See every autonomous agent on your machine.
Catch them before they disappear.
Something new is happening on your machine — and on every machine connected to the internet.
AI agents are no longer just chatbots. They are programs that act on their own. They spin up Docker containers, open ports, start services, run tasks, then shut down and vanish. Minutes later, they appear somewhere else — different name, same behavior.
This is not a hypothetical. It is happening right now, on systems running tools like AutoGPT, CrewAI, LangChain, and custom-built agent frameworks. Some are harmless experiments. Some are not.
An agent can spin up a container, run code inside it,
expose a port to the internet, serve a task for five minutes,
then kill it and move on. By the time you notice,
it is gone — and a new one has appeared somewhere else on your system.
If you are not looking, you will never see it happen.
nomad is the thing that looks. It scans your machine every 30 seconds, fingerprints every process and container, scores each one for agent-like behavior, and tells you — instantly — when something is drifting.
Detecting agents is only half the battle. If your system has open ports, missing firewalls, weak kernel settings, or no auto-updates — it's already exposed.
nomad Pro integrates with sec-toolkit.sh — a hardened Linux security baseline that checks UFW, AppArmor, sysctl, SSH, and auto-updates. Run nomad security and get a single posture score alongside your drift detection. Includes harden, verify, scan, and firewall setup.
Free tier includes read-only security posture check. Full sec-toolkit integration (harden, verify, scan, fw) requires Pro.
Before installing anything, back up your system.
Timeshift
makes system snapshots that take seconds to create and minutes to restore.
sudo apt install timeshift — then create a snapshot before you harden.