A Practical Guide to LLMs in InfoSec: Multi-Agent Orchestration with Claude, GPT, Gemini, and Qwen Using herdr, crush, agy, and pi

The biggest mistake security engineering teams make when adopting Large Language Models (LLMs) is treating a single model and a single chat window as a universal Swiss Army knife. Asking one general-purpose frontier model to simultaneously architect a patch across a 200,000-line codebase, perform an unbiased adversarial security review of its own code, validate exploitability with live payloads, and write bilingual operator runbooks guarantees context pollution, confirmation bias, and data-sovereignty headaches.

Modern security engineering requires role-based model specialization paired with terminal-native multi-agent harnesses. Just as a purple team separates developers, adversarial code reviewers, exploit researchers, and technical writers, an effective AI-augmented InfoSec workflow assigns distinct model families to the specific cognitive tasks where they excel—and connects them through a shared terminal orchestration fabric so the agents can collaborate directly.

In this guide, we break down our production multi-agent InfoSec architecture: assigning Claude (via Claude Code) to repository coding, OpenAI GPT (via the Crush harness) to adversarial code review and testing, Gemini (via the AGY / Antigravity CLI harness) to architectural documentation, and local Qwen weights (via the Pi harness) to vulnerability validation and research—all orchestrated inside Herdr, where agents communicate directly with one another across panes and repositories.

1. The Four-Model Specialization Matrix in InfoSec

Every model family exhibits distinct inductive biases in how it navigates code, reasons about state machines, handles long-context synthesis, and follows tool-use contracts. Rather than forcing one model to do everything, we partition security engineering into four specialized lanes:

Why Separation of Duties Matters for AI Agents

When the same LLM session that wrote a security patch is asked whether there are any vulnerabilities in its own diff, it suffers from severe autoregressive anchoring—it is primed by its own chain of thought to justify the design choices it just made. By handing that diff over to a completely separate model family (OpenAI GPT running in Crush), validating exploitability with a third independent model (local Qwen running in Pi), and synthesizing the architecture and operator runbooks with a fourth (Gemini running in AGY), you enforce true cryptographic and cognitive separation of duties.

2. Deep Dive: The Model Roles

Claude for Coding: Dedicated Per-Repository Ownership

Security engineering rarely happens in a single monolith. A typical defensive platform spans an inline WAF/IPS engine, a telemetry collector, a rule compiler, and purple-team validation harnesses. We assign one dedicated Claude Code agent per code repository.

• Surgical Code Navigation & Tool Use: Claude excels at iterative filesystem exploration—tracing call graphs across headers, understanding subtle pointer lifetimes or async concurrency primitives, and making minimal, idiomatic edits without clobbering surrounding logic.
• Persistent Repo Context: Because each repository has its own dedicated Claude instance living in a dedicated Herdr workspace or tab, that agent never loses track of the repository's build system, FFI boundaries, or domain invariants.
• Defensive Implementation: Whether implementing strict serializer guards, hardening JNI buffer bounds, or building eBPF ring-buffer consumers, the per-repo Claude agent owns the implementation loop from initial branch creation to local compilation.

OpenAI GPT (via Crush) for Code Review & Testing

Once a Claude agent finishes writing a feature or security patch, it does not approve its own work. Instead, review and test verification are handled by one or two OpenAI GPT agents running inside the Crush harness.

• Why GPT for Review: OpenAI's reasoning-tuned GPT models are exceptionally strong at formal constraint checking, spotting subtle off-by-one boundary conditions, identifying unhandled error return paths, and reasoning adversarially about state transitions.
• Two-Tiered Review Topology: In high-velocity sprints, we keep one crush GPT agent focused on Adversarial Diff Review (hunting for bypasses, race conditions, and logic flaws in uncommitted changes) and a second crush GPT agent dedicated to Test Engineering (generating property-based tests, negative boundary fixtures, and CI regression suites).

Gemini (via AGY / Antigravity CLI) for Documentation & Architectural Synthesis

Security tools and patches are only as effective as the runbooks, threat models, and advisories that accompany them. Gemini—running inside the Antigravity CLI (agy) harness—serves as our architectural synthesizer and documentation engine.

• Massive Context Synthesis in AGY: Powered by Gemini's massive context window and Antigravity CLI's multi-workspace awareness, subagent delegation, and artifact generation tools, the agy agent can ingest entire repository trees, RFC specifications, CVE root-cause notes, and raw benchmark logs in a single pass—distilling them into coherent architectural blueprints and Mermaid state diagrams.
• Operator Runbooks & Advisories: When we ship a new detection harness or publish a deep-dive CVE analysis, Gemini in agy transforms raw engineering diffs and exploit notes into structured documentation, deployment guides, and cross-linked English and Spanish technical briefings.

Qwen (via Pi) for Vulnerability Validation & Security Research

Vulnerability research and exploit validation present two unique challenges that cloud-hosted frontier APIs struggle with: safety-filter refusals on benign purple-team tasks and strict operational security (OPSEC) around zero-day telemetry and internal target schemas.

For this role, we run Qwen (such as quantized qwen3.8-flash-next weights hosted on local AMD Radeon RX 7900 XTX GPUs or an internal Strata inference cluster) inside the Pi (pi) harness:

• Zero Telemetry Leakage: Sensitive crash dumps, internal PCAPs, proprietary WAF rule sets, and unpatched vulnerability PoCs never leave the local LAN (192.168.2.0/24).
• True Exploitability Validation: Static scanners and LLMs frequently flag theoretical vulnerabilities that are unreachable in practice. A pi agent powered by Qwen is tasked with proving reachability—crafting concrete HTTP/2 frames, serialized payloads, or fuzzing harnesses against an isolated container lab to confirm whether a bug is genuinely exploitable before engineers spend cycles patching it.

3. The Harness Layer: Crush, AGY, Pi, and Herdr

A model is only as capable as the harness that connects it to your shell, filesystem, and neighboring agents. Here is how our core terminal harnesses fit together.

Crush (crush): The Terminal-First Harness for OpenAI GPT

Crush (crush) by Charmbracelet is a fast, terminal-first AI assistant designed for both interactive TUI sessions and UNIX pipe automation (crush run). In our stack, Crush is the dedicated harness that drives our OpenAI GPT agents.

Configured in ~/.local/share/crush/crush.json with OpenAI's reasoning models and a 128k+ token window, crush gives our GPT reviewers direct, structured access to the repository:

{
  "providers": {
    "openai": {
      "api_key": "env:OPENAI_API_KEY"
    }
  },
  "models": {
    "large": {
      "model": "gpt-5.6-terra",
      "provider": "openai",
      "reasoning_effort": "medium",
      "max_tokens": 128000
    }
  }
}

Because Crush supports both persistent interactive sessions and non-interactive pipeline execution, a reviewer agent can be kept warm in a pane for iterative back-and-forth auditing, or invoked inline against a git diff:

# Non-interactive adversarial diff audit via crush (OpenAI GPT)
git diff main...HEAD | crush run "Perform an adversarial security review of this diff. Focus on integer overflows, buffer lifecycles, and parser state desynchronization."

AGY (agy / Antigravity CLI): The Documentation & Synthesis Harness for Gemini

Antigravity CLI (agy, documented at antigravity.google/docs/cli/reference) is our agentic terminal harness for Google Gemini, purpose-built for deep workspace research, multi-file documentation synthesis, structured artifact creation, and custom skill execution. Moreover, Herdr includes native lifecycle support for agy (via --kind agy and built-in state hooks in ~/.gemini/config/hooks/herdr-agent-state.sh), allowing Gemini documentation agents in AGY to participate as first-class citizens alongside Claude, Crush, and Pi.

Pi (pi): The Extensible Security Research Harness for Qwen

Pi (pi, also at pi.dev) is a lightweight, scriptable coding and research agent equipped with built-in read, bash, edit, and write tools, granular tool allowlists and denylists (--tools and --exclude-tools), and native OpenAI-compatible local endpoint routing.

We pair Pi with our self-hosted Qwen inference servers in ~/.pi/agent/models.json:

{
  "$schema": "https://pi.dev/schemas/models.schema.json",
  "providers": {
    "local-gpu": {
      "baseUrl": "http://192.168.2.2:8081/v1",
      "api": "openai-completions",
      "models": [
        {
          "id": "qwen3.8-flash-next-iq3_xxs",
          "name": "Local Qwen3.8-Flash-Next (RX 7900 XTX)",
          "input": ["text"],
          "contextWindow": 131072
        }
      ]
    },
    "strata-cluster": {
      "baseUrl": "http://192.168.2.254/v1",
      "api": "openai-completions",
      "models": [
        {
          "id": "qwen3.8-flash-next-iq3_xxs",
          "name": "Strata Cluster Qwen3.8-Flash-Next",
          "input": ["text"],
          "contextWindow": 65536
        }
      ]
    }
  }
}

When validating a vulnerability or testing a WAF rule bypass, pi lets us constrain tool execution (for example, granting bash and read inside a sandboxed lab directory while disabling file edits to production code) and adjust reasoning depth on the fly with --thinking high.

4. Multi-Agent Orchestration: How Herdr Lets Agents Talk to Each Other

Having specialized agents is useful; having them talk to each other autonomously without a human copying and pasting terminal output between windows is transformative. That is the role of Herdr (herdr).

Herdr is an agent-aware terminal workspace multiplexer and orchestration server. Unlike traditional terminal multiplexers (such as tmux or zellij) that only see raw byte streams, herdr natively understands coding agent lifecycles. It tracks named agents across workspaces, tabs, and panes, and exposes real-time agent states—idle, working, blocked (waiting on an approval dialog), and done—over a local UNIX socket API and CLI.

The Multi-Agent Security Topology in Herdr

In a standard ColibriSec engineering session inside Herdr, we stand up a coordinated multi-agent topology:

1. Per-Repo Claude Coding Agents (claude-centinela, claude-ojo): Each repository gets its own dedicated Claude Code agent running in a repo-scoped workspace or pane.
2. Standby GPT Review & Test Agents via Crush (gpt-reviewer, gpt-tester): One or two Crush panes powered by OpenAI GPT sit ready in adjacent panes to audit diffs, write unit tests, and verify edge cases on demand.
3. Vulnerability Validation & Research Agent via Pi (pi-vulnlab): A Pi agent running local Qwen sits attached to our purple-team test harness environment, ready to fire live exploit payloads and verify whether a vulnerability is reproducible or whether a newly written patch actually blocks the attack vector.
4. Documentation & Architecture Agent via AGY (agy-docs): An AGY (Antigravity CLI) instance running Gemini synthesizes the resulting code changes, test contracts, and validation telemetry into architectural docs, operator runbooks, and security advisories.

Peer-to-Peer Agent Communication via the Herdr CLI

Because every pane managed by Herdr inherits the session socket environment (HERDR_ENV=1, HERDR_WORKSPACE_ID, and HERDR_PANE_ID), any agent with bash tool access can discover, prompt, wait on, and read the output of any other agent in the session.

Here is a concrete walkthrough of how our per-repository Claude agent orchestrates a full security patch lifecycle by talking directly to the Crush (GPT), Pi (Qwen), and AGY (Gemini) agents via herdr:

Step 1: Discovering Live Sibling Agents

First, the Claude agent working in the primary repository checks the live agent roster in Herdr:

# Verify we are inside a Herdr-managed pane and list active agents
test "${HERDR_ENV:-}" = 1 && herdr agent list

If the testing, research, or documentation agents aren't running yet, the Claude agent can dynamically split background panes (preserving focus with --no-focus) and spin up a pi vulnerability validation agent or an agy documentation agent on the spot:

# Split a new pane to the right without stealing the user's cursor focus
NEW_PANE=$(herdr pane split --current --direction right --cwd "$PWD" --no-focus | jq -r '.result.pane.pane_id')

# Start the pi vulnerability research agent (running local Qwen) in the new pane
herdr agent start pi-vulnlab --kind pi --pane "$NEW_PANE" -- --provider local-gpu --model qwen3.8-flash-next-iq3_xxs

# Split another pane for Gemini documentation via agy (Antigravity CLI)
DOCS_PANE=$(herdr pane split --current --direction down --cwd "$PWD" --no-focus | jq -r '.result.pane.pane_id')
herdr agent start agy-docs --kind agy --pane "$DOCS_PANE"

Step 2: Claude Asks the Pi (Qwen) Agent to Validate the Vulnerability

Before writing a fix—or right after drafting a candidate mitigation—the Claude repo agent messages pi-vulnlab directly to run an exploit validation test against the local target container:

# Claude prompts the pi (Qwen) agent and waits synchronously until pi finishes
herdr agent prompt pi-vulnlab \
  "Validate whether the chunked Brotli trailer overflow in PR branch fix/brotli-bounds is still reachable using the poc_mutator.py harness. Report exact crash offsets or HTTP status codes." \
  --wait --timeout 120000

# Once pi-vulnlab transitions from 'working' to 'done'/'idle', Claude reads its findings
herdr agent read pi-vulnlab --source recent-unwrapped --lines 120

Notice what happens here: herdr agent prompt ... --wait handles bracketed paste, submits the prompt into the pi-vulnlab terminal, observes the agent transition into the working state, and blocks until Qwen finishes executing the exploit harness and settles back to idle or done. Claude then reads the unwrapped terminal transcript directly via herdr agent read.

Step 3: Claude Requests an Adversarial Code Review & Test Suite from GPT (Crush)

Once the patch is implemented, the Claude repo agent doesn't merge blindly. It delegates adversarial code review and test verification to the OpenAI GPT agents running in Crush:

# Dispatch the review task to the GPT reviewer pane running Crush
herdr pane run "$CRUSH_REVIEW_PANE" \
  "crush run 'Audit the staged git diff in src/decompressor.rs for integer wraparound, unchecked slice indexing, and state resets. Output only actionable security findings.'"

# Wait for Crush (GPT) to finish emitting its review verdict and read the output
herdr pane wait-output "$CRUSH_REVIEW_PANE" --match "VERDICT:" --timeout 90000
herdr pane read "$CRUSH_REVIEW_PANE" --source recent-unwrapped --lines 100

Simultaneously, a second Crush GPT agent (gpt-tester) can be tasked with generating boundary regression tests and executing the test runner in parallel. If the GPT reviewer flags an edge case—say, an uninitialized struct field on a partial read error—Claude reads that feedback from the pane, updates the patch in the repository, and re-triggers both the Crush GPT reviewer and the Pi Qwen exploit validator until both sign off.

Step 4: Handing Off to Gemini in AGY for Documentation

Finally, once the code passes GPT's adversarial review in Crush and Qwen's live exploit validation in Pi, the Gemini documentation agent running in AGY (agy-docs) is prompted via Herdr to synthesize the finalized commit range and validation logs into updated architecture docs and operator advisories:

# Prompt the Gemini documentation agent running inside agy (Antigravity CLI)
herdr agent prompt agy-docs \
  "Synthesize the finalized diff in fix/brotli-bounds and the validation results from pi-vulnlab into docs/ARCHITECTURE.md and a bilingual security advisory." \
  --wait --timeout 120000

5. Practical Blueprint: Setting Up Your Own Multi-Agent InfoSec Mesh

If you want to replicate this multi-agent security workflow on your own Linux workstation or remote security lab, follow these five foundational principles:

1. Isolate Repository Ownership (1 Repo = 1 Claude Agent): Avoid bouncing a single coding agent across unrelated repositories. Keep one persistent Claude Code agent anchored in each repo's root directory (or Git worktree via herdr worktree) so its context window remains laser-focused on that component's architecture.
2. Enforce Cross-Model Adversarial Review with Crush (GPT): Never let an agent grade its own homework. Keep one or two Crush instances backed by OpenAI GPT models standing by exclusively for code review, threat modeling of diffs, and test suite generation.
3. Keep Exploit Research & Triage Local with Pi + Qwen: Point Pi at local or internal cluster Qwen endpoints for vulnerability reproduction, payload crafting, and crash analysis. You gain uncensored purple-team utility, zero per-token API cost for heavy fuzzing/triage loops, and complete data sovereignty.
4. Automate Architecture & Advisory Synthesis with AGY + Gemini: Run Gemini inside AGY (Antigravity CLI) so documentation, threat models, and runbooks are continuously updated from live repository diffs and test artifacts rather than treated as an afterthought.
5. Let Herdr Be the Message Bus: Instead of acting as a human copy-paste router between four terminal windows, run your agents inside Herdr. Teach your lead coding agents to use herdr agent list, herdr agent prompt --wait, and herdr agent read --source recent-unwrapped so your Claude, Crush (GPT), Pi (Qwen), and AGY (Gemini) agents close the loop autonomously.