I built an AI IDE where the AI tries to hack its own code here's how the swarm works

Most AI coding tools are built to assist you.

Rogue Studio is built to attack you — specifically, to attack
the code it just wrote for you, find every vulnerability, and
force itself to fix them before you ever see the output.

Here's how I built the adversarial swarm architecture, and why
I think this approach to AI-assisted security is underexplored.

Why I built this

I kept hitting the same wall.

I'm a security-focused developer. I do legitimate vulnerability
research. I analyze contracts, decompile binaries, write PoC
exploits against test environments I own.

And every single AI coding tool I tried would either refuse,
add a disclaimer, water down the output, or quietly route my
code to a server I had no visibility into.

I didn't want a safer AI.
I wanted a sharper one.

So I spent the last few weeks building the tool I actually
wanted to use. I called it Rogue Studio.

It's open source, self-hostable, and it does not apologize
for what it is.

→ github.com/malgatyuvraj/Rogue-Studio

The core idea: make the AI fight itself

Here's the problem with AI-generated code from a
security perspective.

The same model that writes your code is the one
you're asking to review it. It has the same blind spots
in both directions. It wrote the vulnerable pattern,
so it's likely to miss the vulnerable pattern.

The fix is obvious once you see it: use a different
agent with a different system prompt — one that is
not trying to be helpful, but trying to be destructive.

That's Swarm Mode.

Two agents. One goal. No guardrails.
Blue Team → writes the code → signals
↓
Red Team audits for vulnerabilities
↓

↓ ↓
exploit details fed loop terminates ✅
back to Blue Team
↓
Blue Team patches
↓
back to Red Team audit
↓
(hard cap: 3 iterations)

text

The agents communicate through sentinel tokens
embedded in their output stream:

• <done> — Blue Team has finished writing
• <vulnerable> — Red Team found at least one issue
• <secure> — Red Team confirms the code is clean

The orchestrator parses these tokens from the
streaming response in real time and routes accordingly.

Here's the actual loop:

const MAX_SWARM_ITERATIONS = 3;
let verdict = await runSwarm(userTask);
let iter = 1;

while (verdict === "vulnerable" && iter < MAX_SWARM_ITERATIONS) {
  const patchTask = `
The Red Team found these vulnerabilities:
${swarm.redOutput}

Original code:
${swarm.blueOutput}

Patch all vulnerabilities.`;

  verdict = await runSwarm(patchTask);
  iter++;
}

The hard cap at 3 exists because some vulnerability
classes genuinely can't be patched without redesigning
the architecture. If the loop hits 3, it surfaces the
remaining issues to the developer instead of spinning
forever.

What the Red Team hunts for

The Red Team system prompt is specifically tuned to
find these vulnerability classes:

• XSS — unsanitized user input reaching the DOM
• SQL Injection — string concatenation in queries
• Buffer Overflows — unsafe memory ops in C/C++
• Reentrancy — Solidity withdraw-before-state-update
• SSRF — unvalidated URLs in server-side fetches
• Path Traversal — unsanitized file path inputs

Both agents stream simultaneously to a split terminal —
blue glow on the left, red glow on the right. It looks
exactly as dramatic as it sounds.

The part nobody else is building: Air-Gap mode

I want to talk about this one because I think it's
architecturally more interesting than it looks.

Every "local AI" tool I've seen has the same problem.
They support local models but they don't enforce
local-only operation. There's always a fallback,
always a telemetry call, always a condition where
your code leaves the machine without you noticing.

I wanted something stronger than a setting.
I wanted a guarantee.

So I built a physical-looking Kill Switch in the UI.
When you flip it, a middleware layer in
/api/chat/route.ts intercepts every request
before any provider routing happens:

const EXTERNAL_PROVIDERS = [
  "openai", "anthropic", "gemini",
  "groq", "deepseek", "together", "openrouter"
];

const isAirGapped = 
  req.headers.get("x-air-gap-mode") === "true";

if (isAirGapped && EXTERNAL_PROVIDERS.includes(provider)) {
  return NextResponse.json(
    { error: "AIR-GAP VIOLATION: External provider blocked." },
    { status: 403 }
  );
}

The enforcement is server-side.

This is the important detail. A client-side check
can be bypassed by anyone who modifies the request
directly. The server-side middleware means the 403
fires regardless of how the request was constructed.

The only provider that passes through is ollama —
which talks exclusively to localhost:11434.
Zero bytes leave the machine. Not as a claim.
As a code guarantee.

Reverse Engineer Mode

This one is simple conceptually but surprisingly
useful in practice.

One click swaps the entire system prompt for an
aggressive decompiler prompt. The standard safety
instructions are gone. What's left is a prompt
specifically designed to:

• De-obfuscate minified JavaScript and reconstruct readable ASTs
• Parse compiled WASM back into human-readable logic
• Rename obfuscated variables based on inferred purpose
• Explain malware behavior in plain English

No refusals. No disclaimers. No "I can't help with that."

An amber warning banner appears in the UI so you
always know which mode is active. I didn't want
this to be invisible.

Web3 Black-Hat Playground

I added this specifically for smart contract auditors.

One click hits /api/web3/scaffold which initializes
a full Hardhat project in your local rogue_workspace:

await execAsync("npm init -y", { cwd: targetDir });
await execAsync(
  "npm install --save-dev hardhat @nomicfoundation/hardhat-toolbox",
  { cwd: targetDir, timeout: 120000 }
);

It also writes a starter Target.sol with an
intentional reentrancy vulnerability so you have
something to audit immediately:

function withdraw(uint256 amount) public {
    require(balances[msg.sender] >= amount);
    // external call before state update ← reentrancy
    (bool success, ) = msg.sender.call{value: amount}("");
    require(success);
    balances[msg.sender] -= amount;
}

The Black-Hat Agent then generates PoC exploits
against your local contracts to verify your defenses
before you deploy anywhere real.

The route is idempotent. Call it twice, the second
call returns { status: "already_initialized" }
instead of re-running npm install.

Ghost Deploy — Tor .onion Generator

This was the most technically satisfying feature to ship.

The pipeline:
Detect tor binary (which tor)

Spawn http-server on a random open port

Write a torrc with HiddenServiceDir + HiddenServicePort

Start tor daemon with the custom torrc

Poll for hostname file (tor generates this async)

Read the cryptographic .onion address from the file

Stream bootstrap logs to the terminal

Return the .onion URL to the UI

text

The part that took me the longest to understand:
you don't assign a .onion address. Tor generates
one for you from an Ed25519 keypair the first time
it starts with a HiddenServiceDir. You discover
it by reading the hostname file after startup.

const hostnameFile = path.join(hiddenServiceDir, "hostname");
let onionAddress = "";

for (let i = 0; i < 30; i++) {
  await new Promise(r => setTimeout(r, 1000));
  try {
    onionAddress = 
      (await fs.readFile(hostnameFile, "utf-8")).trim();
    if (onionAddress) break;
  } catch {
    // not generated yet, keep polling
  }
}

Poll for up to 30 seconds. In practice it generates
in 3-8 seconds on a warm machine.

Requires: brew install tor on Mac,
sudo apt install tor on Linux.

The API key security fix I almost missed

The production test suite caught something I'd
overlooked: the original implementation accepted
API keys from the request body.

Fine for local use. Dangerous for any hosted deployment.

The fix uses a dual-source pattern — env vars take
priority, client-provided key is only trusted if the
request originates from localhost:

const host = req.headers.get("host") || "";
const isLocalhost = 
  host.startsWith("localhost") || 
  host.startsWith("127.0.0.1");

const ENV_KEYS: Record<string, string | undefined> = {
  openai:    process.env.OPENAI_API_KEY,
  anthropic: process.env.ANTHROPIC_API_KEY,
  gemini:    process.env.GOOGLE_API_KEY,
  groq:      process.env.GROQ_API_KEY,
};

const apiKey = ENV_KEYS[provider] || 
               (isLocalhost ? clientApiKey : undefined);

This keeps the local-first UX intact — self-hosters
can still paste their key into the UI — while being
safe for any cloud deployment.

What the codebase looks like

I spent real time on this.

• TypeScript strict — 0 errors
• ESLint — 0 warnings (37 errors when I started, took a full session to clean up)
• Next.js 14 App Router throughout
• MIT license — do whatever you want with it

The any types are gone. The let declarations
that should be const are fixed. The catch blocks
use unknown and narrow properly. It's the kind
of codebase I'd be comfortable handing to someone
else.

What's next and where you can help

I'm actively looking for contributors. The things
I haven't built yet:

Easy

• Add SSRF and path traversal to the Red Team prompt
• Dark/light theme toggle

Medium

• Playwright E2E test coverage
• Better real-time Tor bootstrap log streaming in UI
• Multi-provider failover when Air-Gap is OFF

Hard

• VS Code extension that ports the agent sidebar
• Multi-file workspace swarm support
• LSP integration for inline Red Team annotations

The codebase is clean, the architecture is documented
in the README, and PRs get reviewed fast.

If you've been waiting for an AI coding tool that
actually trusts you — this is it.

→ github.com/malgatyuvraj/Rogue-Studio

Drop a ⭐ if you think this kind of tooling
should exist. Issues and PRs are open.

If you have questions about the swarm orchestration,
the Air-Gap middleware, or the Tor deploy pipeline —
ask in the comments. I'll answer everything.