Guardian Autopilot

Guardian Autopilot is an AI-powered multi-agent incident response system that detects exposed credentials, assesses risk, recommends actions, and guides human approval workflows using Qwen Cloud.

Comment

Inspiration

For several years, I worked as a lead developer on cybersecurity and threat detection platforms. During that time, I saw security teams spend valuable time manually investigating leaked credentials, assessing risks, coordinating approvals, and preparing incident reports.

Although I had always wanted to build an AI-powered incident response platform, I never had the opportunity to turn that idea into reality.

When I discovered the Alibaba Cloud Qwen Hackathon and experienced the reasoning capabilities of Qwen, I realized it was the perfect opportunity to finally build that vision.

Guardian Autopilot was inspired by real-world security operations and demonstrates how specialized AI agents can collaborate to detect, investigate, correlate historical incidents, assess risk, and generate executive reports while keeping humans in control of critical decisions.

What it does

Guardian Autopilot is an AI-powered multi-agent incident response platform that helps security teams investigate exposed credentials and security incidents.

The platform automatically:

  • Detects exposed credentials from text or screenshots
  • Identifies secrets such as AWS keys, GitHub Personal Access Tokens, and Slack tokens
  • Investigates business and security impact using Alibaba Cloud Qwen
  • Correlates incidents with previous investigations using Historical Investigation Memory
  • Evaluates operational risk
  • Determines whether incidents should be approved, escalated, or automatically remediated
  • Generates executive-ready incident reports with recommended actions

Guardian Autopilot is available through a Developer CLI, REST API, and Guardian Console web interface, making it suitable for developers, security engineers, and operations teams.

How we built it

Guardian Autopilot was built as a modular multi-agent system using Python.

The platform consists of four specialized AI agents supported by a Historical Investigation Memory service:

  • Parser Agent
  • Investigation Agent
  • Decision Agent
  • Report Agent

A central Guardian Orchestrator coordinates the complete workflow:

Parser → Investigation → Memory → Decision → Report

Our technology stack includes:

  • Alibaba Cloud Qwen
  • FastAPI
  • Streamlit
  • Typer
  • Rich
  • Docker & Docker Compose
  • Alibaba Cloud ECS
  • Provider abstraction supporting Mock and Qwen providers

This architecture enables Guardian Autopilot to evolve into a production-ready incident response platform while keeping every component modular, testable, and extensible.

Challenges we ran into

The biggest challenge was designing a reliable AI workflow rather than simply calling an LLM.

We engineered prompts that consistently returned structured JSON, normalized responses between mock and live providers, coordinated multiple specialized AI agents, implemented historical incident correlation, and packaged the platform as a reusable CLI, REST API, and web application.

We also experienced delays activating our Alibaba Cloud account during the hackathon, so we focused on architecture, testing, documentation, Docker deployment, and local integration while waiting for cloud deployment access.

Accomplishments that we're proud of

We're proud that Guardian Autopilot became much more than a hackathon prototype.

During the hackathon we successfully built:

  • Complete AI multi-agent incident response workflow
  • Historical Investigation Memory with incident correlation
  • Live Alibaba Cloud Qwen integration
  • Executive incident reporting
  • Developer-friendly CLI
  • FastAPI REST API with OpenAPI documentation
  • Guardian Console built with Streamlit
  • Docker deployment on Alibaba Cloud ECS
  • Comprehensive architecture and deployment documentation

Most importantly, we transformed a long-standing idea inspired by real cybersecurity operations into a working AI platform.

What we learned

This project reinforced that building AI systems is not only about selecting a powerful language model—it is about designing reliable workflows around it.

We learned how to orchestrate specialized AI agents, engineer prompts for structured outputs, integrate Alibaba Cloud Qwen into production-style applications, implement historical investigation memory, and design an architecture that can continue evolving beyond the hackathon.

The experience also reinforced the importance of testing, documentation, containerization, and deployment when building trustworthy AI systems.

What's next for Guardian Autopilot

Guardian Autopilot is only the beginning.

Our roadmap includes:

  • Multimodal screenshot analysis using Qwen Vision models
  • Automated credential revocation
  • React-based enterprise dashboard
  • PDF incident report generation
  • Kubernetes deployment
  • GitHub Actions CI/CD
  • PyPI package publishing
  • Docker Hub images
  • Enterprise integrations with cloud providers and SIEM platforms
  • AI-powered remediation agents
  • Continuous monitoring and historical investigation intelligence

Our long-term vision is to build Guardian Autopilot into an open-source, governance-first AI incident response platform that helps organizations safely adopt intelligent, auditable, and trustworthy AI-driven security automation.

Built With

  • alibaba-cloud
  • cli
  • docker
  • fastapi
  • openai
  • orjson
  • pydantic
  • python
  • qwen
  • restapi
  • rich
  • streamlit
  • typer
  • uvicorn
Share this project:

Updates