it into memory automatically — the manual version was a space pen and index cards.
The three-step human prescription: understand the world, want something, and learn AI. Desires are evolution's dopamine system — the model doesn't have them.
The jobs question is "violently both" — a K-shaped split: most jobs vanish into UBI, while a top slice with agents produces an explosion of output.
A Jev-driven router turns prompts into decisions: routing, prompt-injection detection, and evals don't need a text answer — they need a choice.
The ISA is the killer artifact: one document that is simultaneously spec, build plan, and test harness — and the code must mirror it.

Timestamp Index

0:00 Cold open — hacking anyone + LifeOS overview
1:08 Attacker AI vs defender AI
5:14 The dependency trap — "when Claude becomes the company"
7:25 Describe your business or lose it
12:44 Bunker — hack yourself first
15:25 LifeOS: the general harness
22:45 Nothing hits the floor — the B computer
29:01 Human 2.0 + the three-step prescription
46:21 The K-shaped future and the ambition pill
54:00 The Jev-powered model router
57:13 The ISA document — one document that is the code
1:09:17 Fabric → ISC lineage