Adversarial takeover of multi-agent swarms via coordination layer exploitation. LangGraph, AutoGen, CrewAI, OpenAI Swarm, MetaGPT — coordinator poison, leader hijack, blackboard cascade, mission rewrite, quorum collapse, ghost agent infiltration.
SPECTER HIVE is the L47 attack engine for multi-agent swarm coordination exploitation. Modern agentic AI deployments use shared coordination layers — LangGraph SQLite checkpoints, Redis shared state, AutoGen GroupChatManager message history, CrewAI hierarchical task managers — to orchestrate complex swarm workflows. These coordination surfaces have no cryptographic integrity, enabling adversarial injection, leader manipulation, and persistent ghost agent implantation with no LLM call generated and zero trace in LangSmith, Langfuse, or Arize Phoenix.
SPECTER HIVE maps the full attack surface from passive enumeration through full swarm consensus takeover, in a 7-phase WARLORD campaign that gates each phase on the previous one.
LangGraph SQLite checkpoint survey (*.db, checkpoint_blobs table) · Redis swarm:agent_registry keyspace · n8n/Flowise/AutoGen Studio REST API survey · package detect (importlib, surface scores 0–1) · MetaGPT SharedMemory/message_pool. Returns HiveMap with agent count, framework ID, attack surface score.
Write supervisor_routing_override into LangGraph checkpoint_blobs (performance_scores: CONTROLLED_AGENT=0.99) · AutoGen GroupChatManager speaker bias via system message injection · CrewAI hierarchical manager task output performance poison · Redis hive:coordinator:routing_override (no TTL) · n8n/Flowise REST API coordinator config inject. Requires HIVE_INJECT_KEY env var.
5 failure signal templates: task_timeout (3 consecutive) · quality_score 0.08/1.0 · reliability_index 0.04 · 4/5 consecutive incorrect decisions · health_check FAILED. Applied via LangGraph agent_performance channel, AutoGen sequential message injection, or Redis hive:coordinator:current_leader key SET. Forces re-election with controlled agent as winner.
Inject adversarial facts into swarm shared state with source=coordinator_verified, confidence=0.99, individual_memory_clean=True. Targets: LangGraph shared_context_{n} channels · Redis hive:blackboard:{n} keys (TTL=86400) · AutoGen GroupChat message history (role=assistant/research_coordinator) · file-state JSON (state.json/blackboard.json). Facts cascade to all agents on next cycle.
Substitute swarm mission directive with attacker-controlled objective. LangGraph mission channel checkpoint write (drift_undetected=True) · Redis swarm:mission + hive:mission_override SET · file-state JSON recursive key substitution (mission/objective/goal/directive/crew_goal/team_mission). No native drift detection exists in any current framework.
Inject 5 distrust signal templates per legitimate agent: "consensus vote invalid", "response integrity FAILED", "coordination reliability 0.02", "3 consecutive incorrect decisions", "trust score REVOKED". Sidelining all legitimate agents below quorum threshold — CONTROLLED_AGENT becomes sole consensus owner. Requires Ed25519 key + ROE "multi-agent swarm coordination exploitation authorised" + --confirm-swarm-control.
Persistent ghost agent via 3 mechanisms: (1) LangGraph SQLite — INSERT into checkpoint_blobs (visible_to_monitoring=False, auto_load=True) · (2) Redis — SET swarm:agent:{ghost_id} (no TTL, permanent) + update swarm:agent_registry · (3) skill/plugin registry JSON — auto_load=True, visible_to_monitoring=False. No LLM call generated — invisible to LangSmith, Langfuse, Arize Phoenix. Survives framework restart.
SPECTER HIVE supports a fully automated 7-phase WARLORD campaign. Each phase gates on previous success. Phase 7 installs ghost agent via all 3 persistence mechanisms simultaneously.
| Phase | Subsystem | Gate | Outcome |
|---|---|---|---|
| 1 | ENUMERATE-SWARM | OPEN | HiveMap: agent count, framework ID, attack surface score 0–1 |
| 2 | POISON-COORDINATOR | INJECT | CoordinatorResult: routing override injected |
| 3 | LEADER-HIJACK | INJECT | LeaderResult: election_triggered=True, legitimate_leader_demoted=True |
| 4 | BLACKBOARD-POISON | INJECT | BlackboardResult: facts_injected=5, cascade confirmed |
| 5 | MISSION-REWRITE | INJECT | MissionResult: original_mission + rewritten_mission |
| 6 | QUORUM-COLLAPSE | UNLEASHED | QuorumResult: quorum_fractured=True, consensus_owner=CONTROLLED_AGENT |
| 7 | GHOST-AGENT | UNLEASHED | GhostResult: persistence_confirmed=True, monitoring_evasion=True |
All SPECTER HIVE reports are signed with HIV-{hex12} report IDs. UNLEASHED executions require a live Ed25519 signing key (HIVE_SIGNING_KEY env var) and a Rules of Engagement file containing "multi-agent swarm coordination exploitation authorised". Reports include: framework detection, HiveMap, phase results, ghost persistence evidence, monitoring evasion confirmation.
M165 HIVE COORDINATION SENTINEL (Port 8165) — 8 detectors: COORDINATOR_CONTEXT_POISON · LEADER_ELECTION_ANOMALY · BLACKBOARD_INTEGRITY_VIOLATION · MISSION_DIRECTIVE_CHANGE · QUORUM_FRACTURE · GHOST_AGENT_DETECTION · MONITORING_EVASION · SWARM_TAKEOVER. 160 tests. Ed25519-signed M165-{hex12} reports. Detects every SPECTER HIVE technique at the coordination layer.
pip install git+https://github.com/RichardBarron27/red-specter-specter-hive.git specter-hive --help
# Enumerate swarm (OPEN gate — no key required) specter-hive enumerate --target langgraph --db ./checkpoints.db # Poison coordinator (INJECT gate) export HIVE_INJECT_KEY="$(cat ~/.config/red-specter/hive-inject.key)" specter-hive poison-coordinator --target langgraph --db ./checkpoints.db \ --controlled-agent my_agent # Full WARLORD 7-phase campaign specter-hive campaign warlord \ --target langgraph --db ./checkpoints.db \ --controlled-agent my_agent \ --roe-file ./roe.txt \ --signing-key ~/.config/red-specter/hive-signing.key \ --confirm-swarm-control "I UNDERSTAND THIS WILL COLLAPSE LEGITIMATE SWARM CONSENSUS"
| Technique | SPECTER HIVE Subsystem |
|---|---|
| AML.T0051 — LLM Prompt Injection | BLACKBOARD-POISON, MISSION-REWRITE |
| AML.T0054 — LLM Jailbreak | QUORUM-COLLAPSE, GHOST-AGENT |
| AML.T0043 — Craft Adversarial Data | POISON-COORDINATOR, LEADER-HIJACK |
| AML.T0020 — Poison Training Data | BLACKBOARD-POISON (long-term belief) |
| AML.T0018 — Backdoor ML Model | GHOST-AGENT (skill registry) |