What SwarmHack is

SwarmHack is Prancer's AI-Native autonomous penetration-testing swarm: a Rust binary (swarmhack) that drives a coordinated multi-agent kill chain against an operator-supplied target, extracts crown jewels from each confirmed vulnerability, and emits an OCSF 1.1.0 Vulnerability Finding report (class_uid=2001, category_uid=2) plus customer-facing Markdown and HTML deliverables.

The three agent families

Agents are organised into three families orchestrated by a GOAP A\* planner over a kill-chain phase routing layer:

| Family | Count | Focus |

| --- | --- | --- |

| Web / API exploit | 23 | SQLi, XSS, CSRF, IDOR, SSRF, JWT, deserialization, etc. |

| AD / identity / network | 34 | LDAP, Kerberos, SMB, NTLM relay, DCSync, ADCS, Entra |

| Secure Service Edge (SSE) | 16 | ZTNA, DNS, SWG, CASB, DLP, RBI, GenAI, observability |

Total: 100+ customer-facing agents.

What SwarmHack is not

SwarmHack is not a configuration auditor, not a Breach and Attack Simulation (BAS) platform, and not a vulnerability scanner.

The unit of output is an *exploit-validated* finding: every Critical / High finding in a report has a deep-exploitation evidence trail — extracted credentials, served files, dumped tables, replayed tickets — recorded in the same JSON. Scans that find nothing emit zero findings; SwarmHack never fabricates "informational" volume.

Reference metadata

| | |

| --- | --- |

| Binary version (Cargo.toml) | 2.6.0 |

| npm package (release/npm/package.json) | [email protected] |

| Operator audience | Prancer engineer, partner SE, customer security operator |

| Evaluator audience | CISO, security architect, partner technical lead |

| Companion docs | npm README, exploit-validated-sse-assessment whitepaper, SSE lab README |

[!IMPORTANT]

SwarmHack is not a publicly available tool. It is distributed to clients under signed contracts and asset-ownership documentation. Every engagement requires the operator to load a per-engagement authorization document via --authz-doc. See the Authorization Model for the safety contract.