This is a submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine
The idea for this project came from the time when my cousin installed a cracked game on some sketchy website. Things were fine for about two weeks. However, slowly but surely, the laptop started behaving like a haunted device – its fans started blowing at maximum speed randomly, the CPU was constantly using 95%, there were frequent blue screens and the laptop was shutting down by itself randomly as well. His SSD got fried twice in a short period of time too. There was no way to find out whether the problem was caused by some kind of a mysterious malware that eats up all the resources of the CPU or some serious damage was done to the chip as it got overheated.
My cousin went to a repair shop. They replaced his thermal paste, gave him a new SSD and gave his laptop back, saying that there was no other problems and the laptop was completely fine now. But even after his visit, the laptop experienced the same problems again. Opening any game would shut down his laptop, blue screen would pop up once a day and his CPU wouldn't calm down. He kept complaining to me about his laptop and asked me to help. I didn't know what the problem was either and couldn't figure it out.
The worst part is that standard task managers don't give you proactive warnings. They just hide quietly in the system tray with raw percentage numbers that most people ignore until hardware is already damaged.
That’s why I built Haunted Hardware Exorcist. It's a real-time system diagnostic dashboard that uses TabPFN to spot anomalous background resource spikes, memory leaks, and thermal overloads and utilizes Gemma 3 to translate those metrics into plain-English diagnostics before your machine gets trashed.
What I Built
· A no delay hardware telemetry monitor. The backend polls raw system vitals using psutil every 1,000ms—tracking CPU load, RAM usage, swap pressure, RAM growth rate (ΔRAM), and top resource-hogging process trees without lagging the background system.
· Zero-shot anomaly classification with TabPFN. Instead of relying on dumb, hardcoded percentage thresholds that trigger false alarms during normal tasks, a local or cloud-hosted TabPFN engine evaluates a 5-feature matrix to instantly classify the machine into four distinct states: Sanctified Core (normal), Abyssal Heap (memory leak), Clockwork Daemon (runaway CPU thread), or Infernal Crucible (thermal hazard).
· Plain-English AI diagnostics with Gemma 3. When an anomaly is detected, Gemma 3 analyzes the process list and raw metrics to translate system telemetry into a clear, 2-sentence breakdown of what is happening under the hood, accompanied by a 3-step practical ritual to fix it.
· An interactive seance & stress testing mode. Manual control sliders and a non-blocking CPU load generator (burn.py) let users and hackathon judges simulate heavy hardware stress states live in the browser to test the AI diagnostics without locking up the server or crashing the host.
· A privacy-first, dual-engine runtime. Designed to run 100% offline locally using PyTorch and Ollama (gemma3:4b), or fully hosted on Render’s 512 MB free tier using lightweight API calls to OpenRouter and TabPFN Cloud.
Why Not Use Task Manager?
Windows Task Manager and macOS Activity Monitor are passive, reactive tools that hide quietly in your system tray. They just show you the raw numbers, like 'CPU: 94%' or 'RAM: 88%', next to process names like svchost.exe or RuntimeBroker.exe. They don't tell you whether a spike is a temporary code compilation or a background process slowly frying your laptop, and they certainly don't warn you before thermal stress starts degrading your SSD or frying motherboard power phases. Haunted Hardware Exorcist is better because it bridges the gap between raw hardware telemetry and actionable human intelligence. By analyzing multi-variable trends rather than isolated spikes, it actively flags dangerous resource patterns, translates technical process trees into plain English using Gemma 3, and gives you the exact steps to shut down rogue/unknown processes before your hardware takes permanent damage.
Why Not Just Use an Antivirus?
Traditional antivirus software is built to look for known malware signatures and sketchy file modifications, but it completely misses hardware-level abuse that looks clean on paper. If a background script or game mod isn't actively stealing passwords or encrypting your files, your antivirus isn't going to flag it—even if it's pinning your CPU at 100% for a week straight. Modern crypto-miners and lightweight resource hogs exploit this exact loophole by masking themselves as basic background tasks or harmless scripts to slip right past signature scanners. On top of that, standard security programs are designed for data safety, not hardware survival. An antivirus doesn't track ambient temps or care if your motherboard VRMs are about to pop, because as far as its definition database is concerned, no "malicious code" was triggered. Haunted Hardware Exorcist fills that exact place by ignoring file signatures entirely and looking strictly at abnormal physical load trends, catching dangerous hardware stress before your components cook themselves.
Demo
https://haunted-hardware.onrender.com
Here is the demo website I built using Render. It uses simulated numbers for the stats of the 'Live PC' (since it would only show the stats of Render's cloud container otherwise).
Code
MishtaJohnny
/
Haunted-Hardware
Haunted Hardware project using TabPFN, gemma and Render
đź‘» Haunted Hardware Exorcist
An AI-powered, real-time system diagnostic app built with FastAPI. TabPFN classifies your machine's state, Gemma 3 narrates the haunting and answers your questions, and a public demo is hosted live on Render (with Gemma served through OpenRouter).
Built for the Hacktoberfest Open-Source AI Challenge, Week 4: Ghost in the Machine.
🌟 Overview
Task Manager shows numbers. It doesn't tell you what they mean. Haunted Hardware Exorcist turns machine telemetry into a haunting you can actually read:
-
TabPFN Classifier: reads live system vitals (
CPU,RAM,Swap Pressure,RAM Growth Rate,Top Process CPU) and classifies the machine into 4 entity states, with a possession % showing how far it is from calm- 🕯️ Sanctified Core: the system is calm and healthy.
- 🕳️ Abyssal Heap: a memory leak thrashing swap.
- ⚙️ Clockwork Daemon: a rogue process pinning the CPU.
- …
Get it Running on Your PC
• Install Ollama from ollama.com.
• Download the AI model:
ollama pull gemma3:4b
• Get a free TabPFN token at platform.priorlabs.ai.
• Download the project:
git clone https://github.com/MishtaJohnny/Haunted-Hardware.git
cd Haunted-Hardware
• Install the requirements:
pip install -r requirements.txt
• Copy .env.example to .env, open it, and paste your token after TABPFN_TOKEN=.
• Start the app:
uvicorn app:app --port 8000
• Open http://localhost:8000 in your browser!
How I Built It
The Core Concept
Large Language Models (LLMs) are great at English, but terrible at raw numbers. If you dump hundreds of rows of raw hardware sensor data (voltage, temperatures, clock speeds) straight into an LLM, it may confidently give you inaccurate or completely false codes or completely miss subtle power drops.
I split the job into two parts:
- TabPFN handles the raw numbers. It does zero-shot anomaly detection on tabular sensor data to instantly spot when a hardware component is acting up or is being unusual. No training of the model is required for this.
- Gemma handles the human explanation. Once TabPFN flags an anomaly, Gemma takes that specific data window and writes a clear, plain-English diagnostic report and repair guide. In this project it gives the report in a spooky, exorcist-style manner.
Making Sure the AI Doesn't Lie
Even with clean data, an LLM might suggest adjusting a fan header or voltage rail that doesn't physically exist on your motherboard.
To stop this, a custom Python validation layer checks every sentence Gemma generates against the system's actual hardware specs. If Gemma recommends a fix for a component your system doesn't have, the code strips that line out before you ever see it.
Keeping it Fast & Reliable
- No UI Freezes: Running heavy math models inside the web server will lock up the app. TabPFN runs in a separate background worker pool so the dashboard stays fast and responsive.
- Instant Fallback: If the cloud API for Gemma hangs or hits rate limits, the system instantly switches to a lightweight local PyTorch model. You get immediate diagnostic steps instead of a frozen screen.
- Secure Telemetry Streaming: System metric logs are routed from the local computer to our Render backend through Cloudflare Tunnels, keeping network ports closed and safe.
Tech Stack Breakdown
- AI Engine: TabPFN for instant sensor anomaly detection + Gemma (via OpenRouter) for natural language troubleshooting.
- Backend Hosting: FastAPI app hosted on Render to manage incoming sensor streams and API keys.
- Local Fallback: PyTorch model running locally if cloud calls time out.
- Networking: Cloudflare Tunnels for secure telemetry transport.
Why Does Open Innovation Matter?
Token-based pricing will bankrupt a hardware monitor in ten minutes
Real-time telemetry generates a firehose of sensor data—voltage droops, thermal spikes, and clock fluctuations happening every few milliseconds. If every metric tick triggered a pay-per-token call to a proprietary cloud API, running a diagnostic utility for an hour would cost more than replacing the motherboard you're trying to fix. Pairing TabPFN with open-weight models like Gemma means running thousands of zero-shot metric checks for $0 in token fees.
Kernel logs and system IDs don't belong on someone else's server
Hardware dumps reveal everything about a system: MAC addresses, unique hardware serials, kernel panic logs, and internal network routes. Sending raw system telemetry over the internet to closed-source servers is a major privacy risk. Running open weights locally via Ollama or inside your own isolated container keeps sensitive machine logs where they belong, on the local machine so that there is no need to worry about where your information goes.
A diagnostic tool that dies when the Wi-Fi drops is useless when you need it
Systems usually crash when everything else is breaking down—network interfaces drop, drivers fail, or internet connectivity cuts out entirely. If a diagnostic tool relies on a cloud endpoint to explain why a CPU is thermal throttling, it stops working the exact moment a machine actually breaks. Having open Gemma weights and a local PyTorch fallback running on the machine guarantees the tool works on an offline workbench, internet or not.
You control the workflow
When you build on closed proprietary APIs, your tool is subject to another company's uptime, price hikes, or unexpected rate limits. If their servers go down or they change their API terms, your tool breaks and there is nothing you can do about it. Because this project uses open-weight models and open-source code, the system is yours permanently. If OpenRouter goes down or rate-limits a key, you can switch to a local Gemma instance or point to another host without losing a single feature.
Cases in which closed models win (but why it doesn't matter for hardware)
A massive closed model will write smoother essays and reports and requires less prompt tuning out of the box but that is unnecessary for hardware troubleshooting. You need fast tabular math from TabPFN to catch the anomaly, and hard Python guards to stop the LLM from telling you random answers. Open weights give you full control over the execution stack, zero monthly operational overhead, and a tool that keeps running without relying on permission from a third-party API.
The Spirit of It
Once I created Haunted Hardware Exorcist, I showed my cousin my project. At first he thought this would never work since him and I tried numerous solutions given by AI, YouTube and repair shops. Nevertheless, I knew my project would work. I got it running on his laptop. After a few seconds, TabPFN caught the constant 95% CPU usage and high heat across his processor. Haunted Hardware Exorcist gave us the 'Clockwork Daemon' output. Gemma then matched those sensor spikes to his active running tasks and spotted a hidden resource abuser called systemd_service.exe inside C:\Windows\System32\winevt\Logs running 24/7 that was silently overheating his machine.
Killing that hidden task brought his CPU load down, finally brought the fans' speed down, and stopped the blue screens for good. Watching someone who knows quite a lot about PCs see a problem, which previously cost money and countless tutorials just for nothing to be solved, get fixed in a couple minutes because of my project was when I realized I finally made a solution to a real problem.
Prize Categories
Best Use of Gemma: Gemma (via OpenRouter API) powers all natural language diagnostic summaries and the steps to fix your PC, taking raw telemetry and TabPFN anomaly scores to generate precise, real-time hardware repair guides.
Best Use of Render: Hosts the live FastAPI backend service and Streamlit web app, handling incoming hardware telemetry pipelines, API secret management, and real-time diagnostic reporting.
Best Use of TabPFN: Drives the core failure prediction engine via zero-shot tabular classification directly on multi-sensor system metrics, delivering instant anomaly detection without the need for prior offline model retraining.
Top comments (0)