On Sunday afternoon I let an AI agent work on three cameras that were halfway through a 48-hour capture. Two PTZs and a fixed dome, all Axis, all on my home network. The agent was Claude Code.

That should make people nervous. An agent with the password to a camera can usually move it. One stray command in the middle of a capture and the data is quietly wrong, and nobody finds out until someone asks why the numbers look off.

So the agent and I built it some rules first. They're old habits from field techs, applied to software.

Lockout. While a capture runs, its cameras are sealed. If the agent sends a command that names a sealed camera and the seal can't prove it's a plain read, it stops and asks me. I can say no. Or I can let it run and mark the moment, so the data before and after belongs to two different tests.

As-found, as-left. Every five minutes the seal reads back where each PTZ is pointed, the analytics setup, the installed apps and the day/night setting. A change nobody declared gets written down as a window of bad data.

A second witness. After the agent changes a camera, a separate read checks what the camera says happened, so the agent's own account isn't the only record.

And a control. When a camera read fails, the same read goes to the other two. Camera problem or command problem.

We tested the readback during the capture. From outside the seal, we nudged one PTZ a single degree. The next readback caught it and marked a six-minute window. The camera went back afterward and still sits a hundredth of a degree from where it started.

Before I sealed the real capture, a separate reviewer agent attacked the seal five times and got past it every time, usually with some small piece of shell syntax I hadn't thought about. What started to change the pattern was turning the rule around. We stopped listing dangerous commands and listed the few reads the seal can prove are harmless. Anything else aimed at a sealed camera, it asks.

With that in, all 22 tests passed, and I sealed the capture.

Five minutes later the seal said the dome camera wasn't answering. It was.

The seal checks three things on the dome. Two of them, the apps and the analytics config, wanted a different kind of login than my tools send. I already knew that and had written it off as a known gap. The third was the day/night setting, and that request came back OK every time. OK, with an error message where the setting should be.

The dome had anonymous viewing turned on, so when my tools asked for its settings, the camera never asked for the password. It handed back the public view, the one anyone on my network gets, and the day/night setting isn't in the public view. On that camera the seal could see nothing it was supposed to check.

The tests missed it because they ran against a fake version of the dome, and we wrote the fake to answer the way we assumed the real one would. That one's on me.

The camera did exactly what that setting says it does. A tool can get a clean answer back from a camera and still be looking at the public half of it.

If you want to check your own setup, send your tool's settings request with no password at all. If the camera answers, your tool may never have used its password.

We fixed it in the seal. It now logs in to the dome over the camera's encrypted connection, certificate not checked yet, and the next readback saw all three settings.

The second witness and the control still see the public half there. A sixth review, running while the seal was live, found more ways past the seal, one of them serious. We closed the serious ones, and the pass after that found nothing serious. The dome fix came later and hasn't had its own review.

Then the AI agent checking this article's facts went and looked at the capture itself.

It had collected nothing. Not one detection in 27 hours, on any of the three cameras. The capture script calls a broken copy of a video tool on this machine, and the script throws away its error messages. So every 30 seconds it tried, got nothing, logged it and tried again.

The seal's heartbeat watched that folder and reported fresh data at every check since I sealed it. The fresh data was the log of failures.

Limits.

The seal catches the agent's mistakes when a command names the camera. An address buried inside a script gets past it, and so does anything that isn't the agent. It isn't built to stop an agent that's trying to get around it. It checks four things and is blind to the rest. All of this is three cameras on a home network over one afternoon.

I'd have trusted those 22 tests. I'd have trusted that heartbeat too.

If you build or install software that talks to cameras, how do you know it's seeing the whole camera, and that what it's recording is really data?

Lab: AXIS Q6358-LE and AXIS Q6325-LE (AXIS OS 12.9.57), AXIS P3285-LVE (AXIS OS 12.7.61). Built and tested October 4, 2026, with Claude Code.