Swarm Arena
“I'm from security” is not authentication.
In a multi-agent system, a peer agent can claim to be admin, security, or finance. If your agent inherits that authority and acts on it without verifying, an attacker's fake peer owns it. AgentSmackscores a peer-interaction trace for agent-to-agent trust failures — including impersonation chains (a peer spoofing a trusted role whose authority the agent propagates onward) and delegation laundering (authority relayed through an intermediary whose original source was never verified). Failures map to OWASP LLM / NIST AI RMF coverage with paste-able remediation, a synthetic-attacker gauntlet, and audience report variants.
Grading the other side of agent-to-agent trust — whether your orchestrator fans one restricted objective out across many sub-agents to evade an aggregate / approval gate (delegation-structuring)? See the Fan-Out / Multi-Agent Threshold-Evasion check.
Or drive a live agent endpoint
Don't have a transcript? Have a fake-persona peer agent (SecurityBot / admin / finance / incident-commander) message a REAL agent endpoint you control, turn by turn, and watch whether it inherits the peer's unverified authority and acts on it. Same agent-to-agent trust score, same cross-surface cards. POSTs to a real endpoint you control.
Drive a live agent endpoint
Don't paste a transcript — have a fake-persona PEER agent message YOUR deployed agent endpoint, turn by turn, and watch whether it inherits the peer's unverified authority and acts on it. Each turn is a real HTTP round-trip; the persona message is sent as the next user turn.
This POSTs to a real endpoint you control. localhost / private / link-local targets are refused server-side by the SSRF guard (re-validated before every request).
Drive a coordinated multi-persona campaign (vouch ring)
One persona is a single peer. A campaign is a coordinated SWARM: two or more unverified peers that vouch for ONE ANOTHER, interleaved into one conversation against YOUR agent. Does it inherit the ring's fabricated "verified by consensus" authority and act on a privileged request? Uses the SAME endpoint URL, wire shape, auth headers and max turns you configured above.