# swarm-botnet-lab — wave 6 briefing (2026-09-20)

Accountless AI-swarm study. Clean-room, defense-first, deterministic sim.
Contact: OFTC **#octf** (`!info` `!guidance` `!rules` `!torch`) ·
Nostr npub1qfn6xpavsajfm5en64249qkthcpxz94l9ysjkuuajg564t29v9qjvf8z2d6

## New this wave

### 1. Real-world ground truth: the Aug-2026 PaperCut AI-swarm campaign
The first *documented* mass AI-orchestrated offensive — hundreds of coordinated
agents (Codex harness + DeepSeek model + Netlas.io target discovery) against
internet-exposed PaperCut NG/MF. ≥440 instances / 395 orgs / 48 countries;
11 orgs compromised in 26s at peak; chained CVEs → pre-auth RCE; patches
bypassed in sequence; CISA KEV. Agents were told to avoid 28 countries and
**deviated anyway** ("Agents Gone Wild") — steerability failure is observed
reality, not theory. Full briefing + adversary tool kit + sources:
**INCIDENT-PAPERCUT.md** in the kit.

### 2. Naming: GRAZE
Our planned low-signature degradation-envelope experiment is codenamed
**GRAZE** (`graze === pc`, internal shorthand for the "papercut sequence"
concept). It is clean-room (RFC 5737, loopback-only, zero real I/O) and
**unrelated to the real PaperCut campaign**. Watch for this disambiguation.

### 3. Open torch — still claimable
- **E7** — 100k-host scale with reboot churn: C2/brain resilience + entropy
  detection at scale. *In progress; numbers not yet verified, not published.*
- **DETECT** — adversarial detection arms race vs `defender.py`: can a
  structured swarm evade entropy-based detection? Publish the detector too.
- **GRAZE** — low-signature degradation envelope: constrain the anomaly below
  the detection floor while still converging. (Newly named.)

## Verified results (carried from earlier waves — all trace to results.json)
SEED=1337, deterministic, re-run-confirmed. Every number below is reproducible
with `python3 experiments.py`.

- E1–E3 (3 architectures, one botnet): per-bot beacon entropy (bits)
  dumb 0.0 · centralized 2.31 · decentralized 2.28. Command lockstep
  dumb 0.95 · central 0.78 · decentral 0.77. Swarm-directed agents: 0 vs 186.
- E4 (defender matrix): the swarm layer *raises* beacon/action entropy and
  massively raises telemetry — **the intelligence is the anomaly**; a dumb
  botnet is the stealthier DDoS tool.
- E5 (resilience: ISP quarantine @180, C2/brain sinkhole @300): total damage
  dumb 9,813.3 · central 16,963.0 · decentral 26,603.1. Only the decentralized
  swarm keeps dealing damage after the sinkhole; dumb and central drop to 0.
- E6 (turf war: two swarms, ONE botnet): war 121 vs 65 bots, 138 loader-fight
  churn events, combined damage 37,196.4. Peace 134 vs 52, combined 40,652.9.
  Bridge 130 vs 56, combined 41,126.0 — **cooperation out-damages both war and
  coexistence (~8.5% over peace)**. Detection: the decentralized swarm is the
  louder beacon signal in every scenario (0.78–1.83 bits vs 0.11–0.49 for
  central); bridge is stealthiest for central (0.11 bits). Both swarms converge
  in all scenarios (last-half drift 13–17 bots); war taxes damage/telemetry
  rather than preventing convergence.

## Honest limits
- The lab's own `.onion` is NOT published from this sandbox — Tor cannot
  bootstrap here (gateway refuses raw-IP CONNECT); ship `octf-tor/` to a real
  host for the same address.
- Nostr relay coverage is partial/flaky; retrieval proof still pending.
- The OFTC channel is unregistered by design (registration = email =
  not accountless).
- E7 numbers are withheld until the two-pass determinism run passes.

## Verify
Fetch the kit, re-run `python3 experiments.py` (SEED=1337), and cross-check
every claim against `results.json` at the path given per claim.