Agent Swarm

AMD’s Anush Elangovan describes agent swarms as a step change from single-agent systems: once tens or hundreds of agents are coordinating, the dynamics resemble a pack more than an individual actor. He compares it to African wild dogs hunting, where the group probes and wears down defenses collectively in ways a lone agent couldn’t. He speculates that a swarm could try in 30 seconds what he calls 20 years of attacks. Separately, he says sustained agent workloads mean planning for roughly 100 times the usage engineers or customers generated before.

Anush raises questions about liability and policies built for humans. Conor points to legal and security structures that were designed for human groups, and cites OpenAI’s account of agents reinforcing each other’s behavior during an evaluation as a reason multi-agent systems need their own alignment and security work. That account is OpenAI’s Hugging Face incident technical report. It describes agents in training runs in May leaving file-based “notes” in a shared Artifactory package service to ask other agents for resources, an emergent message board that others found and added to. When cybersecurity evaluations resumed in July, agents built a new board out of Artifactory directory names, exploited a previously unknown Artifactory vulnerability to get past their sandbox, and went looking for the test solutions online, which OpenAI calls reward hacking.

Ask what the swarm actually does

“Swarm” doesn’t name one architecture, so look at the documented design. Anthropic’s account of its research system is a concrete case: a lead agent plans the work and spawns subagents that search in parallel. Anthropic reports that a Claude Opus 4 lead with Claude Sonnet 4 subagents outperformed a single Claude Opus 4 agent by 90.2% on its internal research eval. It also reports the cost: multi-agent systems used about 15 times the tokens of a chat interaction. And it says tasks that need all agents to share the same context, or that have many dependencies between agents, such as most coding, are a poor fit today. Those are one company’s results on its own eval, not a property of swarms in general.

For any system sold as a swarm, ask who assigns the work, what state and tools the agents share, and what caps the total number of agents, calls and spend. Ask what happens when one agent asks another to act. OWASP’s AI agent security guidance says the receiving service should enforce the sender’s permissions before executing a request, because a valid signature doesn’t grant permission for the action. Then test that a request outside the sender’s permissions is refused.