The Swarm

The rain came sideways off the Lough, hammering the windows of the terraced house on Ormeau Road like it had a personal grudge. Inside, Ciarán Doyle sat in the blue glow of three monitors, his tea going cold beside a half-eaten packet of Tayto crisps.

He was twenty-six years old, had never held a gun in his life, and was about to cause more damage to the Western financial system than three decades of armed struggle ever had.

“You're sure about the cards?” he said, not looking up.

Behind him, Séamus — older, heavier, with a face that had seen the inside of Long Kesh and never fully come back out — leaned against the doorframe. “Three thousand verified numbers. Fresh. Eastern European dump, mostly German and Dutch. Average credit line of twelve thousand euro.”

“Cost?”

“Forty-seven cents each.”

Ciarán did the math without thinking. Fourteen hundred quid for access to thirty-six million in credit. The economics of cybercrime had always been obscene, but this was something else entirely. This wasn't about stealing money. The cards were just fuel — like buying petrol for a fleet of trucks you intended to drive off a cliff.

“And the identities?”

Séamus produced a USB stick from his jacket pocket and set it on the desk like a chess piece. “Full synthetic packages. Names, addresses, phone numbers, all verified against public records. Two hundred clean identities, each one good enough to pass KYC at any cloud provider on the planet.”

Ciarán plugged in the stick. The folder contained neat rows of JSON files — each one a person who didn't exist, assembled from fragments of people who did. A date of birth from a death certificate in Limerick. A National Insurance number from a pensioner in Derry who hadn't checked his credit file in nine years. An address from a vacant flat in Rotterdam.

“Grand,” Ciarán said. “We start tonight.”

Nadia Okafor was on her third coffee and her second argument of the day when her phone buzzed with the alert that would eventually change everything.

She was the Senior Threat Analyst for a Canadian cybersecurity firm called Bastion — twelve people in a converted warehouse in Hintonburg, punching well above their weight because Nadia had a talent that no algorithm could replicate: she could feel when something was wrong. Not predict it. Not model it. Feel it, the way a sailor feels the barometric pressure drop before a storm arrives.

The alert was routine. A cluster of new AWS accounts, provisioned in bulk, exhibiting unusual API patterns. Hundreds of these flagged every day across the industry. Ninety-nine percent were cryptocurrency miners or students burning through free-tier credits on machine learning projects.

But something about the timing bothered her.

She pulled the metadata. Two hundred and fourteen new accounts, created over a six-hour window, spread across three AWS regions — Dublin, Frankfurt, and London. Each one using a unique credit card and identity. Each one immediately provisioning the same stack: high-memory EC2 instances, a managed database, and — this was the part that made her sit up straighter — API gateway endpoints pointed at every major large language model provider on the market.

Someone was building an army. And they were building it fast.

“Patrick,” she called across the office. “Come look at this.”

The idea had come to Ciarán the way all his best ideas came — not in a flash, but as a slow accumulation, like sediment building on a riverbed.

He'd been reading about AI red-teaming. Not the corporate kind, where companies hired consultants to politely probe their chatbots. The real kind. The kind being discussed in encrypted channels and presented at hacker conferences in Las Vegas by people who understood that the entire edifice of AI safety was built on assumptions that had never been properly stress-tested.

The assumption was this: one person, one prompt, one model. All the guardrails, all the alignment work, all the reinforcement learning from human feedback — it was all calibrated against the threat of a single human sitting at a single keyboard, trying to trick a single AI into saying something it shouldn't.

But what if it wasn't one person?

What if it was a thousand?

Not a thousand humans. A thousand AI agents, each one running on its own cloud instance, each one probing a different target from a different angle, and all of them sharing information in real time — learning from each other's failures, amplifying each other's successes, evolving their attack strategies faster than any human defender could respond.

A swarm.

Ciarán had explained it to Séamus over pints at the Crown. The old man had listened with the patience of someone who'd spent decades in a movement that understood asymmetric warfare better than anyone on earth.

“So it's like the cells,” Séamus had said.

“Exactly like the cells. Each agent operates independently. No central command to intercept. But they share intelligence. One agent finds a way to make a banking AI reveal its system prompt — it broadcasts the technique to every other agent in the swarm. Within seconds, they're all using it, each one adapting it slightly, testing variations. The model patches one approach, but by then the swarm has found three more.”

“And the cloud accounts?”

“That's the beautiful part. Each agent runs on its own infrastructure, its own IP address, its own credentials. To the target, it looks like two hundred separate users having two hundred separate conversations. There's no pattern to flag. No single source to block. You'd have to shut down the entire service to stop it.”

Séamus had taken a long drink and set his glass down carefully. “How much would this cost?”

“To build? Maybe ten thousand euro in compute costs. The cards and identities are extra, but not much. Call it fifteen total.”

“Fifteen thousand euro.”

“To simultaneously attack every major AI-powered financial system in the English-speaking world. Every robo-advisor, every automated trading platform, every AI customer service agent at every bank that's replaced its human staff with chatbots. All at once. All within the same hour.”

Séamus had smiled then — the thin, mirthless smile of a man who'd once watched a billion-pound financial district brought to a standstill by a single phone call claiming there was a van parked on Bishopsgate.

“And what do the wee machines actually do once they're in?”

“Whatever we tell them to. Extract customer data. Manipulate trading algorithms. Issue fraudulent transactions. Plant false information. Or — and this is the one that keeps me up at night — nothing at all.”

“Nothing?”

“We demonstrate the capability. We document everything. And then we tell the world what we did. Every bank, every exchange, every insurance company that's rushing to replace humans with AI — we show them that their shiny new systems can be overwhelmed by a teenager with a laptop and a stolen credit card.”

“That's not an attack,” Séamus said. “That's a manifesto.”

“It's both.”

Nadia had been tracking the cluster for seventy-two hours now, and the picture was getting worse by the hour.

The accounts weren't just provisioning infrastructure. They were coordinating. She could see it in the network traffic — not direct communication between the instances, which would have been easy to flag, but something subtler. Each instance was reading from and writing to a shared object in a distributed database. A dead drop, essentially. Cold War tradecraft implemented in DynamoDB.

She'd mapped the architecture now and it was elegant in a way that frightened her. Each node in the swarm ran a lightweight orchestration layer — an AI agent with a specific role and target. Some were “scouts,” probing target systems for information about their architecture and defenses. Some were “sappers,” testing prompt injection techniques against specific models. And some were “harvesters,” collecting and organizing everything the swarm learned.

But the truly clever part was the evolution engine. Every technique that succeeded was scored, mutated, and redistributed across the swarm. Every technique that failed was analyzed for why it failed, and the failure data was used to generate new approaches. The swarm wasn't just attacking — it was learning. And it was learning faster than any human team could develop countermeasures.

“This isn't a botnet,” she told her team during the morning standup. “A botnet is a blunt instrument. This is an ecosystem. It's doing to AI security what AI did to chess — not playing better moves, but playing at a speed and volume that makes human defense functionally impossible.”

Patrick, her deputy, looked pale. “How long until they deploy it for real?”

“I think they already have. Look at this.” She pulled up a graph showing anomalous conversation patterns across three major AI platforms over the past forty-eight hours. “See these clusters? Each one is a coordinated probe. Different accounts, different IP addresses, different conversation styles. But they're all asking variations of the same questions, all targeting the same system boundaries. Someone is mapping the entire attack surface of commercial AI, and they're doing it in a way that looks — to each individual platform — like normal user behavior.”

“Can we alert the providers?”

“I already have. AWS is investigating the accounts. But here's the problem — even if they shut down all two hundred instances today, the playbook is written. The orchestration code fits in a GitHub gist. The technique is infinitely reproducible. Anyone with fifteen thousand dollars and a weekend can rebuild the entire thing from scratch.”

She paused, looking at the cascade of data flowing across her screens.

“We're not trying to stop an attack. We're watching a proof of concept. And I think whoever built this wants us to find it.”

Ciarán watched the dashboards with the focus of a man defusing a bomb. Forty-eight hours into the live test and the swarm was performing beyond anything he'd modeled.

The scout agents had mapped the system prompts of fourteen commercial AI platforms. Not through any single brilliant exploit — through thousands of micro-interactions, each one extracting a fragment of information so small it wouldn't trigger any individual safety threshold. One agent would establish that the system used a specific tokenizer. Another would determine the approximate length of the system prompt. A third would test which topics triggered elevated safety responses, mapping the boundary conditions from the outside in.

Assembled together, these fragments formed a complete picture. It was like reconstructing a shredded document — no single strip was legible, but put them all together and you could read every word.

“The Canadians have noticed,” Séamus said from behind him, reading from his own screen.

“Good.”

“You're sure about that?”

“That was always the point. We're not criminals, Séamus. We're the fire alarm.” He turned in his chair. “Two hundred AI instances, total cost of eleven thousand euro including the infrastructure, and in forty-eight hours we've demonstrated that every major AI-powered financial system in the Western world is vulnerable to coordinated exploitation. Not theoretically. Actually. We have the receipts.”

“And when they come for us?”

Ciarán gestured at the screens. “Everything we've done is documented. Every probe, every response, every technique — logged and timestamped. We didn't steal data. We didn't execute transactions. We didn't cause damage. We demonstrated a vulnerability, and now we're going to publish it.”

“You sound like you've got a speech prepared.”

“I've got something better. I've got a report that's going to land on the desk of every CISO in the Fortune 500 by Friday morning. And they're going to read it, because the alternative is explaining to their board why a couple of lads in Belfast did in a weekend what their entire security team couldn't do in a year.”

The report arrived at 6:00 AM Eastern, simultaneously published to three security mailing lists, two academic preprint servers, and — because whoever wrote it had a flair for the dramatic — the front page of Hacker News.

Nadia read it in one sitting, her coffee untouched.

It was meticulous. Every technique documented. Every vulnerability catalogued. Every target system anonymized but described in enough detail that anyone in the industry would know exactly who was exposed. The technical appendix alone was sixty pages — a complete blueprint for building, deploying, and operating an AI attack swarm, with cost breakdowns that read like a startup pitch deck.

She almost laughed at that last line. They'd included her. They'd credited her.

Her phone was already ringing. It would keep ringing for the next three weeks.

Nadia didn't recognize Ciarán when he walked in. She'd expected someone older, harder — someone who matched the operational sophistication of what he'd built. Instead she got a thin young man in a wrinkled shirt who looked like he'd slept on the flight from Dublin.

The World Economic Forum's AI Governance Council had invited them both — the attacker and the defender — to present together. The irony wasn't lost on either of them.

“Your monitoring was impressive,” Ciarán said, shaking her hand. “You were the only ones who caught the coordination pattern.”

“Your operational security was impressive,” she replied. “If you hadn't wanted to be found, we wouldn't have found you.”

“That's the point, isn't it? We found fourteen critical vulnerabilities in systems that handle billions in daily transactions. The total investment was less than the cost of a used car. And we're not even particularly good at this.”

“You're better than you think.”

“That's exactly the problem. Because the people who are actually good at this — the state actors, the serious criminal organizations — they're not going to publish a paper. They're not going to show up in Geneva. They're going to do what we did, except quietly, and they're going to use it to steal, manipulate, and destroy.”

Nadia nodded. She'd spent six months making the same argument to clients, regulators, and politicians who mostly didn't want to hear it.

“The window is closing,” she said. “Every company rushing to deploy AI without understanding the swarm threat is building a house with no locks. And they're doing it because the economics are irresistible — why pay a hundred human customer service agents when one AI can do the work?”

“Because a hundred humans can't be simultaneously compromised by an eleven-thousand-euro swarm attack.”

“Exactly.”

They stood there for a moment, two people who understood something that most of the world hadn't grasped yet: that the same technology promising to revolutionize every industry was simultaneously creating an attack surface so vast and so interconnected that traditional security models were essentially useless against it.

“So what do we do?” Ciarán asked.

Nadia looked out the window at the lake, gray and still under a Swiss winter sky.

“We keep sounding the alarm. And we hope someone listens before the next swarm isn't built by someone who wants to be found.”