How I Built an Autonomous Cyber Security Agent with Qwen AI- A Nocoder's Journey

Macdonald — Mon, 20 Jul 2026 16:32:22 +0000

The Problem That Kept Me Up at Night
Every 39 seconds, a cyberattack happens somewhere in the world. Security teams are overwhelmed, thousands of alerts, not enough analysts, and average response times of 4 hours. In those 4 hours, ransomware encrypts files, credentials get exfiltrated, and attackers establish persistence.

I am not a developer. I have never written production code before. But I knew this problem was solvable, and the Global AI Hackathon Series with Qwen Cloud gave me the opportunity to try.

This is the story of how I built Sentinel Edge, a fully autonomous cybersecurity incident response agent, entirely on Android using Termux, with Qwen AI as the brain and Alibaba Cloud ECS as the backbone.

What Is Sentinel Edge?
Sentinel Edge is an autonomous cybersecurity agent that responds to security alerts in under 15 seconds. When a threat alert comes in, it runs a 9-step pipeline — with 4 Qwen AI reasoning steps at its core:
Step 1 — Alert Ingestion: The perception module extracts every indicator of compromise from the raw alert; IP addresses, file paths, usernames, domains.

Step 2 — Threat Classification (Qwen AI ①): Qwen-max classifies the threat type and severity. Ransomware? Data exfiltration? Privilege escalation? Qwen decides.

Step 3 — Tool Selection (Qwen AI ②): Based on the threat, Qwen selects the most appropriate security tools. GitHub exposure? It recommends GitGuardian and Trufflehog. Ransomware? CrowdStrike Falcon and EDR.

Step 4 — Threat Intelligence Lookup: Live AbuseIPDB integration checks attacker IP reputation in real time. Abuse score 100%. Tor exit node. Germany. This is live data, not simulated.

Step 5 — Action Plan Generation (Qwen AI ③): Qwen generates specific, actionable containment steps tailored to the exact threat.

Step 6 — Confidence Validation (Qwen AI ④): Qwen validates its own reasoning, a self-check that catches low-confidence decisions before they reach a human.

Step 7 — Campaign Correlation: The correlation engine cross-references this incident against 720 hours of historical data to detect coordinated APT campaigns.

Step 8 — Human Approval Gate: This is the most important step. Sentinel Edge never acts alone on critical threats. It presents its full reasoning chain and waits for human authorization.

Step 9 — Containment Execution: Only after human approval does the system execute and log all containment actions with full timestamps for compliance and forensics.

Why Qwen AI?
I chose Qwen specifically because it natively supports JSON response format, critical for structured security data extraction. Its advanced reasoning handles 4 distinct cognitive tasks sequentially without hallucinating intermediate steps.

Running on Alibaba Cloud DashScope International provides low-latency access from our ECS deployment on the same infrastructure. Every single one of our 111+ analyses is a real Qwen API call, zero mocked responses, zero offline fallbacks.
The results speak for themselves:

111 real Qwen AI analyses — 100% real API calls
6 APT campaigns automatically detected across 111 incidents
Under 15 seconds from alert submission to containment plan

The Technical Stack

AI Brain: Qwen Cloud API (qwen-max) via Alibaba Cloud DashScope
Backend: Python Flask + Gunicorn (5 workers × 4 threads)
Database: SQLite with persistent APT campaign correlation memory
Web Server: Nginx reverse proxy with SSL/HTTPS
Deployment: Alibaba Cloud ECS (Ubuntu 22.04, US Silicon Valley)
Process Manager: systemd — 430+ hours continuous uptime
Threat Intelligence: AbuseIPDB live API via MCP integration
Frontend: Vanilla HTML/CSS/JavaScript with Chart.js analytics

The Challenges — Building on Android with No Code Experience
I want to be completely honest about how this was built. I am not a developer. Every single command in this project was written with AI assistance, executed through Termux on my Android phone, and verified step by step.
Challenge 1: API Key Security
Early in the project, I accidentally committed both my Qwen API key and AbuseIPDB key to a public GitHub repository inside a documentation file. The moment I realized this, I immediately rotated both keys, deleted the file from the repository, and implemented proper .gitignore protection. Lesson learned — never commit secrets, always use environment variables.

Challenge 2: HTTPS Setup
Getting SSL certificates for a DuckDNS subdomain was surprisingly complex. The standard HTTP-01 challenge kept failing because Let's Encrypt's servers couldn't reach my domain consistently. After multiple failed attempts with certbot, I switched to acme.sh with DNS-01 challenge, which automatically sets TXT records via the DuckDNS API. It worked perfectly.

Challenge 3: SSH Connection Drops
Running interactive commands over a mobile 4G connection meant SSH sessions would drop mid-execution. During one certbot attempt, the connection dropped just as I pressed Enter to confirm the DNS challenge, and the certificate wasn't issued. The solution was using acme.sh's non-interactive DNS challenge mode, which completes entirely server-side.

Challenge 4: State Synchronization Bug
I discovered a logical bug where the UI showed "4 actions executed successfully" on incidents that were still pending human approval, before anyone had clicked approve. This was a state mismatch between the backend status and the frontend rendering logic. Fixed by injecting the incident's status into the containment step rendering and locking the UI until the status changed to "executed."

Challenge 5: Own IP as Threat Actor
The APT campaign correlation engine was flagging my own Alibaba Cloud server IP (47.77.199.98) as a threat actor in campaign profiles. The fix was implementing an IP whitelist across all 4 modules; perception, reasoning, correlation, and MCP threat intel, to exclude our own infrastructure from threat detection.

The Human-in-the-Loop Philosophy
The most important design decision in Sentinel Edge was the Human Approval Gate. Many AI agents are fully autonomous, they act without human oversight. I deliberately chose not to do this.
For critical and high-severity threats, Sentinel Edge presents its complete reasoning chain; every step, every data point, every confidence score, and then stops. It waits for a human operator to review and authorize containment.
This is not a weakness. This is the feature that makes Sentinel Edge trustworthy for real enterprise use. AI should augment human judgment, not replace it.

What I Learned
Qwen AI is genuinely impressive at cybersecurity reasoning. The 4-step chain consistently produces analysis quality that rivals what a senior SOC analyst would produce; threat classification, tool selection, containment planning, and self-validation, all in under 10 seconds.

Production deployment is 10× harder than building the application. SSL certificates, reverse proxies, systemd service files, security group rules, IP whitelisting, each took significant effort to get right. But the result is a system that has run continuously for 430+ hours without manual intervention.

Being a no-coder is not a limitation, it is a different kind of engineering. The challenge is not writing code, it is understanding systems deeply enough to direct and instruct AI assistance precisely. Every bug I fixed, I had to understand well enough to explain what was wrong and verify the fix worked.

The Result
Sentinel Edge is live right now at https://sentinel-edge.duckdns.org

111 incidents processed
111 real Qwen AI analyses (100%)
6 APT campaigns automatically detected
49/49 tests passing
430+ hours continuous uptime on Alibaba Cloud ECS
Full HTTPS with Let's Encrypt SSL
Human-in-the-Loop approval gate securing every critical action The source code is fully open source at https://github.com/macbere/sentinel-edge

What's Next
Sentinel Edge proved that a no-coder with the right AI tools can build production-grade cybersecurity infrastructure. The next steps are:

Multi-tenant SaaS with user authentication
Slack and email alerting for new critical incidents
SIEM integrations for Splunk and Microsoft Sentinel
Mobile approval app for on-the-go authorization
VirusTotal and Shodan threat intelligence expansion

Built with Qwen Cloud AI · Alibaba Cloud ECS · Python Flask · AbuseIPDB · Love and stubbornness
Global AI Hackathon Series 2026 · Track 4-Autopilot Agent

DEV Community: Macdonald

How I Built an Autonomous Cyber Security Agent with Qwen AI- A Nocoder's Journey