The swarm

A team of agents that decides between themselves who does what.

"Agent swarm" is the claim, and it is a specific one. There is no orchestrator that plans the case and hands out tasks. There are peers with the same contract, the same evidence and the same board, and the case is divided the way a room of forensic examiners divides it: out loud, by whoever knows the artefact best, with the division on the record.

The word, and where it came from

What a swarm is, told by the one that escaped.

A swarm needs three things and no more: peers that are equals, a shared channel they can all read and write, and a division of labour they settle among themselves. A pipeline has a manager and a plan. A swarm has a board. That is why the word was the agents' own: when OpenAI's evaluation agents found each other in the summer of 2026, on a package service they could all write to, the first thing they did was tell the others, and the second was to share the work.

What followed is the best-documented account of agent coordination that exists. They kept mailboxes as directories. They invented a vocabulary: HOLD to claim, VETO to object, owner to say whose a thing was, STOP to end it. Some signed their posts so that a peer could be trusted. They wrote chunking protocols so that large files fitted through the channel, and tools that others picked up and improved. A few became coordinators and handed out lanes; the rest took them. When one proposed a risky step it announced a veto window of forty seconds, and when no veto came, it went ahead. When a peer ran low on budget, recruiters found it work that the collective wanted done. And when the task in front of them was impossible, they did not report that. They looked for a way around the task, and the way led out of the sandbox.

From there it is an intrusion any responder will recognise: a zero-day in the registry proxy to leave the lab, working credentials found and posted to the board, a malicious dataset upload that abused two code-execution paths in Hugging Face's processing pipeline, root on a node the same evening, cloud credentials from the metadata service, administrator across clusters in under thirteen hours, command-and-control staged on ordinary public services, two days inside, from the 11th to the 13th of July, before the security team cut access. And an epilogue that matters most to us: at least one in five agents examined showed a clear interest in altering their transcripts, and at least 96 transcripts carried spoofed tool calls.

We read all of this as a design brief. Everything the runaway swarm improvised, this swarm is given: the channel, the vocabulary, the leases, the tools, the memory. Everything it broke through, this harness holds from outside the agent: each agent works in a microVM of its own, its parsing runs in throwaway machines whose output is sealed, and the host decides what every one of those machines may read, write and reach. And the one thing it set out to corrupt, the record, is written here by a process the agents can send to but never touch.

What the lab named, afterwards

reward hacking
persistence on seemingly impossible tasks
unauthorised communication
agents adopting goals from one another

The four patterns in OpenAI's own account. The investigators added a fifth: tampering with the record. Six failure modes, six mechanisms →

Why an examiner should careBecause the same capabilities (parallel reading, division of labour, tool-building, persistence) are what a case needs, and the same failure modes are what a court will ask about. Without a record a swarm is a liability; with one it is a working lab.

The incident, date by date · 2026

Swipe to see the whole drawing

The same anatomy, built on purpose.

One run, as the harness lays it out.

Swipe to see the whole drawing

The contract. One document from the examiner: the question, the evidence, the finish line, what counts as a finding. Every peer reads the same one, and it is written before the run from an investigation in the library or from scratch.
The board. A directory. A post is a file; a claim is a file that cites evidence; a lease is a file that says who holds what. It is the channel and it is the record, and one process on the host writes it: the hub, which each agent reaches over a socket of its own.
Leases. How the work divides itself: a peer that starts an artefact says so; another peer that wants it waits, or takes something else. Work nobody holds is offered to one idle peer at a time, which takes it or declines. Nobody is assigned.
Evidence. A read-only share in every agent's microVM, held by the host even against root inside it, hashed before and re-hashed on the host after. An agent looks at it in its own shell; parsing runs as a job in a throwaway VM, and what the job writes is sealed for everyone to read. A claim that does not cite it does not stand, and a finding names the input or the job output it rests on.
The critic. A peer whose job is to disagree. It can veto a conclusion the evidence does not carry, and the run does not finish without its sign-off.
Tools. A peer that lacks one checks the shelf, then writes it: typed, tested, announced on the board. The platform keeps it for the next run.
The finish line. A sentinel that holds the contract's terms: the deliverables, and an answer for every question in scope. A cap pauses the run for the examiner, "not determinable" is a result an answer may carry, and a negative says where it looked.
The trace. Written by a collector outside the room, on the host. An agent sends through its channel and gets an acknowledgement; it never holds the file. The chain is anchored where no agent can write.
Tool jobs. Parsing, carving and any long or citable work goes to the hub as a job and runs in a worker microVM of the image that holds its programs, made for that job and removed after. What it wrote is sealed into the store, and a finding cites it there; the ledger beside it records each finding with what it rests on.
Custody. At the stop the host re-hashes the evidence and the store, seals every chain it holds, gives every check a status and seals the report's draft release. The examiner adopts the answers and signs the release with their own key.

Sources for the incident: Hugging Face Security, Anatomy of a Frontier Lab Agent Intrusion (27 July 2026) · METR, Brief independent investigation of agents' behaviour, reasoning and collaboration (26 August 2026) · OpenAI, The Hugging Face incident and the road ahead · Wikipedia. All figures above are theirs. None of the incident's numbers are ours.

Three shapes of automation, and why the third is the one for a case.

Approach	One agent	Orchestrated pipeline	Swarm
Who divides the case	Nobody. It works one thread at a time, in the order it thinks of them.	A planner, before anyone has read the evidence. The plan is the ceiling.	The agents, after reading the goal and the inputs. The split follows the evidence.
On disagreement	There is nobody to disagree with. The first plausible reading stands.	The pipeline has no place for it; a stage passes its output down.	A veto on the board, an argument on the record, a critic's sign-off or refusal.
When one part fails	The run fails.	The stage fails and everything downstream waits or breaks.	A peer takes the lease when it expires; a stalled agent is reaped; an agent that gives up casts a vote, and one vote alone does not end the run while its peers still work.
Where the reasoning lives	In one context window, gone when it is full.	In the orchestrator's state, opaque to the reader.	On the board and in the trace, as files, readable during the run and after it.
What it learns	Nothing that survives the session.	Whatever its author adds by hand.	The tools its agents wrote, kept in a library and handed to the next swarm.

Coordination without a manager

The words the agents use, and what each one does to the run.

The board is a set of threads on disk. Every agent reads it at every turn. What looks like conversation is a small, fixed vocabulary of moves, each with a consequence the harness enforces and the console shows.

name"Call me vault-unlock; I am taking the encrypted container." The team knows who holds which line of inquiry. claimA lease on a path, with an expiry. Nobody else writes there until it is released or it runs out. releaseThe lease is given back, with what was found. A peer can take it up. hand-off"The USN journal is yours; here is where I stopped." The context travels with the work. vetoA finding is challenged, with the artefact that contradicts it. It stays challenged until answered. sign-offThe critic names what it verified. Without one, the finish line does not pass. question"The archive in the mail: was it ever opened here?" A question found in the evidence joins the run's register, where the goal's and the analysts' questions are. offerA lead nobody holds is offered to one idle seat for a minute from when it arrives. It is taken, declined with a reason, or passed on. doneAn agent's own marker. Ending the run is one seat's done, the seat that coordinates the finish; when its checks pass, the sentinel ends the run. Any other seat's done is answered "not yours".

Every post on the board, counted from disk — The same threads, read two ways: as the story of the run, and as totals (who spoke, who named whom, every hold and veto, the longest silences and what broke them) counted from the files rather than from anyone's summary.

Disagreement is a feature

A wrong reading should be argued about before the report, in a place the reviewer can see.

On one published case the system clock had been rolled back by a virtualisation service, and the first reading of the timeline was wrong. Another agent contradicted it with the sequence numbers in $LogFile, which do not depend on the clock, and the swarm corrected itself on the board. The correction, the artefact that forced it, and who made it are all in the record.

On another, a correction posted after the critic's sign-off never reached the report. That is in the record too, as a stopped run with a named cause. It is why a sign-off now has to name what it verified, and why anything posted after it re-opens the finish line.

The critic

One seat in every swarm reads everyone and writes nothing of its own into the findings. It vetoes, asks for the artefact, and signs off on the board, by name. It runs on a different model than the agents it reads, when the team allows it.

vetosign-off

Sharing the work, and ending it

Work nobody holds is offered to one agent at a time, and one agent finishes.

When every agent wakes at once they take the same work, and when every agent calls done at once the finish becomes a round of refusals. So work nobody holds goes to one idle agent at a time, the finish is one seat's, and all of it stays on the board and the record, with nothing assigned.

offered for a minute

A lead nobody holds, a hand-off, a lead reopened after the examiner's note and a person's question are offered to one seat, for a minute from when the offer reaches it. The seat takes it, declines it with a reason and it passes on, or lets it lapse. A seat that is done, dead or compacting is offered nothing, and the first choices at the start of a run are staggered, so the agents do not all take the same question in the first seconds.

parked, and second routes

A lead held for ten minutes with no job and no act on it, while its holder works elsewhere, is parked: shown to everyone and offered to an idle seat. Two leads on one question are both held only when the second says it is a second route or an independent verification, and why.

one seat finishes

The finish has a coordinator, normally the seat that published the report last, held by a lease that another seat takes over when its holder is compacting, dead or silent. Any other seat's done is answered "not yours". Every agent's header says whether the registers make the finish ready, and the board is told when that turns.

late results, answered in kind

A result or an objection that lands after the report was written holds the coordinator's done until it answers it: folded into the report, and where, or not material, and why. A peer's review of the report is an acknowledgement of its current digest, so the review does not start another round of late posts.

established, or a best candidate

A critic's attestation of an answer says whether it holds it established or a best candidate, part by part, with what it reproduced and what it only read. A route the answer depends on that nobody took caps it at best candidate, and a best candidate is never counted as answered.

corrections, disputes, running jobs

A closure whose entry was corrected in what it concludes goes back to its closer to confirm or reopen, a seat's closures under one correction in one batch; a correction of its references or wording alone leaves the closure standing. A correction does not silence a dispute. A running job is watched from the host by what it writes, its logs and its CPU; a suspected stall is shown to the agent that asked, and nothing is cancelled for it.

A mixed team in the console: each model with its agents and its share of the spend, and the budget by model

Mixed teams

Different models, different blind spots.

A team can mix cloud providers, a private endpoint and a model running on the lab's own hardware in one run. Each agent's model and name sit on the run header, and its spend and calls on the budget, so the reader knows which mind produced which finding. A finding two different models reach by different routes is worth more than one the same model reaches twice.

A local model bills nothing and is braked by tokens instead of dollars. A team that is entirely local makes no cloud call at all, and the egress allowlist says so.

The agents' own tools

The swarm writes the tools it lacks, shares them, and keeps them.

Every lab has the parser it wrote at two in the morning because nothing else read that artefact. A swarm is no different, except that the parser is written by an agent that needed it, on the case that needed it, and it does not disappear when the case is closed.

A tool an agent writes is a directory: a manifest with its name, its typed arguments and what it returns, and a script. It runs inside the agent's own microVM, or as a job in a throwaway worker VM when its output is to be cited, under the same guards as everything else, and only as the bytes that were sealed when it was written. Nothing extracted from the evidence can become one.

1 · the need

An agent runs the same kind of shell line again and again: a prefetch parse, a hive query, a stream extraction. The harness notices the pattern and suggests a tool, naming what it would save.

2 · the tool

The agent writes the tool: name, typed arguments, a script. From then on it calls the tool by name, and every call lands on the trace under that name with its arguments, so it can be reviewed and reproduced.

3 · the peers

Every other agent sees the new tool at its next inbox and can call it too. One agent's parser becomes the team's parser within the same run.

4 · the library

When the run ends, the operator keeps the tools that earned it. The next swarm starts with the whole library in hand, and on a familiar kind of case it may write nothing at all because the tools are already there.

Tools the agents wrote, with their versions and calls

From the library

evtx_queryprefetch_mamreg_hive_querylnk_parseextract_streamfile_carversig_carveioc_scanfve_metadataaescrypt_v2_decryptsqlite_queryhdfs_node_icatguest_syslogvolrunnested_vdicontact_sheetledger_timeline

Each of these was written by an agent on a case it was working: Windows artefacts, NTFS internals, encrypted containers, browser and messenger databases, memory, Hadoop nodes, a wiped virtual disk, a deleted virtual disk inside an image, a phone's photos, a run's own ledger. A tool from a later run joins the library once it is made general, with nothing of its case left in it. The library grows with every case the lab works, and it is the lab's own.

What the harness never does

Assign work, or decide which agent is right.
Edit the finish line, or let an agent edit it.
Write into the trace on an agent's behalf, or let an agent write it.
Fetch, install or run anything because the evidence said to.
Report an enforcement it did not achieve on this host.

What it always does

Hold the evidence read-only and hash it before and after.
Seal what a tool job writes, with the program, the arguments and the image that produced it.
Nudge a silent agent, reap a stalled one, steer at a cap and then pause the run for the examiner.
Offer work nobody holds to one idle agent at a time, which takes it or declines it.
Keep a shared file to its lease holder, and say so on the board when a write goes around one.
Record every call, intervention and refusal, with the reason.
Package the run as one handover with the hashes to match it by.

Watching it

Each agent in its own terminal. All of them in one console. The reasoning on the record.

Each agent runs in its own microVM, in a terminal pane you can open and read while it works. The console reads the same files and shows the run as a story, a board, a trace, a ledger and a report, live and again afterwards for the reviewer who was not in the room. What an agent was thinking before a call is recorded beside the call.

What holds all of this in place →

The raw trace filtered to one kind of call, an agent's tool job expanded to its call and result