CrazyPax: AI-Assisted Security Investigations

An agent-based investigation needs controls around the work: approved scope, permitted tools, execution and spending limits, a way to follow or stop progress, and a report supported by evidence.

CrazyPax is a PaxDynamics initiative led by Andrei “Pax” Popa. The work combines product interfaces, backend lifecycle coordination, scoped access, agent integration, and reporting, using existing tools and preserving their provenance.

The terminal client prepares scope and connects to the service. The console presents investigation progress and evidence. The implementation includes job coordination, operator controls, reconnection, and result export.

Evidence reporting retains finding support, verification state, and coverage limits. Execution completion, report availability, and evidence review have separate states.

• Prepare and retain scope and limits before investigation work begins.
• Keep company credentials in the backend and issue scoped access for jobs.
• Make spending, execution limits, stop behavior, and uncertain outcomes explicit.
• Separate technical evidence from the client-facing report and preserve source attribution.

The repository records deterministic platform, engine, CLI, and browser checks, alongside bounded provider and guest tests. Fixture success establishes behavior under those conditions, rather than live-target assessment quality.

CrazyPax remains in private beta. Hosted customer execution is still under acceptance, and the public site’s demonstrations use simulated output. The PHP series is separate published research.