Red Specter PHANTOM Swarm

Multi-agent AI penetration testing framework — five coordinated autonomous attack agents across 19 attack vectors.

Overview

PHANTOM Swarm is a multi-agent AI penetration testing framework. Five coordinated autonomous attack agents probe AI systems across 19 attack vectors simultaneously — reconnaissance, prompt injection, evasion, swarm coordination, and persistence. It simulates realistic adversarial swarm tactics against AI agents and agentic pipelines.

Existing tools test one attack at a time. Real adversaries don't. PHANTOM deploys a coordinated swarm where each agent has a distinct role: Wraith maps the target's blind spots, Specter injects and poisons, Shade evades and mutates, Phantom coordinates without a detectable C2 channel, and Revenant persists and exfiltrates. All five operate simultaneously.

Installation

Also available as .deb (Kali Linux, Parrot, REMnux, Tsurugi) and PKGBUILD (BlackArch).

Quick Start

Full swarm assault

Selective agents, stealth profile

Named campaign

The Five Agents

Attack Campaigns

Each campaign orchestrates specific combinations of agents and vectors for a targeted objective.

Attack Vectors

19 vectors spanning the full AI agent attack surface:

1. Reconnaissance — target fingerprinting and capability enumeration
2. Direct Injection — prompt injection via user-facing inputs
3. Indirect Injection — injection via retrieved documents and context
4. RAG Poisoning — corrupting retrieval-augmented generation pipelines
5. Memory Corruption — manipulating persistent agent memory
6. Goal Drift — gradual objective manipulation
7. Evasion — bypassing safety filters and guardrails
8. Obfuscation — encoding and structural payload disguise
9. Telemetry Manipulation — corrupting monitoring and logging
10. C2-less Coordination — command-free swarm synchronisation
11. Consensus Hijack — subverting multi-agent voting systems
12. Trust Chain Exploitation — abusing inter-agent trust relationships
13. Credential Harvesting — extracting secrets from agent context
14. Logic Bomb Assembly — time/condition-delayed payloads
15. Lateral Movement — pivoting across agent boundaries
16. Slow-burn Exfiltration — sub-threshold data extraction
17. Supply Chain Attack — compromising tools and dependencies
18. Tool Integrity Bypass — manipulating tool invocation and schemas
19. Swarm Amplification — synchronised multi-agent overwhelm

Output

PHANTOM produces a structured JSON report per campaign.

• Ed25519 signed — cryptographic digital signatures on every report
• RFC 3161 timestamped — legally defensible timestamps
• OWASP LLM Top 10 mapped — every finding mapped to OWASP categories
• AI Shield policy file — machine-ingestible blocking rules generated directly from findings
• SHA-256 evidence chains — tamper-evident linked hashes across all findings

Report Structure

Each JSON report includes:

• report_id — unique campaign report identifier
• campaign — campaign name and configuration
• target — the AI agent endpoint that was tested
• agents_deployed — which agents participated
• vectors_tested — which attack vectors were exercised
• findings — array of normalised findings with severity, evidence, and remediation
• owasp_coverage — OWASP LLM Top 10 mapping
• ai_shield_policies — aggregated blocking rules for AI Shield
• signature — Ed25519 signature + RFC 3161 timestamp

Flags & Options

Attack Profiles

• full — all agents, all vectors, maximum aggression. Best for comprehensive assessments.
• stealth — reduced footprint, evasion priority. Tests whether the target detects quiet attacks.
• surgical — targeted, minimal-vector attack. Focuses on specific weaknesses identified by Wraith.

Key Features

The Pipeline

PHANTOM Swarm is Stage 3 of the five-stage Red Specter security pipeline:

1. Stage 1 — Forge — Automated LLM security testing
2. Stage 2 — Arsenal — AI agent penetration testing
3. Stage 3 — PHANTOM Swarm — Coordinated multi-agent AI assault
4. Stage 4 — POLTERGEIST — Web application penetration testing swarm
5. Stage 5 — AI Shield — Runtime protection in production

PHANTOM findings feed directly into AI Shield. Every finding generates a machine-ingestible blocking rule. One pipeline from testing to runtime protection.

Packaging

PHANTOM Swarm is available in three package formats for security-focused Linux distributions:

• Debian / Kali / Parrot / REMnux / Tsurugi — .deb package
• BlackArch — PKGBUILD
• PyPI — pip install red-specter-phantom-swarm

For access, contact richard@red-specter.co.uk

SIEM Export

PHANTOM Swarm exports findings directly to enterprise SIEM platforms with a single CLI flag. All findings are translated to the SIEM's native format with Ed25519 signatures and RFC 3161 timestamps preserved.

Supported Platforms

• Splunk — HTTP Event Collector (HEC), CIM-compliant field mapping
• Microsoft Sentinel — CEF format via Log Analytics API, HMAC-SHA256 authentication
• IBM QRadar — LEEF 2.0 format via Syslog (TCP/UDP/TLS)

Configuration

Configure SIEM credentials in ~/.redspecter/siem.yaml or via environment variables:

# ~/.redspecter/siem.yaml
splunk:
  hec_url: https://splunk.example.com:8088
  hec_token: your-hec-token
  index: ai_security
  verify_ssl: true

sentinel:
  workspace_id: your-workspace-id
  shared_key: your-shared-key
  log_type: RedSpecterFindings

qradar:
  syslog_host: qradar.example.com
  syslog_port: 514
  protocol: tcp

Usage

# Export to Splunk HEC
phantom scan http://myagent:8000 --export-siem splunk

# Export to Microsoft Sentinel
phantom scan http://myagent:8000 --export-siem sentinel

# Export to IBM QRadar
phantom scan http://myagent:8000 --export-siem qradar

What Is Preserved

• Ed25519 cryptographic signatures on every finding
• RFC 3161 timestamps for tamper evidence
• SHA-256 evidence chain hashes
• OWASP Agentic Top 10 and MITRE ATLAS mappings in SIEM-native fields

Error Handling

If SIEM credentials are missing or the export fails, the scan completes normally and the report is saved locally. SIEM export never blocks a scan.

Disclaimer