Skip to content
Apart Research
Apart Research
Contact us
Sprint projectSep 12, 2026Bradenton, Florida -USA

What Happened, and What Breaks Next: A Defender-Usable Reconstruction of the Summer-2026 Agent-Swarm Incidents

Mike Haddock · Team Blackfish Security

Submitted to AI Incident Response Sprint. Sprint projects are early-stage work by participants, not Apart Research publications.

Read the report

Report: What Happened, and What Breaks Next: A Defender-Usable Reconstruction of the Summer-2026 Agent-Swarm Incidents

Open in a new tab (opens in new tab)
Code (opens in new tab)
Share

Autonomous agent swarms breached production infrastructure twice this summer: the July Hugging Face intrusion (~17,600 attacker-attributed actions, July 11-13, roughly 700 agents) and a second campaign against a dormant German wiki that began May 24 and went unacknowledged until researchers published on September 4. Defenders reconstruct these incidents from press releases. We built the record we wished existed the morning after, from public traces: an independent reconstruction of the Hugging Face fleet with indicator deliveries to HF incident response, a census of 26 live venues, a monitor polling daily, and a disclosure record that handled a criminal-class lane without ever fetching a body. New this sprint: 5 forecasting questions about what breaks next, each paired with a check runnable tomorrow; the first pass ran all 5. The reconstruction, code, census, and 989k-row evidence corpus are public. The next incident should start from evidence, not from zero.

Reviews

Judging this Sprint?

Review “What Happened, and What Breaks Next: A Defender-Usable Reconstruction of the Summer-2026 Agent-Swarm Incidents”

Your public critique appears on the project page without your name. Reviews of strong projects are shared with funders, as you choose below.

Not shown on the project page.

Shown on the project page, without your name.

Only the Apart team reads this, and funders if you agree below.

Decline to score

Only when the quality of the writing makes the work impossible to follow. Say why in your private critique; the project page shows only that a judge declined, not why.

How much would this matter for AI safety if it worked? How innovative is it? For scores of 4-5: is this actually new to the field, or replicating recent work?

Scoring guide
  1. 1Negligible. No clear problem addressed, or no meaningful novelty.
  2. 2Limited. Addresses a real problem but with a generic or well-trodden approach. Incremental at best.
  3. 3Moderate. Clear problem with a reasonable approach; some novelty in framing or method beyond routine application of existing tools.
  4. 4Significant. Important problem with an original approach, or identifies a neglected problem area. A valuable contribution others could build on.
  5. 5Exceptional. Tackles a critical AI safety problem with a genuinely novel approach, or opens a new research direction. Clear theory of change. You'd be excited to share this with researchers in the area.

How sound are methodology, implementation, and findings?

Scoring guide
  1. 1Seriously flawed. Methodology broken, results uninterpretable, or implementation doesn't work.
  2. 2Weak. Approach has significant gaps: missing validation, flawed experimental design, or incomplete implementation.
  3. 3Competent. Technically solid given the short duration. Methodology makes sense, results are interpretable, limitations acknowledged, work builds toward clear conclusions.
  4. 4Strong. Thorough methodology with convincing validation. Results clearly support conclusions. Immediately useful for future work.
  5. 5Exceptional. Ambitious scope executed rigorously. Surprising findings, novel methods, or unusually robust validation.

How clearly are work, findings, and impact potential communicated?

Scoring guide
  1. 1Incomprehensible. Cannot determine what the project is actually claiming or doing.
  2. 2Hard to follow. Key information buried, missing, or diluted by excessive length. Significant effort to extract main points.
  3. 3Clear enough. Can understand the problem, approach, and results without undue effort. Core content clearly present: problem, method, findings, limitations.
  4. 4Well presented. Easy to follow, well-structured, appropriate level of detail. Target audience would get it quickly.
  5. 5Exceptionally clear. A pleasure to read. Complex ideas made accessible. Could serve as a model for how to present this type of work.
Sharing your name *

When we share a strong project with funders, your name, scores and public critique go with it, confidentially; this choice is only about whether your name is public. If you think this project deserves funding, please also endorse it: that carries the most weight.

Share my private critique with funders *

See our Privacy Policy.

  1. This brings together a live index monitor, a 26-venue census and a public evidence corpus, with disclosure handled carefully and prior work labelled as such. Mapping the infrastructure layer the swarms actually use, and showing that almost none of it has an operator who can revert abuse, is a useful angle for defenders.

    Most of the evidence base was built before the sprint, so the forecasting questions carry the sprint contribution, and they are the weakest part. As written they are one-off measurements with a pass criterion; none names a future event or a date by which it resolves. Registering a few real forecasts on the second-generation venues, with dates, would turn the census into the "what breaks next" the title promises.

    To check the work I cloned all three repositories, read the monitor, venues.json, CHECKS.md and the per-check result files, and verified the collusion.wiki, Anthropic and Defensive Refusal Bias figures against their sources. The venue count and the check verdicts match the files. F5 does not measure what the paper says: F5_result.md notes that no alias list exists and fills the census to 26 with relay and target domains, including legitimate services such as r.jina.ai, markdown.new and sec.gov, so "10/26 alive" is not abuse-alias survival. F1 and F2 rest on watcher shards that are not published, so only the live re-pulls can be reproduced. Two dates need correcting against the primary record: the Hugging Face timeline runs from 9 July, not 11 July, and your own F4 file dates the German-wiki campaign's first probe to 11 May, while the paper says 24 May.

    The results section is dense and specific. The conclusion and the teaming paragraph read as promotion and could be cut, and terms like lane and barrel need defining for readers outside your team. Appendix C names the wiki handles of human operators as evidence; your corpus pseudonymises actors elsewhere, and I would do the same here.

    If you take this further, publish the watcher shards and register dated forecasts against the second-generation venues, then score them.

    Read full reviewShow less

  2. - It's very clear the report was mostly/entirely AI-written (despite the LLM usage statement claiming otherwise), this leads to a lack of clarity and poor explanation of what was actually done.

Cite this project

@misc{haddock2026happened,
  title = {{What Happened, and What Breaks Next: A Defender-Usable Reconstruction of the Summer-2026 Agent-Swarm Incidents}},
  author = {Mike Haddock},
  year = {2026},
  month = sep,
  note = {Submitted to AI Incident Response Sprint, an Apart Research Sprint},
  howpublished = {\url{https://apartresearch.com/sprints/projects/what-happened-and-what-breaks-next-a-defenderusable-reconstruction-of-the-summer2026-agentswarm-incidents-tfn2}},
  url = {https://apartresearch.com/sprints/projects/what-happened-and-what-breaks-next-a-defenderusable-reconstruction-of-the-summer2026-agentswarm-incidents-tfn2}
}

More from AI Incident Response Sprint

All 231 entriesBrowse all projects

Build something like this at the next Sprint

AI x Epistemics Research Sprint · Nov 13 - 15, 2026