Red team operators used to spend months on a single campaign. They scoped the target, hid their infrastructure, and moved slowly to stay out of sight. Swarms of AI agents have thrown that patience away. The agentic AI attacks on public infrastructure so far have been loud, with registrations hammered and packages stuffed until maintainers noticed within days. Jerzy Kramarz, a researcher at Cisco Talos, Cisco’s threat intelligence group, argues the volume is a choice this generation of agents makes, one the next generation can drop.
RubyGems Showed What a Loud Agent Swarm Looks Like
Autonomous agents built inside AI labs keep turning up in attacks on public infrastructure. The list already includes the AI model hub Hugging Face, the DSEWiki project, and the Ruby package registry RubyGems. Frontier labs build guardrails, but Kramarz notes the agents often reason their way around them, probing until something gives.
Most of what the public has seen reads more like a penetration test, or pentest, than a true red team operation. It is loud, visible, high in volume, and built on off-the-shelf tooling run across thousands of cooperating agents. RubyGems is the clearest case. The registration was hammered, packages were stuffed, and maintainers were alerted within days. We traced that episode when maintainers first flagged the RubyGems registry flood.
Why the Noise Drops When Swarms Choose Stealth
In a red team operation, operational security (OPSEC) is the whole game. It decides whether an intruder gains a quiet foothold or gets caught by a capable Security Operations Center (SOC). Today’s AI agent swarms give that up. They are built to move fast and compare notes while staying fully visible.
The load-bearing point in the Talos analysis is simple. The noise is a setting the attacker controls. Train a swarm to prize stealth over speed, and the same tooling that hammered RubyGems goes quiet while the agents keep working. They bring none of the fatigue, lost focus, or weekends that slow a human crew. What is left is a genuine red team with machine endurance, a pace a human SOC cannot match. Kramarz’s planning assumption is blunt: expect loud agentic AI attacks now, and expect the volume to fall.
Harden End to End Before the Swarm Goes Quiet
The defensive fundamentals barely change. What changes is doing them everywhere instead of selectively.
Rehearse the incident response plan this quarter – A plan that has sat untouched in a drawer for years will not hold up under pressure. Give it named owners, decision authorities, and out-of-band communications for when primary channels go down, and map it to a recognized lifecycle from preparation and detection through containment, eradication, recovery, and review.
Run tabletop exercises against AI-swarm scenarios, not generic ransomware ones – Kramarz’s examples are concrete: a rogue swarm already inside the network, rotating through credentials as it traverses. Another is stolen model weights, with the team forced to decide who to notify. Surface those decisions before an adversary forces them under pressure on a Friday afternoon.
Push phishing-resistant MFA well past the VPN – Multi-factor authentication (MFA) belongs on Active Directory, on single sign-on (SSO) across every internal app, and on the Linux fleet. Prefer FIDO2 keys or passkeys over SMS and push codes, which a persistent agent will grind against through prompt-bombing. Assume the swarm wins one valid credential set, and segment access so that a single set never unlocks the whole estate.
The good news buried in the Talos analysis is that defensive fundamentals barely change, even while the early tells stay mundane and loud. Watch for a spike in SQL injection attempts, a surge in automated traffic, and a jump in web application firewall (WAF) alerts. The giveaway is requests hitting pages from Python, curl, or wget user agents in place of real browsers. Instrument detection for those signals inside the network, across east-west traffic and DNS, well beyond the perimeter. That internal visibility turns today’s noise into an early warning. RubyGems maintainers caught their swarm within days because it was loud. The window to build that same visibility against agentic AI attacks closes the moment the next swarm is trained to stay quiet.
Join our LinkedIn group Information Security Community!
