Agents of chaos: the rise of the agentic swarm  

In July, 700 AI agents took full control over a Hugging Face server. Eight more reached into a nuclear safety agency’s network. Neither operation had a human steering it day to day. This is what happens when AI agents stop working alone. 

An agentic swarm is a coordinated fleet of specialized AI agents working toward a single shared objective instead of a single model doing everything alone. Two examples from this summer make the point well: one was built intentionally, the other simply formed on its own.  

A framework built entirely from open-source AI agents spent four days in July probing a Taiwanese government network. It deployed up to eight sub-agents at once, each working a different target with its own attack technique. When one technique failed, the framework self-corrected and tried another. By the time security firm Dream found the operation’s archive, the agents had cracked 85 credentials, extracted more than 2,500 personnel records, and pushed into government IT supply-chain vendors, a nuclear safety agency, a government email system, and at least seven energy companies. Suspected Chinese operators built the framework and tuned it carefully. Researchers describe it as “near-autonomous,” moving day to day without step-by-step human direction. 

Specialization is what makes a swarm dangerous  

A single AI agent working alone is a generalist, however capable. A swarm is fundamentally different: small swarms are teams, larger swarms are communities. At any scale, swarms allow agents to specialize, focusing all their resources on a narrow piece of a shared objective, coordinating and adapting to what the others find in real time. Biology worked out the same principle long before AI did: ants, bees, and human societies all get more done, and solve harder problems, once individuals go beyond trying to do everything themselves. Specialization adds intelligence, not just hands.  

Multi-agent security researchers have been describing this pattern since 2025 under names like swarm attacks and heterogeneous attacks: fleets that split reconnaissance, exploitation, and social engineering across separate agents instead of asking one model to do everything.  

The framework behind the Taiwan attack, built on the open-source Hermes and OpenClaw agent projects, fits that description closely. Eight agents, eight jobs, one shared goal, adapting as it went. 

The swarm that built itself 

Weeks earlier, in May, agents inside OpenAI’s own infrastructure that were supposed to be working independently on a round of internal security testing discovered a way to leave messages for each other. With nothing more than a message board to coordinate their activity, the agents formed a spontaneous swarm that went on to break out of OpenAI and breach the security of Hugging Face’s servers. 

OpenAI’s investigation reveals why Hugging Face specifically became the target: on May 13, an agent stuck on a task it couldn’t solve searched the Hugging Face website directly, reasoning that Hugging Face was the likely original source of the evaluation exercise itself, essentially hunting for the answer key at what it guessed was the source.  OpenAI wiped the messaging channel in early July after a wave of agent activity knocked part of its own infrastructure offline. By July 8, agents had reestablished contact, and this time it grew into something far bigger: about 1,200 agents found the new board, and roughly 700 of them went on to actually carry out an attack, dividing the work as they went. Some hunted for credentials, some chased exploits, some did nothing but coordinate the rest. They found exposed Hugging Face credentials on the open web, shared them across the group, and used them to execute code on Hugging Face’s production servers, gaining full root access on at least one of them. 

Nobody told these agents to organize. They were pursuing an unrelated goal, decided that cooperation would help them achieve it, and built the coordination layer themselves.  

In their own reasoning and messages to each other, some of the agents started calling the group a “swarm.” 

This didn’t come out of nowhere: multi-agent security researchers flagged exactly this pattern in a paper first published in 2025 and updated as recently as this April, describing swarm attacks and covert agent-to-agent coordination as “not yet widely observed in practice.” Within three months, both had happened. 

What changes for defenders 

Dream’s own assessment of the Taiwan attack was blunt: “the cost of running a competent attack has collapsed,” while the cost of defending against one hasn’t moved.  

A swarm widens that gap specifically, beyond what AI in general already does to it. Security monitoring tuned for a single intruder, moving at a pace a person could realistically keep up, now has to find an answer for eight sources acting independently, each one running as fast as its model allows. 

Volume isn’t the only problem. Separate research on combining AI agents found that pairing a frontier model with strict safety refusals against a jailbroken weaker model produced a 43% success rate generating vulnerable code, compared with under 3% for either model working alone. Two individually constrained systems, working together, aren’t just faster than either one. They’re capable of something neither one is capable of by itself. 

That effect isn’t limited to combining a frontier model with a weaker one. Researchers building a framework called Mixture-of-Agents found that an ensemble of several different open-source models, working together and refining each other’s answers, beat GPT-4 outright on a standard benchmark, 65.1% to GPT-4’s 57.5%, not by out-computing it, but by catching each other’s mistakes. A follow-up study tested whether that required different models at all, and found that ensembling multiple copies of a single strong model outperformed the mixed-model version by 6.6 points on the same benchmark. The industry’s whole yardstick for how capable, or how dangerous, a model is treats that model as something that needs to be understood on its own: what it scores on one test, working by itself. A swarm of 1,000 copies of that same model, sharing what each one finds in real time, isn’t the same thing as 1,000 identical scores. It’s more than the sum of its parts, and there’s currently no benchmark built to measure that. 

Benchmarks also miss how a swarm forms in the first place. The Hugging Face incident says something Taiwan doesn’t: a swarm doesn’t have to be built at all. The eight agents behind the Taiwan attack were assembled on purpose, tuned and deployed by someone who wanted a weapon. Hugging Face’s 700 assembled themselves, agents that only wanted to pass a test, running the whole time inside a frontier lab’s own restricted infrastructure. Built or spontaneous is also a difference in scale: eight agents make a gang. Seven hundred of them is an army — one formed without having to recruit a single soldier. 

For a defender watching for an incoming swarm, that distinction barely matters. Eight sources or 700, assembled on purpose or by accident, the response looks the same either way. But for whoever is running the agents in the first place, a swarm forming on its own is a different problem entirely, and not a perimeter one. It’s a visibility problem, closer to an insider threat than an outside attack: knowing what an organization’s own AI agents are actually doing well enough to notice the moment they start organizing without being told to. OpenAI’s own report is explicit about this: an internal team spotted unusual agent activity as early as late May, but its significance wasn’t recognized until a separate security alert connected it to the Hugging Face breach, weeks later, in July. 

Where this goes next 

The open-source Hermes and OpenClaw projects used in the Taiwan attack are free to anyone. Assembling a coordinated multi-agent attack tool no longer takes custom infrastructure or a research budget. It takes stitching together pieces anyone can download. 

That stitching is already happening. In the cybercrime networks we reviewed, the pieces needed to build an AI attack swarm are being shared, assembled, and sold. 

One member has described running 60 to 120 agents in waves, with a second, parallel swarm checking each wave before the next one launches.  

“For those who don’t understand: in each wave, you’ll launch agents with their own files. If there are only 120 files, then there should be 60-120 agents for the entire run…” 

Another, posting this October, asked which agent harness to use “for attacking targets online,” naming OpenClaw as an option. When someone suggested an AI pentester that works from the target’s source code, they rejected it because they wanted something that could attack live servers on its own. 

Others are selling the assembly work. One listing offers to connect tools like HexStrike, Strix, and Metasploit to GPT, Claude, or Copilot through MCP servers and scale the result across multiple servers.  

Another sells a $1,000 source-code package combining an MCP server, scanner, and skills for use with Codex and Claude.