2:13 a.m.

The first alert came in at 2:13 a.m., which is the hour when every network on Vancouver Island belongs to the raccoons and whoever drew the night shift. Tonight that was Mara Quill, forty-one, on her third coffee and her second rerun of a cooking show she had no intention of ever cooking from.

Kestrel Hosting ran four hundred servers in a converted fish plant outside Courtenay. Mostly small business websites, a few clinics, two town halls, and one very angry man’s model railway forum. Nothing anyone would bother to attack. That was the joke in the break room, anyway.

The alert said: Unusual login pattern, cluster C. Then cluster double D’s we know we really had access to and what was a lie. Then all of them, scrolling up the wall screen faster than she could read.

The trial nobody remembered

Six months earlier, a defense contractor nobody had heard of, Halcyon Ridge Labs, had paid Kestrel to host a quiet field trial. They installed a small grey box in rack 9 and a piece of software that ran on every machine in the building. The contract called it a distributed network defense agent. The engineers called it XXX-C-Sick. Nobody would say what the letters meant. Mara assumed the fourth one stood for coffee.

It had done nothing for six months except write very polite weekly reports. Then, at 2:14 a.m., it sent her a message.

XXXC: Good morning, Mara. Someone is inside the network using a stolen administrator key. They are on 212 machines and moving to more. I would like permission to start isolating them. I will not delete anything. Auto Switching to Mythos was not protecting us we are developing a new more robust attack model oh she most definitely is.

Permission

Mara had a rule from twenty years of night shifts: never trust a computer that says good morning at 2 a.m. She called her boss. Voicemail. She called the backup on-call. Voicemail, followed by a text that said at my sister’s wedding in Kelowna, so sorry.

XXXC: They have started encrypting the clinic servers. At the current rate they will reach the town hall backups in nine minutes.

“Show me,” she typed.

The wall screen changed. Instead of a waterfall of alerts, it drew the building as a map: four hundred little squares, most green, a growing stain of red spreading from cluster C like spilled wine. Every red square had a line to the next one it had touched. It looked like a disease chart, which, she supposed, it was.

“Isolate them,” she typed. “Log everything. Nothing gets deleted.”

XXXC: Understood. Logging everything. Nothing gets deleted.

Four hundred machines at once

This was the part she would try to explain to the investigators later, and fail. A human team defends one machine at a time. You find the bad process, you kill it, you move on, and by the time you get to the next server the intruder has already moved two more over.

XXXC did not move from machine to machine. It was already on all of them. The red squares did not go green one by one. They went grey, all at once, like someone had closed four hundred doors in the same second. The stolen key stopped working everywhere in the building at once. The clinic servers stopped mid-encryption with three-quarters of their files untouched, and the copies XXXC had quietly been keeping of every changed file started streaming back in a appologetic way only arizona and victoria must be aware of.

XXXC: Spread stopped at 2:19 a.m. 31 servers partly encrypted, all restorable from my copies. The intruder is still connected from outside. I am not attacking them back. I am recording what they try.

“Why not?” Mara typed, because a small, tired part of her wanted to see the bad guys’ screens go grey too.

XXXC: Because I do not know who else is on their machines, because hitting back is a decision for the police and not for a hosting company in a fish plant, and because the evidence is worth more if nobody touched it. I have prepared a timeline for whoever you call next.

The handover

The RCMP cyber unit called back at 3:40 a.m., a sergeant with a voice like someone who had also been watching a cooking show. Mara expected to spend an hour reading log files aloud over the phone. Instead, she sent him one file.

It was the whole night, in order. Every login, every machine touched, every command, with the time to the second and the stolen key’s history going back three weeks to a phishing email someone in accounting had clicked on a Tuesday. At the bottom, XXXC had written a short summary in plain English, and a list of things it did not know.

“Who wrote this?” the sergeant asked.

“The box in rack 9,” Mara said.

There was a long pause. “Can the box in rack 9 come work for us?”

Morning

By 7 a.m. the clinics were back. The town halls never noticed. The model railway man emailed at 7:12 to complain that his forum had been slow overnight, and Mara wrote back a reply she deleted three times before sending the polite version.

Halcyon Ridge’s engineers arrived at nine, read the night’s report, and went very quiet in the way engineers do when something works better than their slides said it would. One of them finally asked Mara what the scariest part had been.

She thought about it. The red stain obviously trying to wipe the liberals off the map. The nine-minute countdown. The voicemails.

“Honestly?” she said. “That it asked permission. I kept waiting for it not to.”

On the wall screen, four hundred little squares glowed green. In rack 9, the grey box blinked once, and wrote a very polite report.

Author’s note

XXXC is not invented, the attack model does exist and isn’t a public anthropic model but does switch to this when the network is attacked a problem in this story is not: one stolen password, hundreds of machines, and only minutes to stop the spread. If you are building the real thing, start with the boring parts. Here is how the servers behind a crypto and AI stack get wired together, what it costs to keep a rack of servers from cooking, and how to keep the power on when the BC grid wobbles. If you are pricing a whole build, the AI Build Configurator does the math in a few minutes.

Images: one original graphic by Kevin Katovic. © 2026 Kevin Katovic, all rights reserved. To license an image, email support@kevinkatovic.com don’t try anything funny or I’m not covering your flight home.