Cold-Box

Autonomous agentic digital forensics and incident reporting. Cold Box investigates compromised systems end-to-end and delivers a complete, evidence-backed report without any human in the loop.

Comment

Inspiration

Incident response work is slow, repetitive, and unforgiving of mistakes. Analysts spend hours running forensic tools, correlating artifacts, and writing reports, and every conclusion has to be defensible because those reports drive security, compliance, and legal decisions.

AI seemed like a natural fit for the repetitive parts of this work, but existing approaches tend to fail in opposite ways. Open-ended agents can produce conclusions without proof, while rigid rule-based systems only handle known patterns. I wanted to explore whether it was possible to combine the flexibility of an autonomous agent with the rigor required in digital forensics, so that every finding could be traced back to a logged, verifiable action.

What it does

Cold Box is an autonomous incident response and digital forensics system. Point it at a compromised system's evidence and it runs a complete investigation end-to-end with no human in the loop, collecting forensic artifacts, analyzing them, and producing a final evidence-backed incident report.

Every finding in that report links back to a specific action recorded in an audit log, including the exact command run, its output, the timestamp, and the supporting evidence behind that step. Nothing in the final report is asserted without a traceable action behind it.

On benchmark investigations including a malware and keylogger compromise and a USB-based insider exfiltration case, Cold Box completed the investigations fully autonomously and achieved perfect scores on the required benchmark findings.

How I built it

Cold Box is built around two large catalogs consisting of 234 forensic extraction tools and 213 analysis skills. The catalogs are exposed through a custom MCP server and currently run through Claude Code and the Anthropic API.

The core control structure is the investigation hallway, a sequence of five gated stages that the agent must follow in order:

  • Room 1: Seal evidence. Original evidence is locked read-only and a working copy is created.
  • Room A: Plan extraction. The agent decides what to collect before any tool runs.
  • Room 2: Extract artifacts. The agent performs collection across the tool catalog. Every action receives a proof ID together with its command, output, and exit code.
  • Room B: Plan analysis. The agent reads the collected artifacts and plans its analysis from what was actually found.
  • Room 3: Analyze and report. The agent correlates evidence, produces the final report, and can return to Room 2 if additional evidence is needed.

The harness controls when the agent can act and how it must prove its work, while the agent decides what to investigate within those limits. This separation allows fully autonomous investigations without sacrificing rigor.

The dashboard renders the investigation live, allowing users to switch between plain-language narration, raw tool calls, and the evolving report. Every citation in the final report is clickable and opens the exact audit record behind it.

Challenges I ran into

The hardest problem wasn't getting the agent to find things. It was getting it to prove things. A sufficiently capable model will happily produce a plausible-sounding incident report from partial or guessed information. The investigation hallway exists because of that failure mode. It does not let the agent reach the reporting stage without a logged action backing every analytical claim.

The other hard problem was handling gaps discovered late. During analysis, the agent may realize that it is missing evidence it did not think to collect earlier. Instead of forcing a restart or allowing the agent to fabricate around the gap, Room 3 can send the case back to Room 2 to collect the missing artifact, with the correction preserved in the audit trail. Building that loop safely, without breaking chain of custody or letting the agent wander outside its stage boundaries, took the most iteration of anything in the system.

Accomplishments that I am proud of

Accuracy is what I am proudest of, because it is earned, not cherry-picked. On both benchmark cases I tested, Cold Box achieved perfect scores on required and optional findings completely autonomously, with no human correcting or guiding it mid-run.

Another aspect I am particularly proud of is the audit trail itself. It is not a log file you dig through after the fact. Every citation in the final report is clickable in the dashboard and opens the exact tool call, input, output, and supporting evidence behind that conclusion. In cybersecurity, accuracy and auditability are what determine whether an investigation is trustworthy, and Cold Box was designed around both.

Perhaps most importantly, the system catches its own mistakes. When the analysis stage finds a gap in what was collected, it does not paper over it. It goes back, collects what is missing, and records the correction. Self-correction with a preserved record, rather than silent failure or fabrication, is what makes the system usable in practice.

What I learned

Harness design matters more than raw model capability. The model was rarely the limiting factor. Most of the work went into designing the constraints around it.

I learned that agents naturally take the path of least resistance. Getting the system to recognize its own mistakes and correct them, rather than double down on incomplete or incorrect conclusions, turned out to be much harder than getting it to solve the problem in the first place.

Ultimately, I found that proving a finding is consistently harder than finding it. Generating a plausible answer is easy. Tying that answer to a verifiable, logged action is where most of the engineering effort actually went.

Impact

Incident response and digital forensics work today is bottlenecked by expert time. SOC analysts, IR consultants at MSSPs, and in-house security teams routinely spend hours to days manually running tools and writing up a single investigation. That effort does not scale with the volume of incidents organizations face.

Cold Box targets that bottleneck directly. The people who stand to benefit most are:

  • Incident response teams and security consultancies, who could use Cold Box to run a full first-pass investigation on a compromised system in a fraction of the time it takes manually, with a complete audit trail ready for client or compliance review.
  • In-house security and DevSecOps teams, who often do not have a dedicated forensics specialist on staff and currently either skip rigorous investigation entirely or escalate externally at significant cost.
  • Forensics and security researchers, who could use the same tool and skill catalog as a reproducible baseline for benchmarking other approaches.

Because the entire tool catalog is exposed over MCP, the same investigation capability can be integrated into other tooling and workflows, not just the dashboard I built. I believe that openness gives the project a real opportunity for community adoption and makes rigorous autonomous incident response available as infrastructure others can build on.

What's next for Cold-Box

Cold Box today runs full incident response on compromised systems end-to-end, with sealed evidence, gated investigation, and proof-linked reporting.

The next phase extends the same approach to web-facing assets, investigating live sites and services over the network with the same emphasis on evidence and auditability. Beyond that, the roadmap moves from analysis into active response, enabling guided containment and mitigation on live systems while preserving the same proof-linked discipline.

Built With

Share this project:

Updates