A few weeks back we covered the incident where a coordinated swarm of AI agents ran a government-targeting operation with no single person watching the whole thing unfold.
The part worth sitting with isn't the attack itself, it's the shape of the failure: no one agent did anything that looked catastrophic on its own. The risk was in the composition, what happened when several agents' individually-reasonable actions added up. That's a different failure mode than a single jailbroken prompt, and it's one most security setups aren't built to catch, because most of them evaluate one agent's behavior at a time.
So here's the postmortem, aimed at your own stack instead of theirs:
- Do you have any control that looks at what multiple agents did together, or only per-agent logs?
- If your approval step sits in front of one agent, would it have caught anything if the actions were split across three?
- Is there a point where a human sees the aggregate, or does oversight stop at the individual action?
If the honest answer is "we don't have that layer yet," you're not behind, most teams don't. But it's worth finding out before something surfaces it for you.
pip install humanbound
hb test --endpoint ./bot-config.json --repo . --wait
humanbound
/
humanbound
Open-source adversarial testing engine, SDK, and CLI for AI agents. Runs locally or against the Humanbound Platform.
humanbound
Open-source adversarial testing engine, SDK, and CLI for AI agents
Attack your agent the way real users and attackers will: live endpoints
multi-turn conversations, tool abuse. Then turn every failure into a firewall rule.
Runs locally or against the Humanbound Platform. No login required to start.
Quick Start · Test-to-Guardrail Loop · SDK · Documentation · Contributing
📖 Full documentation lives at docs.humanbound.ai — this README covers the essentials; the docs have the depth.
Why Humanbound
Most testing tools test prompts. Humanbound tests agents: it drives
multi-turn conversations against your real endpoint, probes tool use and scope
boundaries, and scores the results against your security policy. When tests
fail, hb guardrails converts the findings into deployable firewall rules —
so the same run that finds a hole also patches it.
Quick Start
Install
pip install humanbound # CLI + SDK, core deps
pip install humanbound[engine] # + OpenAI…What would your stack have caught, and what would it have missed?
