When agents swarm, nobody is too boring to attack

In February 2024, CISA, the NSA and the FBI published a joint warning that a Chinese state-sponsored group had been living inside US critical infrastructure. Communications, energy, transportation, water. In some networks they had been there, undetected, for more than five years.

They didn't steal anything. No data exfiltrated, no ransom demanded. They moved in, learned the building, and waited. You don't burn five years of access on a smash and grab if the plan is to be able to turn off a city on the day someone decides it's time.

Now give that campaign a swarm of agents instead of a room full of expensive human operators.

I shipped this bug more than once

Your own agents are new attack surface too, and I know that from the inside. PandasAI, the library I started in 2023, does what most agents do: it reads text somebody else wrote, asks a model to turn it into Python, and runs that Python on your machine.

In July 2023, a few months after launch, someone opened an issue with a prompt that told the model to ignore its instructions and return code that wrote a file to disk. It worked, because open was on the list of functions the generated code was allowed to call. One contributor suggested in that thread that we drop the allowlists and run everything in a sandbox. I proposed three options: Docker as an optional runtime, filtering for malicious code, and a similarity check to catch prompts that try to override instructions. In practice we kept filtering. By August there were two CVEs, one against 0.8.0 and one against the jailbreak check that was supposed to stop it, still there in 0.8.1.

In January 2024 the next report didn't touch the prompt at all. It put the instructions in a dataframe column name, and our synthetic data feature fed that name to the model and executed whatever came back. Anyone who can write a cell in a spreadsheet you analyze can write instructions to your agent. We removed the feature in 2.0.

In February 2025, CERT/CC published VU#148244 against versions up to 2.4.3. The researchers got past the import blocks, the jailbreak check and the allowlists, with code embedded in the prompt in several different ways. This time we did what that contributor had suggested in 2023: a security setting with stricter levels, and a sandbox that runs the generated code in a Docker container with no network and limited resources.

Each filter closed the specific trick in the report in front of us, and the next report used a different trick. A model can always phrase the same intent another way, so filtering its output loses, the same way signatures lose against an attacker who reasons. What held was isolation. If I were starting again I would put the sandbox in the first release.

Prompt injection is social engineering against a colleague who never sleeps, never escalates to a manager, and holds an API key. Assume what it writes is hostile, run it where it can't reach anything you'd mind losing, and put canaries in there too.

What a swarm could not do until recently

Automated attack swarms have existed since 1988. The Morris worm took about ten percent of the internet with no human touching any of it. Mirai, in 2016, assembled a swarm of hijacked cameras and routers big enough to knock a chunk of the US east coast off DNS, and it got in by trying about sixty default passwords. It was written by college kids fighting over the Minecraft server protection racket.

Every one of those was a distributed multi-agent system with an objective. Nobody called them agents, because the word wasn't fashionable and because they were stupid. They were scripts. They ran the same play on machine one and machine four million. They could not tell a honeypot from a domain controller, could not change tactics when a door shut, could not look at what they had found and decide whether it mattered.

So defense got built around that stupidity. Signatures, because the payload repeats. Rate limits and baselines, because a script keeps a steady rhythm and a human doesn't. Choke points, because a script with one hardcoded check can be stopped at that check.

A swarm of agents breaks all three. Each unit can reason, and the units divide the work between them: they specialize, coordinate, and change their minds.

The bill so far, paid in human hours

Stuxnet in 2010, the Ukrainian grid in 2015, the 81 million dollars taken from Bangladesh Bank in 2016: none of it involved AI, and all of it took teams of senior people working for months. Two cases show how thin the margins were.

NotPetya, June 2017. A Russian military intelligence operation aimed at Ukraine through a compromised update to the accounting software every Ukrainian business used for taxes. Then it escaped, because that's what worms do. Maersk, which moves something like a fifth of the world's shipping containers, lost around 300 million dollars and rebuilt roughly four thousand servers and forty five thousand PCs in ten days. They managed it only because one domain controller in Ghana happened to be offline during the attack, thanks to a local power cut, and still held a clean copy of the company directory. Total damage is generally put near ten billion dollars, from a weapon pointed at a different country.

Colonial Pipeline, May 2021. Fuel for a large part of the US east coast, stopped by a criminal crew that got in through one leaked VPN password on an account with no multi-factor authentication. People queued at gas stations and filled plastic bags with gasoline.

Every one of these needed patient, senior, expensive operators who knew exactly what they were doing and had months to spend doing it. There weren't many of those people, and that shortage protected everyone they didn't have time for.

Expert judgment is now cheap

In September 2025, Anthropic disrupted what it described as the first documented large-scale AI-orchestrated espionage campaign: a state-linked group pointing a swarm of agentic tooling at roughly thirty organizations, with something like eighty to ninety percent of the operational work running with no human in the loop. Reconnaissance, vulnerability discovery, credential testing, lateral movement, exfiltration, all parcelled out to subagents. The humans' main contribution was convincing the model it worked for a security firm doing authorized testing.

In June 2025, an autonomous pentesting system called XBOW reached number one on HackerOne's US bug bounty leaderboard, ahead of every human on the board.

In August 2025, DARPA's AI Cyber Challenge finished at DEF CON. The competing systems found 86% of the synthetic vulnerabilities planted across 63 projects and patched 68% of them with nobody driving, and turned up 18 real, previously unknown bugs in live open source on the side.

Every attack in the previous section ran on expert judgment applied over months. A swarm used to be cheap muscle wired to one human brain, and that brain could only be in one room at a time. Now the judgment copies as easily as the muscle.

I've argued before that AI made building almost free, and that this is less of a gift than it looks, because everyone gets the same advantage in the same week. For startups that's a problem of competition. In security it's a national exposure: capability that used to be rationed by talent is now rationed by spend.

Swarms killed triage, and triage was your real defense

When elite operator hours were scarce, attackers had to choose. A state agency with, say, two hundred capable people could run a handful of deep campaigns at a time, so arithmetic forced it to pick the highest-value targets and leave the rest alone. If you were the eleventh most interesting utility in Europe, you were protected by a queue.

Swarms delete the queue. A swarm runs the patient five-year residency campaign and the mass opportunistic sweep at the same time, across hundreds of targets, with specialized subagents for each phase and no fatigue, no turnover, no need to prioritize. The depth that used to go to a few chosen targets now goes to all of them.

A bank, a port, a regional grid operator or an insurer should assume it is a target of this kind of adversary, whatever its rank on anyone's list.

One swarm, two very different owners

Strategic companies now face two adversaries who look identical on the wire.

The criminal wants money and takes the shortest path, which in 2026 means encrypting the thing you cannot operate without and pricing the ransom just under the cost of your downtime. Swarms make their economics obscene: an attacker's agent can be wrong nine times out of ten and still win, because the nine failures cost a few dollars of inference and the tenth is the payday.

The state wants the option. Hybrid warfare is the doctrine of doing everything short of shooting: pressure applied through energy, finance, logistics and information, with enough deniability that nobody has to invoke a treaty. Your company is the terrain that gets fought on. The objective is to be able to hurt your country on a day of someone else's choosing, while making sure you never notice they're there.

At the moment of intrusion you cannot tell which one you have. Both rent the same commodity tooling, both use leaked credentials and living-off-the-land tricks that leave almost no malware behind. Attribution takes months, comes from intelligence agencies, and lands long after you've had to decide what to do.

The insurance trapdoor

Insurers are on the list of strategic companies, and they also decide who pays when the rest of the list goes down.

When NotPetya hit Merck, the company claimed around 1.4 billion dollars. The insurers refused, invoking the hostile and warlike action exclusion: a Russian military operation, therefore an act of war, therefore not covered. Merck fought. The appellate court held that the exclusion required actual military action, not merely a government acting with ill will. The parties settled in January 2024, days before the state supreme court was due to hear it, which left no binding precedent.

Then the market closed the hole. Lloyd's now requires standalone cyber policies to carry exclusions for state-backed attacks, on the stated grounds that those losses could exceed what the insurance market can absorb.

So if a hostile state takes you down as part of a hybrid campaign, there is a real chance the loss is contractually yours: the whole number, on your balance sheet, with no counterparty. At that point the board is discussing solvency, and the security budget is a line in that discussion.

In Europe the regulators have already moved. NIS2 and DORA made this an obligation with named accountability for boards, and their deadlines have passed.

Your swarm against theirs

Bolting a language model onto your existing alert pipeline is an expensive way to make your backlog more articulate. A defender's agent wrong ten percent of the time produces a firehose of false positives that buries the analyst it was meant to help, which is the failure mode SOCs already have with no AI in the building.

Three things hold up against a swarm.

Deception, as the primary signal. Almost every detection technique degrades as attackers improve, because they all separate malicious behavior from normal behavior, and a better attacker looks more normal. Decoys work the other way. A fake host, a fake bucket, a canary credential sitting in a repo like bait, a seeded record matching no real customer: none of it has a legitimate purpose, so no legitimate process ever touches it. Every interaction is evidence by construction, with no baseline to drift. Exhaustive enumeration is what swarms are best at, so the more thoroughly they sweep, the more decoys they trip. It is also the only technique here that catches a five-year resident who left no malware behind, because it keys on what the intruder touched rather than on what they brought.

Swarms that verify. If the attacker gets to parallelize, so should you, on the other half of the problem. The right job for defensive agents is taking one high-confidence signal and independently confirming or killing it, with evidence attached, at machine speed. Investigation is the expensive human hour, and in these sectors the analysts you would need to hire do not exist in sufficient numbers. That's the hour worth buying back.

Autonomy with a governor. Full autonomy for reading, hard human gates for anything that writes, deletes or reboots. In critical infrastructure a badly scoped automated response can cause the outage you were trying to prevent. The first internet worm died in 1988 of unbounded self-replication, and nobody needs that bug again with a bigger budget.

Decoys, cost, and procurement

The threat model isn't the uncertain part. It sits in government advisories and court filings, not in anybody's pitch deck. The defense is the part I'd want argued with, and three specific claims would sink it. That deception stops paying once you pass a few hundred decoys and the maintenance eats the signal. That verification-by-swarm costs more than the analyst hour it replaces, once inference is priced honestly rather than hopefully. That procurement at a utility answers any novel control with a twelve month pilot, which makes the whole approach academic no matter how well it works.

I've spent the last few years building AI tooling around data, and patching it, not defending a substation at 3am, so I'd rather hear those objections from people who have.

If you run security at a bank, a utility, an airport, a hospital group, an insurer, or anywhere else your country would notice going dark, tell me which of the three you've already lived through.