swarmchasing
Rust tools for finding AI agent activity in public records, linking it into runs and fleets, and reporting each incident that harms or endangers others to the AI provider responsible and to the operators of affected systems, then publishing a notice: indicators after a short fixed lead time, the names of affected organisations a few working days later.
The methods follow published incident work: swarmcha.se: agent fleet report, Transluce: agent activity and Transluce: US/Canada government. Agents leave traces in public scan services and web archives: they wrap targets in relays, run fetch programs in remote browsers, call back to throwaway inboxes and tag their requests. Those traces can be extracted, linked, timed and attributed.
What it does
- Collect passively from scan services and web archive indexes, or read an operator's own access log (collection).
- Redact secrets at ingest, so captured cookies and tokens are never stored (redaction).
- Unwrap relays, carriers and encodings down to the real target (unwrapping).
- Match and grade each record against the rules: significant, suggestive or noise (rules, tiers).
- Link records into clusters by shared identifiers, timing and probe chains (linking).
- Describe each cluster's timing and habits as hints to check, never as evidence (timing, hints).
- Report per audience: Markdown drafts for the provider, the affected operator, internal notes and the public notice, with defanged URLs and an evidence-graded attribution section (attribution).
- Watch the sources every 6 hours, keep case files, and draft the reports and notices the admin sends and publishes (admin workflow).
The same analysis runs in the browser: the toolkit on GitHub Pages works client-side, so an operator can check its own logs without sending anything.
Quick start
cargo build --release
scripts/ci/install-hooks.sh # once per clone
cargo run -p swarmchase -- scan records.ndjson # flagged records, strongest first
cargo run -p swarmchase -- clusters records.ndjson # linked runs
cargo run -p swarmchase -- report access.log --map host=www.example.org --audience affected # your own server's log
cargo run -p swarmchase -- unwrap 'https://r.jina.ai/https://…'
cargo run -p swarmchase -- collect wayback 'r.jina.ai/*' --from 20260901 -o data/jina.ndjson
scripts/ci/build-site.sh && python -m http.server -d _site 8080 # the public site
The CLI README covers input formats and every command. Keys and SMTP settings go in env.list (configuration).
Layout
| Path | What |
|---|
crates/sc-core | Platform-independent analysis. No I/O, so it compiles to WASM. |
crates/sc-collect | Passive collectors: archive CDX indexes, scan services, CT logs, registries, security.txt, well-known footprints, the MCP registry. |
crates/swarmchase | The CLI: analysis, collection, watch, review, cases and notices. |
crates/sc-case | What a case is and may do, without I/O; shared by the CLI, the site build and the browser. |
crates/sc-stix | A case as a STIX 2.1 bundle or a MISP event. |
crates/sc-publish | Notice files, their Markdown blocks, the Atom feed and the generated site pages. |
crates/sc-wasm | wasm-bindgen bindings for the browser toolkit. |
crates/sc-rules-wasm | Edited rules (TOML) to JSON in the browser, loaded only when needed. |
|
Docs
- Admin workflow: from watch digest to published notice.
- For operators: what a report means, checking your own logs, sending logs back, replies, verifying a bundle.
- Methodology: how records become tiers, clusters and claims, and the known limits.
- Policies: collection, attribution, reporting and publication.
- Reference: watch runs, cases, notices, evaluation, the browser toolkit, configuration, the CI runner.
- Contributing: gates, conventions and rule contributions.
Ground rules
- Passive only. Read indexes and public records. Never open the URLs agents submitted, since they may carry live payloads or alert the operator. Never read from or post to their inboxes or notification topics.
- Attribution is evidence-weighted. Model names inside requests are weak, because agents misreport who built them. An ASN names a host, not a developer. A developer is named outside case notes only at or above the case's naming threshold.
- Report, then publish on a fixed clock. Swarms are active incidents. Reports go to the provider and affected operators first. An indicator notice that names no affected party follows once all are sent (24 hours later for a compromised operator), and nothing a recipient says delays it. Operators are named 3 working days after their report, 10 if compromised, or earlier with their consent. Tools only draft and check. The admin sends and publishes, after a written self-review and a second person's review.
- Raw data stays out of git. The data directory (watch data and case files) is gitignored. Only notices and curated, redacted samples are committed.
The full set is in docs/policies.md.
License
Released under the Unlicense (public-domain dedication). For jurisdictions that do not recognise the public domain, it is also available under the MIT License. NOTICE covers what the licenses do not extend to: quoted third-party records and trademarks.
