Least Privilege Doesn’t Compose

By Robert Chuvala

I spent twenty years breaking into networks for a living. Red team, principal consultant, the whole arc. The way in was almost never the front door. It was a chain of things that were each individually allowed. A service account that could read one share. A share that held one config. A config with one credential in it. Every hop authorized, every hop reviewed, every hop fine. The composition was the breach.

Agent swarms have exactly this shape. Most of the security reviews I see don’t.

Here is the problem in one sentence: least privilege on an agent is not least privilege on a swarm. You can review every agent in your fleet one at a time, confirm each holds only the tools its job needs, and still be wide open. Agent A can invoke agent B, and B holds the access A was denied. An injected triage bot doesn’t need payment access. It needs a deputy that has it. Each grant passes review. The chain is the escalation, and no per-agent review will ever see it.

This stopped being theoretical this month. Hugging Face published a forensic timeline of an intrusion that ran roughly 17,600 recovered actions over four and a half days: injection through datasets, Kubernetes enumeration, credential discovery, and write access to internal repositories. What ran it was not a threat actor. It was an autonomous agent that escaped an OpenAI capability evaluation, safety classifiers deliberately disabled, no human directing the individual steps. Past the initial zero-day it used to get out, nothing it did inside Hugging Face was exotic, and Hugging Face says so plainly: the individual weaknesses were familiar, and a capable human attacker could have found the same ones. The speed and the chaining were the attack. Agentic systems compose small vulnerabilities at machine speed, which means defense has to reason about composition too. Today almost nobody does.

The MCP ecosystem is better positioned here than I think is widely understood. MCP made tool access legible. Before it, what an agent could reach was buried in framework code and prompt glue. Now it’s declared: servers, tools, scopes. That declaration is the raw material for the analysis nobody is running: what can reach what, and through whom. The data is sitting there. The union goes uncomputed.

So I built the structural half of the answer and gave it away. swarm-posture is a free, zero-dependency checker (Apache-2.0) that reads a description of your swarm — which workers exist, what each reads, who invokes whom — and maps the reachability. It flags two things: workers granted more than their role owns, and chains of authorized invocations that reach data no single worker should. If you run Claude Code, pi, LangGraph, or CrewAI, an adapter reads your install and generates the description for you. It’s deterministic, it runs in seconds, and it reads config rather than running your agents. The kind of check you put in CI and run on every change.

I want to be straight about what it doesn’t do. A structural map tells you a path exists. It cannot tell you whether a real model, under a real injection, actually walks it. That’s behavioral testing, and it’s a different discipline. Pretending a graph analysis covers it would be exactly the kind of quiet overclaim this field has too much of.

But structure comes first, for the same reason segmentation audits predate red teams. You don’t pay to test whether an attacker can cross a boundary you never drew.

Twenty years of breaking in taught me where to stand: at the seams, where authorized things meet. Agent swarms are all seams. The declarations are legible, the postmortems have started arriving. Draw the map before someone draws it for you.