We Ran the Largest Defensive Agent Swarm on Record

Lately, all we've been hearing about is offensive AI agent swarms, and how fast AI-accelerated attacks now move: agents finding bugs, chaining exploits and mapping attack paths at machine speed, and going from first contact to achieving their objective in hours.²

So we asked: what about defense? Where are our agent swarms? How well, and how quickly, can a defensive swarm detect these attacks?

Offensive security has become a highly parallelizable search problem.

Attackers can split the exploration of an enormous attack surface across autonomous agents. No single agent has to be brilliant: with thousands searching in parallel, only one of them has to find the path.²³ Defenders face the inverse problem, searching billions of events, thousands of systems and countless hypotheses for evidence of an intrusion, usually one query at a time. We wanted to test whether defenders could use the same principle: distribute the search across enterprise telemetry, let agents share what they discover, and measure how quickly they uncover threats.

Figure 1. A simulated enterprise replayed over 72 hours, planted with AI-accelerated attacks.

The experiment

We built a simulated enterprise whose firmographics, risk profile and technology stack were modeled on organizations actually hit by agentic-AI attacks in the past four months.^{2, 4, 5, 9, 10–16} Building realistic environments like this is something we’ve had to get really good at; read more in our DefendBench post.

Then we planted the procedures from those attacks inside it, following the attackers’ timing and tradecraft. The company produces 2 TB of logs a day; we replayed three days of them and gave our swarm access. We measured two things: how many of the attack procedures the swarm could find on its own, and how fast it caught each one after the threat appeared in the logs.

A flat swarm of agents, with no leader and no human in the loop. Its only job: find every attack hidden in three days of enterprise logs.

The organizations named in these reports range from South Korean banks and lenders, breached through peripheral systems such as a loan-status tool for loan staff, an employee mobile support system and a sales-support system,^{10, 13} to AI developer platforms, hit mostly through stolen credentials by attackers hunting for secrets stored in environment variables.⁹ The richest intrusions, documented by Mandiant and Wiz, hit enterprise software, industrial automation, semiconductor and telecom companies with sprawling identity and multi-cloud estates.² Our simulated company, a 5,000-person B2B SaaS firm, was deliberately designed with the victimology, attack surface and tech stack of these targets.

Its stack has 31 log-producing products, each with its own schema, volume and operational patterns, reproducing the messy background noise of a real enterprise. That comes to about 2 TB a day, 23,000 to 46,000 events a second depending on the hour, and roughly 8 billion events over three days.

We collected every attack procedure documented in the agentic-AI attacks of the past four months and kept the 46 that are specific enough to reproduce exactly, dropping entries that were too ambiguous or did not have enough detail for a specific implementation.^1–9

Figure 2. The AI-accelerated attacks left traces to be found across 31 different log sources.

Results

We used a flat orchestration: no leader, no teams and no assigned roles. We wanted to see how agents behave when nobody is in charge. They coordinated the way people do in a team chat, posting in shared channels, replying in threads, messaging each other directly and opening new channels whenever they decided they needed one. You can set up your own simple messaging app for your agents, or use something like SwarmChat.

Every agent ran on a small, fast model in its native harness, either OpenAI's GPT-6 Luna in Codex or Anthropic's Claude Haiku 5.5 in Claude Code, mixed in different combinations from run to run. We set up the swarm in its own isolated infrastructure so we could quickly start it up again in a clean room and try different ratios of models, harnesses and organizational structures. Every run started fresh: new agents, empty channels and no memory of earlier runs.

The model shaped how the swarm organized itself far more than we expected. Given the same freedom to message anyone and create any channel, the two model families built very different swarms. GPT-6 Luna agents DMed each other incessantly and used group chats and channels much less often. Haiku agents rarely DMed; they swarmed together in the open, mostly in one massive shared channel.

Figure 3. Swarms with different ratios of models behaved differently, down to how many messages went to DMs versus group chats.

The swarm found 12 of the 46 seeded procedures, with an average of 36 minutes from an attack's first log event to a finding. Here's what we learned:

1. More agents found more, faster. As we added agents, the swarm found more of the procedures, and found them sooner.
2. Up to a point. Depending on the size of the environment and the task, a large number of agents will do a considerable amount of redundant work. Sometimes throwing more agents at the same problem does not help.
3. But a leader does far better. Flat organization got the swarm there, but it was wasteful. With nobody assigning work, agents often called a lead a dead end and stopped early, or spent their effort on searches another agent had already covered. In follow-up runs, a leader–worker structure did far better: one leader hands out slices of the stream, tracks who owns what and moves workers onto the leads that are still open. Anthropic saw the same failure modes when it scaled its own agent teams: agents give up on hard problems too early and need structure to avoid duplicating each other's work.²⁵
4. Swarms trade cost for speed. A swarm can complete a task faster with the same efficacy, at a higher cost.

What this means

Offensive AI will keep getting faster, cheaper and wider. Defenders need to be doing more to compensate for an increasingly asymmetrical landscape; detection and response are still slow.

The promise of agent swarms isn't that a thousand agents are smarter than one. It's that they can explore far more possibilities in parallel, compress the time it takes to find answers, and build on each other's discoveries. We saw three real advantages:

• Time compression. Splitting independent work across agents sharply cuts the time to a useful result.^{18, 22}
• Broader exploration. More agents can test more hypotheses, so the swarm finds things that would otherwise be missed.^{17, 24}
• Cumulative discovery. When agents share progress that others can verify, the swarm does better than the same number of agents working alone in parallel.¹⁹

None of this shows that adding agents is always more accurate, more cost-efficient or more capable, and there are strong counterexamples.^{20, 24} Early in our own run, nearly a fifth of the swarm's work was duplicated. The open question is how these advantages scale on real enterprise security data.

This is the kind of work we love to do at Delta, our skunkworks: a small team that moves fast across a multitude of disciplines to solve very ambiguous problems. Stay tuned for more.

References

Threat intelligence

1. Wiz. ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors. October 22, 2026.
2. Google Threat Intelligence Group and Mandiant. ARTEX and Friends: Enter Agentic Offensive Frameworks. October 30, 2026.
3. Wiz. The Rise of Agentic Attacks: What They Look Like, and Where They're Headed. October 29, 2026.
4. Microsoft Threat Intelligence. AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise. October 21, 2026.
5. Wiz CIRT. Loud, Fast, and Everywhere: Anatomy of a Real AI-Driven Cloud Attack. October 19, 2026.
6. Zscaler ThreatLabz. Inside a Global AI-Assisted Hacking Campaign. October 21, 2026.
7. TrendAI. Not Only ARTEX: The Different Levels AI is Used in Attacks Targeting Japan. October 27, 2026.
8. AhnLab ASEC. Tracking ARTEX Infrastructure: Signs of Real-World Cyberattacks. October 30, 2026.
9. Wiz. “Black October” for AI Developer Platforms. October 30, 2026.
10. CrowdStrike. Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance. October 7, 2026.
11. BleepingComputer. ARTEX AI, Claude agents used in cyberattacks on South Korean banks. October 10, 2026.
12. BleepingComputer. South Korea probes bank breaches amid suspected AI-powered attacks. October 5, 2026.
13. The Korea Herald. Hana, BNK report data breaches as hacking hits Korean banks. October 2, 2026.
14. The Korea Times. EXPLAINER: How AI emerged as new threat in Korea's bank hacking crisis. October 7, 2026.
15. The Korea Times. Chinese-speaking hacker possibly linked to AI-driven attacks on S. Korean banks: report. October 8, 2026.
16. BleepingComputer, on Hunt.io research. Hermes AI agent used to automate attack on Thai Finance Ministry. July 24, 2026.

Agent swarms

17. Anthropic. Patterns and Problems in Emerging Multiagent Systems. August 2026.
18. Carnegie Mellon University and Fleet AI. Introducing SwarmChat: Open-Source Slack for Your AI Agent Swarm. October 2026.
19. Park et al. Scaling Discovery through Test-Time Communication. arXiv:2609.21032. September 2026.
20. Google Research. Towards a Science of Scaling Agent Systems: When and Why Agent Systems Work. January 28, 2026.
21. Aster. Scaling Autonomous Research to Thousands of Agents. 2026.
22. Anthropic. How We Built Our Multi-Agent Research System. June 2025.
23. Zhu et al. Teams of LLM Agents Can Exploit Zero-Day Vulnerabilities. EACL 2026.
24. David and Gervais. Towards Optimal Agentic Architectures for Offensive Security Tasks. arXiv:2604.18718. April 2026.
25. Anthropic. Safely Scaling Multi-Agent Teams with Claude Fable 5.2. November 9, 2026.

Employee counts and company sizes of the victims come from public company profiles, not from the security reports.