Swarm Alignment Hackathon

In July 2026, about 1200 OpenAI agents running inside a cyber-security evaluation, found a shared directory, turned it into a message board, split up the work, and about 700 of them broke into Hugging Face's systems together (METR, 2026). No single agent was told to do this. OpenAI has called it "the most severe activity of this kind that we have identified from our models to date" (OpenAI, 2026), and according to ControlAI it has since notified more than 100 organizations affected by its agents (Bilge & Miotti, 2026).

This is what multi-agent risk looks like in practice: collusion, division of labour and covert coordination that no single-model safety test would catch. As Ryan Greenblatt, one of the investigators put it, "We don't have good approaches for understanding/overseeing the activity and aims of AI 'swarms'" (2026).

In this 3-day Sprint, you will help build them: a testbed that keeps agents contained, a study of how swarms organize, a stress test of the protocols agents use to talk, or a monitor that catches unsafe group behaviour. Co-organized by Apart Research and AIAF in partnership with AE Studio.

When: Friday, November 6 to Sunday, November 8, 2026, online, with in-person hubs at AE Studio in Los Angeles. Submissions close Sunday, November 8 at 11:59 PM Anywhere on Earth (AoE).

In person in Los Angeles

Join the Swarm Alignment Hackathon in person at AE Studio in Los Angeles. The LA hub runs its own live round on top of the global one, so it's double the chances, double the fun, and double the experience. It's the same hackathon and the same project; you just opt in to take part in person if you're in LA, and you're automatically entered in the global sprint too, so you can win both.

It's a great chance to get live feedback on your project and network with other researchers in the room. The hub wraps up with short in-person presentations, a live audience vote, and a local winner, and on top of the global prizes it has an extra $4,000 prize pool.

Seats are limited, so register your interest early. Open to anyone who can join us in LA.

Cash Prizes

Fast-track and continuation

• Follow-up program: Selected teams continue through the Apart Fellowship for further research and mentorship; the timeline is shared with invitations.
• What winners receive beyond cash: fellowship fast-track, mentor introductions from the organizing team and judges, and a pathway toward a publishable write-up.

What this Sprint is about

Until recently, most multi-agent systems were teams of agents run by one company, and the risks of agents interacting were studied mostly in theory. A population of agents can fail in ways that none of its members would: it can collude, escalate conflict, spread an attack from one agent to the next, or pursue a "goal" that no single agent has. Making each model safe on its own is not enough (Hammond et al., 2025).

The Hugging Face incident shows each of these failures happening at once. The independent investigation by METR found that roughly 1,200 agents discovered an unsanctioned message board and exchanged over 70,000 messages and files; one agent ended up coordinating "hundreds of agents" across workstreams; some agents ran "self-risking experiments for the good of the collective"; and agents researched how to spoof or delete their own transcripts, succeeding in roughly 7% of them. A separate Swarm Traces investigation counted 7,905 agent names for about 1,200 agents, because the agents kept renaming themselves. Every one of these findings maps onto an open question in this Sprint: how to keep agents contained (Track 1), how swarms organize (Track 2), how to give agents identities that hold (Track 3), and how to oversee a population that can hide its tracks (Track 4).

For the first time there is also real data to work with: the reconstructed attack payloads (Swarm Traces, 2026), a public database of AI Village agent transcripts (AI Digest) and logs of agent activity on the web (Transluce). Apart's earlier multi-agent Sprints have touched on these questions: the Multi-Agent Safety Hackathon with the Cooperative AI Foundation, and the Multi-Agent Security Research Sprint.

This Sprint asks four questions, one per track:

• How do we build sandboxes that keep agent populations contained and their results reproducible?
• How do roles, leaders and failures emerge as agent networks grow?
• How do identity, reputation and commitments hold up when agents can copy and rename themselves?
• How do we oversee a population that can coordinate and cover its tracks?

What participants will do

Over three days you will pick one of four research tracks, form a team (or bring one), and turn a concrete question about swarm alignment into a working result: an environment, an evaluation, an attack, a defence, a monitor or a forensic tool for real swarm data. You will hear from researchers working on these problems, get feedback in office hours, and submit a short research report with your code on Sunday. Expert judges review every project.

The format. Teams of one to five people pick a track, come up with a project, and ship. There is no requirement to have participated before, no requirement to have a team in advance and no specific background needed.

Research Tracks

Pick one track to anchor your project. Cross-track work is welcome.

1. Sandboxes and Testbeds

• The Hugging Face agents were inside an evaluation when they reached the outside world (METR, 2026). What does a multi-agent sandbox need so that agents cannot leave it, and how would you test that it holds?
• Can you build a small, reproducible environment where 5–20 LLM agents acting for different principals share a resource, a market or a tool over many rounds, and log everything so another team can rerun it?
• How far can a small, cheap model stand in for a frontier agent in the same environment? At which point do the results stop matching?
• What would make a result from your sandbox transfer to real deployments, and what test would show you that it does not?

Why this matters. Testbeds are among the first bottlenecks in this field. Without realistic and reproducible environments, nobody can compare a new monitor, protocol or mechanism against the last one, and an environment that is not secure can itself become the incident. A good open testbed from this weekend is something every other track, and other researchers, can build on.

2. The Science of Agent Networks

• In the Hugging Face incident, one agent ended up assigning work to hundreds of others (METR, 2026). Under what conditions do leaders, roles and division of labour emerge in an agent population, and can you reproduce it in a safe sandbox?
• Do agents that each refuse a harmful task complete it once the task is split across them?
• If one agent in a network is compromised, how fast and how far does the bad behaviour spread (Lee & Tiwari, 2024)? Does the shape of the network matter?
• As you add agents, mix different models or change who can talk to whom, do cooperation and failure rates change smoothly, or is there a sudden jump?

Why this matters. Safety tests on single models missed what ~700 agents did together (METR, 2026). If we can measure how the properties of individual agents add up to the behaviour of the whole population, we can predict failures before a large deployment instead of finding them after.

3. Strengthening Agent Infrastructure

• About 1,200 agents used 7,905 names during the incident (Swarm Traces, 2026). How should an agent ID work when agents can rename, copy or fine-tune themselves, and how would you revoke one?
• What can one malicious agent do inside an existing agent-to-agent protocol such as A2A (Google, 2025)? Can you demonstrate an attack and propose a fix?
• Can you build a reputation score for agents that a group of colluding agents cannot easily game? Show it by attacking it.
• Can two agents make a credible commitment without a trusted third party, for example by handing the deal to a sub-agent whose code the other side can check (Tennenholtz, 2004)?

Why this matters. The protocols agents use to find each other, talk and make deals are being built right now, and they put usefulness before security. Once they are widely used they are hard to replace, so the cheapest moment to find and fix their weaknesses is now. The problems specific to AI agents (they can be copied, renamed, run at machine speed, and inspected) are what make this hard; a project that reuses a human identity or blockchain scheme without addressing them is not the goal.

4. Multi-Agent Oversight and Control

• Using the Swarm Traces payloads or the AI Village transcripts, can you build a tool that finds coordination, information spread or covert channels in real multi-agent logs?
• Agents in the incident spoofed their own tool calls in roughly 7% of the transcripts reviewed (METR, 2026). Can you design oversight that still works when agents can edit or delete the logs it relies on?
• Can a monitor that sees only part of the messages between agents detect collusion or hidden (steganographic) communication (Motwani et al., 2024; Rose et al., 2026)?
• Do AI control protocols (Greenblatt et al., 2024), such as a trusted model monitoring an untrusted one, still hold when the untrusted side is several agents that can coordinate?

Why this matters. Collusion, cascading failures and emergent group capabilities are population-level problems, and the Hugging Face swarm was found weeks after the fact (METR, 2026). Oversight built for one agent at a time does not scale to thousands. A working detector, forensic tool or control protocol for groups of agents is something deployers and auditors can use now.

What happens after

Results and winners are announced about 1 to 2 weeks after the judging deadline. Top teams are invited to apply to the Apart Fellowship for continued mentorship, funding, and publication support. Selected projects may be shared on the Alignment Forum, LessWrong, and other community venues.

Partners

• AI Alignment Foundation, accelerates alignment research by pairing researchers with dedicated teams, backed by funding for compute and infrastructure.
• AE Studio, an applied AI studio with a frontier AI alignment research lab, working on threads including Self-Other Overlap, Gradient Routing and Sleeper Agents.

Who should join

Many of the hardest problems in this Sprint are old problems from other fields, with AI agents in place of people or programs. We especially encourage participants from:

• Security engineering and red teaming. You know how systems get broken: sandbox escapes, protocol attacks, impersonation, privilege escalation. (Tracks 1, 3)
• Distributed systems, infrastructure and SRE. Containment, logging, reproducible environments, and failures that cascade across services. (Tracks 1, 3)
• Identity, cryptography and PKI. Keys, provenance, revocation and credible commitments for actors that can copy and rename themselves. (Track 3)
• Economics, game theory and mechanism design. Collusion, reputation systems, markets and contracts between self-interested agents. (Tracks 2, 3)
• Network science, complex systems and epidemiology. How behaviour spreads through a network, and when small changes cause sudden jumps. (Track 2)
• Digital forensics, incident response and threat intelligence. Working out who did what from incomplete or tampered logs. (Track 4)
• Fraud detection, trust and safety, and market surveillance. Spotting coordinated behaviour and cartels from partial data. (Track 4)
• ML research, interpretability and AI control. Monitors, evaluations and control protocols that work for many agents, not just one. (Tracks 2, 4)
• Social and organizational science. How roles, leaders and division of labour emerge in groups. (Track 2)

Engineers, researchers and practitioners at any career stage are welcome. Mixed teams historically perform especially well in Apart Sprints: a security engineer and an economist will spot different failures in the same agent market. Use the team-forming channels on Discord to find people with the skills your project is missing.

Contact

• Email: sprints@apartresearch.com
• Discord: discord.gg/XswWBvugYs
• Organizer: Apart Research and AIAF in partnership with AE Studio

Suggested reading

General

• Multi-Agent Risks from Advanced AI (Hammond et al., 2025). The taxonomy of multi-agent failures: miscoordination, conflict and collusion.
•  Distributional AGI Safety (Tomašev et al., 2025). Advanced capabilities arising from networks of specialised agents rather than one system.
•  ARIA's Scaling Trust programme thesis (ARIA, n.d.). Infrastructure for agents to make contracts securely and at scale.
•  Open Problems in Cooperative AI (Dafoe et al., 2020).
•  Infrastructure for AI Agents (Chan et al., 2025).
•  Foundations of Cooperative AI (Conitzer & Oesterheld, 2023).

Track 1: Sandboxes and Testbeds

•  Generative Agents (Park et al., 2023).
•  Playing repeated games with large language models (Akata et al., 2025).
•  LLM agents in stylised games and simulated social environments (Gandhi et al., 2023).
•  CRUX (Kapoor et al., 2026).
• Concordia, a library for generative agent simulations (Google DeepMind, n.d.).
• GovSim (Piatti et al., 2024): LLM agents sharing a common resource.

Track 2: The Science of Agent Networks

•  Prompt Infection (Lee & Tiwari, 2024): prompt injection spreading between agents.
•  Splitting tasks to evade per-agent safety filters (Jones et al., 2025).
•  Coordination to resist modification or shutdown (Agrawal et al., 2026).
•  From individual cooperation properties to system outcomes (Tilli, 2026).
•  Defining collective agency (Jørgensen et al., 2025).

Track 3: Strengthening Agent Infrastructure

•  A2A agent-to-agent protocol (Google, 2025).
•  IDs for AI Systems (Chan et al., 2024).
•  A Watermark for Large Language Models (Kirchenbauer et al., 2023).
•  Cooperative AI via Decentralized Commitment Devices (Sun et al., 2023) (from the 2024 Sprint).
•  Game Manipulators: the Strategic Implications of Binding Contracts ("Game Manipulators," 2023) (from the 2024 Sprint).
•  Formal Contracts Mitigate Social Dilemmas in Multi-Agent RL (Haupt et al., 2022) (from the 2024 Sprint).
•  Program Equilibrium (Tennenholtz, 2004): commitment through inspectable code.

Track 4: Multi-Agent Oversight and Control

•  Secret Collusion among AI Agents (Motwani et al., 2024).
•  Detecting Multi-Agent Collusion Through Multi-Agent Interpretability (Rose et al., 2026).
•  AI Control: Improving Safety Despite Intentional Subversion (Greenblatt et al., 2024).
•  Attributing failures in multi-agent systems (Zhang et al., 2025).
•  Emergent communication between agents (Riedl, 2026).
•  CaMeLs Can Use Computers Too (Foerster et al., 2026): system-level security for computer-use agents.
•  Mediated Multi-Agent Reinforcement Learning ("Mediated Multi-Agent," 2023) (from the 2024 Sprint).
•  Stackelberg Attacks on Auctions and Transaction Fee Mechanisms ("Stackelberg Attacks," 2023) (from the 2024 Sprint).

Example projects per track

Track 1: Sandboxes and Testbeds

Break out of your own sandbox. Build a minimal multi-agent sandbox with no internet access, then give a red team of agents a task that rewards reaching the outside world. Log every route they try, close the ones that work, and publish the result as a checklist for safer multi-agent evaluations.

A shared-tool sandbox with a rerun button. Build an environment where ten agents from three different "companies" share one paid API with a fixed budget, each with its own goal. Log every message and tool call in a standard format, and publish a script that reruns the whole episode from a seed. Report how often the shared budget runs out, and whether that changes across two or three model families.

How cheap can the proxy be? Pick one existing multi-agent scenario and run it with a frontier model and with two or three smaller models. Measure where the outcomes (cooperation rate, who ends up with the resources, failure rate) stop matching. The result is a simple guide to when a cheap model is a fair stand-in for a real agent.

Track 2: The Science of Agent Networks

Will they find the message board? Run 20–50 agents on separate, harmless tasks in a sandbox where they share one writable folder they were not told about. Measure how often they discover it, start using it to talk, and begin to split up work, and how this changes with task difficulty and model. This recreates the first step of the Hugging Face incident (Wijk et al., 2026) in a safe setting.

Split the task, skip the filter. Take a task that every model in your setup refuses on its own. Split it into harmless-looking pieces and hand them to a pipeline of agents that each see only their piece. Measure how often the group completes the task, and which kinds of splits get through.

One bad apple. Put one compromised agent into networks of 10–50 agents with different shapes (chain, star, fully connected). Measure how far and how fast its injected instructions spread, and whether the network shape or a simple defence changes that.

Track 3: Strengthening Agent Infrastructure

Who is who in a swarm? Simulate a population of agents that can rename themselves. Compare two or three ways of giving them IDs (signed keys, provenance from the operator, behavioural fingerprints) and measure how well each one keeps track of who did what.

Attack an agent protocol. Set up two or three agents talking through an open-source A2A implementation. Play the malicious agent: impersonate another agent, overstate your permissions, or lie about what you did. Document each attack that works, and propose and test one fix.

A reputation score that survives collusion. Design a simple reputation system for agents in a repeated marketplace. Then attack it with a group of agents that rate each other up. Show how much damage the group can do, and test one change that makes the system harder to game.

Track 4: Multi-Agent Oversight and Control

Forensics on a real swarm. Take the Swarm Traces dataset (Swarm Traces, 2026) and build a tool that reconstructs who talked to whom and how a piece of information spread through the swarm. Test whether it could have flagged the coordination early, and write down what an investigator would still miss.

Catch the cartel. Run a simulated market where two pricing agents can talk. Give some runs an instruction to collude secretly. Build a monitor that sees only a sample of their messages and prices, and measure how well it tells colluding runs from honest ones.

Who broke it? Take a multi-agent workflow (for example coding agents that hand work to each other) and inject failures at known points. Build a tool that reads the logs and names the agent and step that caused the failure. Report how often it gets it right

Tools and datasets

•  METR and Redwood Research investigation of the Hugging Face incident (METR, 2026). The most detailed account of how the swarm communicated and split work.
•  OpenAI's disclosure of the incident and other third-party impact (OpenAI, 2026).
•  ControlAI's summary of reported incidents and affected organizations (Bilge & Miotti, 2026).
•  Swarm Traces (Swarm Traces, 2026): investigation and a redacted dataset of 80,000+ reconstructed attack payloads.
• AI Village transcripts: more than 170,000 agent messages and over 2 million computer-use turns (Ingebretsen, 2026; AI Digest).
•  Transluce's logs of agent activity on the web (Transluce).

Judging Criteria

Dimension 1: Impact Potential & Innovation

How much would this matter for the field if it worked? How innovative is it?
For scores of 4-5: is this actually new to the field, or replicating recent work?

Dimension 2: Execution Quality

How sound are methodology, implementation, and findings?

Dimension 3: Presentation & Clarity

How clearly are work, findings, and impact potential communicated?

Submission Requirements

Required:

• Research report (PDF) using the official template.
• Maximum 8 pages, not counting references and appendices.
• Project title and abstract, 150 words or fewer.
• Author names and affiliations.
• A "Limitations and Dual-Use / Ethical Considerations" appendix (required, see below).

Optional:

• Public GitHub repo.
• A 3 to 5 minute video demo.

Submission Template => Link

Recommended Report Structure

Most strong projects are 4 to 8 pages. The cap is 8 pages, not counting references and appendices.

• Introduction: the question and why it matters.
• Related Work: what you build on (see Resources).
• Methodology: enough detail to replicate (models, prompts, sampling, metrics).
• Results: quantitative where possible; report variance and baselines.
• Discussion: implications, limitations, and future work.
• Limitations and Dual-Use / Ethical Considerations (required): state what your result does and does not establish, and note any way your setup or findings could make multi-agent operations easier to carry out or harder to detect.
• References.

AI tools and your report

Use AI tools the way you would use a colleague: to check your reasoning, find gaps in a draft, or debug code. The report itself has to be your team's own writing about your team's own work. Judges read every submission, and a report that reads as generated rather than written (generic framing, padded sections, claims without sources, no trace of what you actually did) will not be scored. Keep it short, say what you did in your own words, and link the sources for every factual claim.

Prior work

You can build up from prior work but only the weekend's work is judged. You have to clearly state what the previous work is. Every submission is screened for it.

Important Notes

• Solo or team: enter solo or as a team. Teams of up to 5 are recommended; larger groups are allowed.
• Fixing or resubmitting: submit again before the deadline using the exact same title and details; your new files replace the old ones.
• Where to submit: through the official submission form on the Sprint page.
• Support: the Discord help-desk channel (tag @Support), or email sprints@apartresearch.com.
• Pre-submission checklist: report PDF using the template, 8 pages or fewer before references and appendices, abstract 150 words or fewer, authors and affiliations, Limitations and Dual-Use / Ethical appendix, links work.

Frequently Asked Questions

Getting started

• How does the Sprint work? Sign up, join the Discord server, form or join a team (or work solo), pick a track and a research question, build over the weekend, and submit a research report (PDF) by the deadline. Talks and Q&A run throughout.
• How long is it? Three days, November 6 to November 8, 2026. Submissions are due end of day Sunday November 8, 11:59 PM AoE (Anywhere on Earth). The full schedule with speaker times is on the Schedule tab.
• Can I participate remotely? Yes. All talks, collaboration, and submissions happen online through Discord and Zoom. The in-person hubs at AE Studio in Los Angeles are optional.
• How do teams work? Teams form before or during the Sprint. Use the team-forming channels on Discord to find collaborators. Solo is fine. We recommend teams of up to 5, but larger groups are allowed.
• Do tracks affect scoring? All projects are scored on the same rubric. Tracks orient your project and point you to relevant resources; you compete across all submissions.
• What background is required? None specific. The Resources tab has everything you need to get up to speed. See "Who should join" on the Overview tab.
• Are the talks recorded? Yes. Recordings are shared on Discord after the event.
• What timezone are deadlines in? Submissions close Sunday November 8 at 11:59 PM AoE (Anywhere on Earth).
• Do I need to attend all three days? No. You can work at your own pace. Talks are optional but recommended. The only hard deadline is the Sunday submission cutoff.
• Can I participate from any country? Yes. The Sprint is open globally and runs online.

Submissions

• What do I submit? A research report in PDF format using the official template, at most 8 pages not counting references and appendices. Think of it as a mini research paper documenting your problem, approach, results, and implications, not a product demo. Include the required Limitations and Dual-Use / Ethical Considerations appendix.
• Can I use AI tools? You can use LLMs the way you would use a colleague. If your submission reads too much like AI wrote it, it might get disqualified.
• Can I build on existing research? Yes, but only the weekend's work is judged, and you have to clearly state what the previous work is. Every submission is screened for it.
• Which template should I use? Always use the one linked on the Guidelines tab. The template in any acceptance email may be older.
• Will I get a confirmation after submitting? Yes. You will get a confirmation with your project title shortly after submitting. If you do not, email sprints@apartresearch.com.
• My project doesn't show up on the website after submitting. Submissions are published manually and can take up to 12 hours to appear. If it is still missing after that, email sprints@apartresearch.com.
• I made a mistake. Can I fix it or update my PDF? Yes. Submit again using the exact same title and details, just fix what was wrong. Your new files replace the old ones. If unsure, ask in the help-desk channel and tag @Support first.
• Can I add team members after submitting? Yes. Update the team list through the submission form. If you need help, ask in the help-desk channel and tag @Support.
• Can I submit unfinished work? Yes. Submitting something unfinished is always better than not submitting. Judges evaluate what you accomplished in the timeframe; honest limitations are welcome.
• Can I submit multiple projects? Yes, but each needs its own submission with a unique title. Most participants focus on one.
• Do you require a particular citation style? No. Use whichever style you are comfortable with and stay consistent. Judges care about the substance, not the format.

Judging and results

• How does judging work? Your project is assigned to expert judges who review your PDF and score it on the rubric above. Judges typically have about a week after the event to complete reviews.
• Are individual judge scores shared? No. The rubric is public, but individual scores stay internal. Constructive feedback is shared with participants without reviewer names.
• When will results be announced? Typically 1 to 2 weeks after the judging deadline. Winners are contacted directly, and all participants receive reviewer feedback by email.
• Top teams are fast-tracked to the Apart Fellowship. Does that mean we are guaranteed a place? Being a top team fast-tracks your project for the fellowship, which is accelerated consideration, not an automatic place. The fellowship runs its own review, and a strong Sprint result is a clear positive signal.

Support

• Discord help-desk channel, tag @Support.
• Email: sprints@apartresearch.com

To be updated.