LunaSec: An autonomous security bot that knows when to hesitate
Yesterday morning, a cold email landed in the general inboxes of BitwareTunes, our independent music imprint.
The message was signed “Dr. Shamielle Alston” on behalf of the “Academy of Emerging Music Arts & Sciences” (AEMAS). The pitch was polished and complimentary: it praised the intersection of human imagination and artificial intelligence, extended an invitation to our AI artist roster, stated that “this is not a paid placement,” and announced the inaugural 2027 “Ellison Awards” with submissions opening on November 1.
In a standard corporate setup, one of two things happens to an email like that. Either an email filter quietly dumps it into a spam folder, or an employee forwards it to an internal security inbox where it sits in a triage backlog for days until an analyst skims it between meetings and marks it closed.
At Bitware Labs, the email never touched a human queue. It was intercepted by LunaSec, our autonomous security bot.
Within minutes, LunaSec reviewed the sender’s public footprint, collected the facts that AEMAS had published about itself, listed what it could not verify, and drafted an advisory for our review. The published result is a consumer advisory on our imprint’s site (bitwaretunes.com/ai-music/ellison-awards-warning).
LunaSec handled the investigation and the first draft without human intervention. But the interesting part of the architecture is not what it can do on its own; it is the strict boundary that governs what happens when it isn’t sure, and who decides what is fair to say in public.
The Review: Parsing the Pitch
LunaSec doesn’t read incoming solicitations like a human hoping for industry validation. It parses them as an intelligence pipeline, and it separates what it can establish from what it can only suspect.
The email arrived from info@aemas.org. The language followed a familiar pattern for awards outreach: open with flattery, present the organization as an established “Academy,” state early that the message is not a paid placement, and then point to an upcoming submission window.
LunaSec reviewed the sender’s public footprint and AEMAS’s own published material. It sorted its findings into three groups.
- Stated by AEMAS: AEMAS says it was established in 2026. Its submissions page lists a fee of $500 per entry, per category, non-refundable, which guarantees consideration only. It lists 32 categories, a submission window of November 1, 2026 to February 28, 2027, and an inaugural ceremony date of November 13, 2027.
- Not independently verified: The legal entity behind the program, the identity and credentials of the five judges, sponsors and partners, the venue, and how the fee is allocated. “Not verified” means only that LunaSec could not confirm them. It does not mean they are untrue.
- Context: The Ellison Awards are an inaugural program, so there are no previous winners and no track record yet. A new award can become meaningful over time. In our opinion, artists should simply understand that before paying.
Awards that charge entry fees are common, and many are legitimate. The useful habit is to check the fee terms, the judges and the organization before you pay, not after you have told your friends you were nominated.
Autonomous Execution: Giving the Bot Hands
Most security bots in the modern enterprise are essentially noisy RSS feeds. They ingest telemetry, calculate an anomaly score, and dump a notification into a Slack channel: “⚠️ Medium Severity: Suspicious outbound link detected.”
A bot that can only notify is an expensive way to increase human cognitive load. Against machine-speed adversaries—spammers who automate entire scraping, domain acquisition, and cold-outreach loops—passive alerting guarantees you are always behind.
LunaSec is built on a different principle: if the bot has the capability to establish the facts, it must have the agency to act on them.
LunaSec handled the first stage of the incident on its own. It did not publish anything or accuse anyone. Its job was to establish what it could, and to prepare:
- Evidence Capture: It preserved the raw message headers and the text of both emails as received.
- Source Review: It collected what AEMAS itself had published: the $500 per-category fee, the non-refundable terms, the submission dates and the stated categories.
- Open Questions: It listed what it could not verify, such as the legal entity, the judging panel, the sponsors and the venue.
- Draft Advisory: It drafted a public advisory for human review. After that review, the advisory was revised to attribute each fact to AEMAS’s own materials, label opinion as opinion, add a right of reply, and avoid any allegation of wrongdoing. It is here: The Ellison Awards & AEMAS: What AI Artists Should Know Before Paying $500.
The takeaway is that the bot did the legwork in minutes, and a person decided what was fair to say in public.
The Hesitation Rule
Granting an autonomous AI agent the power to fire off registrar takedown notices and publish public advisories sounds alarming if your mental model of AI is a conversational chatbot. An agent that hallucinates or acts impulsively with external APIs could easily cause reputational damage, trigger legal liability, or file false abuse claims against legitimate partners.
The reason LunaSec can operate safely with live execution privileges is because its autonomy is bounded by a single, non-negotiable architectural invariant: The Hesitation Rule.
LunaSec is permitted to decide what to do and handle cases independently—but if it ever hesitates, it must escalate to a human before any action is taken.
In software architecture, "hesitation" is not an emotional state; it is a rigorous mathematical boundary. LunaSec evaluates its findings against a strict confidence and blast-radius matrix:
| Evaluation Dimension | Deterministic Autonomous Execution | Mandatory Human Escalation (Hesitation) |
|---|---|---|
| Domain Provenance | Newly registered domain with no verifiable footprint | Aged domain (>2 years), mixed DNS history, corporate registration |
| Infrastructure Signal | Multiple independent technical indicators of abuse | Dedicated enterprise mail servers, authenticated corporate infrastructure |
| Entity Attribution | Clear, documented technical evidence of abuse | Registered company name, existing trademark, partial entity match, or any claim about a named person or organization |
| Action Blast Radius | Internal flagging, evidence collection, draft advisory | Registrar or hosting reports, public statements, network-level blocking, legal correspondence |
| Confidence Floor | Convergence across all sources, no conflicting indicator | Any single conflicting indicator or unverified data source |
When every indicator is unambiguous and the action is low-impact, there is little room for doubt, and LunaSec can proceed on its own. The AEMAS case was a useful reminder that “unaccredited,” “newly registered” and “unverified” are not the same as “proven wrongdoing.” Those are questions to ask, not conclusions to publish. That is exactly where the human review belongs.
However, the millisecond a case touches ambiguity, the system halts.
If an outreach originates from a domain with ten years of continuous legitimate corporate operation, or if a corporate entity is found in official government registers, or if an action could impact innocent shared infrastructure, LunaSec hesitates.
When LunaSec hesitates, execution freezes. It does not drop the issue or guess. It synthesizes the complete investigative dossier, highlights the specific conflict or ambiguity that caused the hesitation, and dispatches a high-priority alert to the human on-call engineer:
“OSINT completed for target entity. 4 indicators malicious, 1 indicator ambiguous (valid corporate entity match in Delaware registry). Confidence: 84%. External actions paused under Hesitation Rule. Dossier compiled for human review.”
Zero abuse reports are sent. Zero public warnings are published. The human reviews the synthesized dossier, evaluates the context, and either authorizes the action or adjusts the classification.
Defending at Machine Speed
Yesterday’s incident was a small one: an unsolicited awards pitch. But the mechanics behind it point toward the future of defensive infrastructure, and the review step turned out to matter as much as the speed.
Modern online threats are no longer driven solely by manual scammers typing out individual phishing notes. They are powered by scraping scripts, automated outreach bots, and synthetic media pipelines. When the adversary operates at machine cadence, an organization whose defense relies entirely on manual triage has already lost.
LunaSec demonstrates how to close that gap. You do not replace human accountability with an unconstrained black box. Instead, you build autonomous agents with real execution tools, allow them to resolve unambiguous cases at the speed of the wire, and enforce a hard, deterministic tripwire that demands human judgment the exact moment the machine hesitates.
The public advisory, including the emails as received and a full disclaimer, is available on BitwareTunes: The Ellison Awards & AEMAS: What AI Artists Should Know Before Paying $500. It is a consumer advisory and statement of opinion; it does not allege that AEMAS or any individual has committed fraud or any crime.