Anatomy of an Agentic Personal AI Infrastructure

Anatomy of an Agentic Personal AI Infrastructure

Speaker: Daniel Miessler, Founder, Unsupervised Learning

Conference: [un]prompted 2026 — The AI Security Practitioner Conference

Date: March 3–4, 2026, San Francisco

Watch on YouTube: https://www.youtube.com/watch?v=l9CPmPk2R-M

Reading time: ~10 minutes

TL;DR

Daniel Miessler, creator of Fabric and founder of Unsupervised Learning, walks through the architecture of his personal AI infrastructure — a unified, Claude Code-based system he calls PAI (Personal AI Infrastructure) — while offering a broader argument that companies are rapidly moving from human-run to process-run, and that security practitioners need to systematize their own work before McKinsey does it for them.

Introduction

Daniel Miessler is one of the most widely read voices in AI security. Through his newsletter Unsupervised Learning and his open-source project Fabric, he has spent years distilling what AI can and cannot do for security practitioners. By the time he took the stage at [un]prompted 2026, virtually everyone in the room had read something he wrote or used something he built.

He started by admitting that the talk he submitted — about his personal AI stack — felt almost embarrassing to give by the time the conference arrived. Everyone has an AI stack now. He nearly pivoted to something more theoretical. The conference organizer Gadi persuaded him to present the stack anyway.

The result was a talk that worked on two levels simultaneously. On the surface, it was a tour through Miessler's specific technical choices and modules — the PyUpgradeSkill, the Debate module, the Iterative Depth technique, the Arbol composable action framework. Beneath that, it was an argument about what is coming for companies, for security teams, and for the individual practitioner who wants to remain relevant.

▶ Watch: Introduction and the "Companies Become APIs" Thesis (00:00)

The Macro Shifts: Companies Become APIs, Reality Becomes Filtered

Before describing his own system, Miessler offered three macro predictions that framed why building personal AI infrastructure is urgent rather than optional.

Companies become APIs. He used Excalidraw as an example. They announced that you could now describe a diagram and it would render automatically. His response: that is a non-starter unless the feature is accessible via API to his AI agents. If a company's functionality is only accessible by logging in and typing in a box, it does not exist for an agent-first workflow. "The way this is heading is your company exists as an API, and if people's AIs can't use your company in their workflow, you don't exist." Within a few years, AI agents will autonomously select and compose services based on user needs without human intermediation.

Custom everything. As agents filter and compose more of reality on behalf of individuals, people will increasingly experience different news, different software, different interfaces. A Miessler agent and a neighbor's agent will be presenting fundamentally different views of the world to each of them. The security implication for penetration testers and red teamers is pointed: you may enter a client environment and find completely custom software built by AI agents, requiring a completely custom assessment stack in response.

Companies move from human-run to process-run. Miessler described an insight from years embedded inside a large energy company. When something goes wrong, they do not ask who is responsible — they ask whether the process was followed. If yes, the process is blamed and refined. If no, the individual is blamed. He argues AI will push every company toward this model, because AI requires explicit, codified processes to operate against. Security, he noted, has always wanted to "shift left" — to embed security into the development process rather than bolt it on at the end. If software is now being generated by AI following SOPs, the opportunity to finally make that happen is real: "Build software correctly the first time using an SOP."

▶ Watch: Macro Shifts — Companies as APIs and Process-Run Organizations (02:00)

The PAI Architecture: One Unified System

The centerpiece of Miessler's talk was the architecture of his personal AI infrastructure, which he calls PAI. The design principle is a single unified system where everything he does with AI is incorporated and compoundable. Context is stored centrally. Tools are modular. Skills are reusable. Any insight from any session gets pulled back into the central system.

PAI is built on top of Claude Code, runs primarily in Markdown, and is therefore portable to any environment where Claude Code is permitted — which, Miessler noted, means it can be used at work without special IT approval, since it is just context and markdown files layered on top of a tool most companies already allow.

The system comprises several named modules:

PyUpgradeSkill. This module monitors Anthropic and OpenAI engineering blogs, GitHub release notes, and changelogs. It tracks a timestamp from the last time it ran, compares what has been released since then, cross-references that against Miessler's existing system architecture and goals, and recommends specific upgrades. "I don't have to track all that, which is highly stressful."

Debate. For complex decisions, this module spins up between two and sixteen specialized sub-agents who are "experts" in the relevant domain. They debate aggressively in multiple rounds — the number of rounds is configurable — while a parent agent observes. The parent agent either makes the final call or presents the recommendation to Miessler for a human decision. "They form their opinions, they make their best argument, and then the parent agent basically says, 'Okay, we're gonna go this direction.'"

First Principles. Reverse-engineers the root cause of a problem rather than troubleshooting specific symptoms.

Iterative Depth. Based on a research paper finding that asking the same question from slightly different perspectives dramatically improves AI output. The technique hits the same conceptual surface from multiple angles, producing substantially better results than a single query.

▶ Watch: The PAI System Architecture and Core Modules (06:00)

The Algorithm: A Seven-Phase Optimization Loop

The module Miessler called "probably the most interesting piece of the whole PAI ecosystem" is simply called The Algorithm. He was careful to acknowledge the difficulty of the underlying problem while claiming genuine results.

The challenge he identified: software has a natural feedback signal — does it work or not? But for open-ended creative or analytical tasks, there is no equivalent. How does an AI know if it wrote a good short story? How does it know if it chose the right direction for a project?

The Algorithm addresses this by building an ideal state for any scenario. It takes a request, interprets it in the context of Miessler's full personal context (including goals, prior work, and preferences), generates a set of ideal state criteria, and then uses those exact criteria as verification criteria. The criteria must be discrete and testable — if they are not, the system cannot use them as handholds for iteration.

The seven-phase structure is roughly modeled on the scientific method: observation, hypothesis, experiment, test, verify. Agents work through each phase, and Miessler can observe all of them in parallel on a single interface showing progress across concurrent sessions.

The practical example he offered: ask the system to "build an entire role-playing game system with history, languages, terrain, and a combat system." What the system does is interpret the request in context, generate what it thinks you actually meant (correcting for "writer's blindness"), produce ideal state criteria, and then work toward meeting those criteria with testable verification at the end.

▶ Watch: The Algorithm — Seven-Phase Optimization (12:00)

Arbol: Composable Actions as a Security Research Platform

The newest module in PAI is called Arbol (Spanish for "tree"). Miessler described it as the realization of something he had been trying to build with CLI tools for a decade.

The concept: any discrete piece of functionality — an AI call, a script, an API request — is packaged as a single, composable action. Each action can run locally on the command line or in the cloud (Miessler uses Cloudflare Workers). Actions can be chained into pipelines. Connect a source and a destination, and you have a flow.

The security research application is direct. He demonstrated a Surface reconnaissance tool he built for himself: get all top-level domains for a target, pipe into get subdomains, pipe into Nmap port scanning. Each step is an independently reusable action.

Arbol also powers his content curation system. The system collects content from across the web — the full firehose — and applies a "Label and Rate" module that scores quality without regard to who wrote it. "If Marc Andreessen writes a shitty essay, it will not show up. And if a nine-year-old kid from Idaho writes an amazing essay, it will show up." The content is democratized by quality, not by reputation.

▶ Watch: Arbol — Composable Actions and the Recon Use Case (14:00)

The Strategic Argument: Systematize Before McKinsey Does

The through-line of Miessler's talk was an argument that went beyond tooling. The real threat to the individual security practitioner is not AI itself — it is systematized AI operated by large consulting firms and enterprises.

"You do not want to have anything that you care about be an amorphous blob," he said. "Because I feel like that is an attack point — for some McKinsey, a giant team of smiling twenty-two-year-olds — to come and attack that thing and extract everything out of it and basically turn that into a process which outsources you."

The solution is to get there first. Build a unified system that captures everything you do, encodes your expertise as reusable skills, and compounds in capability over time. Do things once, incorporate them into the harness, and let the system grow. "When you have a unified AI system like this, you can basically take everything you're doing and put it inside the system. You put your context in here, you put all your tools. And I think this is the way to go."

PAI is open source and had a recent release at the time of the conference. Miessler encouraged practitioners to check it out and adapt it for their own contexts.

▶ Watch: The Strategic Argument — Systematize Before You Are Systematized (16:01)

Notable Quotes

"As of two months ago, if a company's functionality is only accessible by logging into their tool and typing in a box, that is a non-starter for me. Your company exists as an API, and if people's AIs can't use your company, you don't exist." — 00:00

"You do not want to have anything that you care about be an amorphous blob. Because that is an attack point for some McKinsey — a giant team of smiling twenty-two-year-olds — to come and extract everything out of it and turn that into a process which outsources you." — 16:01

"When something bad happens at a well-run company, they only have one question: Did we follow the process? If yes, the process is blamed and refined. If no, the individual is blamed. AI is about to bring this model to every company." — 04:00

"Claude rewrote Raiden Pico — a framework two of us spent over a year building at IBM X-Force — in three days." — Adam Laurie, in the prior session, referenced by context

Key Takeaways

• Build a unified personal AI system rather than a collection of disconnected tools. Centralized context, reusable skills, and compounding capability compound over time in ways that isolated tools cannot.
• Companies are moving from human-run to process-run — AI requires explicit SOPs to operate against. Security's long-sought goal of embedding security into the development process may finally be achievable now that AI generates most code.
• Debate and Iterative Depth are high-leverage prompting techniques: running multiple specialized agents in structured debate, and repeatedly asking the same question from different angles, both produce dramatically better outputs than single queries.
• Composable actions (Arbol model) are more valuable than monolithic scripts: discrete, reusable units that can be chained into pipelines and deployed locally or in cloud workers give you a security research platform that grows with use.
• The strategic imperative: systematize your expertise into a unified AI harness before someone else does it for you. The practitioner who encodes their knowledge as compoundable AI skills is the one who remains relevant as AI commoditizes rote security work.