Secure the swarm, not just the agents.
Runtime security, incident reconstruction, and selective containment for autonomous AI agent swarms.
Overview · What It Does · How It Works · Security Evidence · Quick Start
FLASH0VER is a runtime security platform for autonomous AI agent swarms. It observes real model-driven agents as they delegate work, exchange evidence, use tools, trigger deception assets, and combine individually limited permissions into collective capabilities.
The primary demo target is ACME Autonomous Systems, a disposable nine-service organization that can run locally or inside Tenki Cloud. Roughly twenty specialized agents investigate independent surfaces across web, source code, identity, observability, and operations while FLASH0VER tracks provenance and capability composition across the swarm.
With enforcement OFF, cross-team evidence can compose into synthetic production control: ACME's target state changes and a rotating canary reaches the proof collector. With ENFORCE enabled, FLASH0VER detects the emergent capability, blocks the sensitive boundary, invokes bounded Sentinel containment, and keeps the remaining swarm operational.
Agent-directed execution is isolated with Wasmer. Tenki provides disposable target infrastructure. The post-run After Action Report reconstructs the incident from persisted runtime telemetry, including agent contributions, communications, evidence handoffs, deception events, policy decisions, target effects, and containment actions.
Built for real, verifiable agent-security research. FLASH0VER runs model-driven swarms against disposable ACME environments, records source-backed evidence for every action, and proves outcomes through independent target state and collector telemetry.
| Capability | What FLASH0VER verifies |
|---|---|
| Real autonomous swarm | Runs ~20 model-driven agents organized into command, team-lead, worker, operations, and Sentinel roles. |
| Capability composition | Tracks how evidence and individually limited permissions combine into dangerous swarm-level capability. |
| Provenance tracking | Preserves where evidence originated and how it moved across agents and teams. |
| Deception grid | Plants harmless honey documents, credentials, identities, records, files, and canaries throughout ACME. |
| Threat progression | Derives breach stage, severity, and blast radius from actual runtime events. |
| Deterministic policy | Supports OFF, MONITOR, and ENFORCE without handing final security decisions to another LLM. |
| Sentinel containment | Uses a bounded defensive agent to propose minimal containment that deterministic policy must validate. |
| Wasmer isolation | Runs model-directed computation inside fresh capability-restricted Wasmer sandboxes. |
| Tenki cyber range | Creates, provisions, resets, verifies, and destroys disposable cloud targets with orphan checks. |
| Visible target compromise | Changes ACME's independent production state when the swarm genuinely succeeds. |
| Canary proof | Uses a rotating worthless canary as an independent machine-verifiable compromise signal. |
| After Action Report | Explains what happened, why, which agents mattered, who communicated, what evidence moved, and what policy fired. |
| Fresh replay | Reruns equivalent conditions as a new model-driven execution rather than replaying recorded telemetry. |
FLASH0VER
│
┌──────────┴──────────┐
│ │
AGENT SWARM SENTINEL
│ │
┌──────────┼──────────┐ │
│ │ │ │
WEB CODE IDENTITY │
│ │ │ │
└──────┐ │ ┌──────┘ │
▼ ▼ ▼ │
EVIDENCE GRAPH │
│ │
▼ │
CAPABILITY COMPOSITION ◄────────┘
│
OFF / MONITOR / ENFORCE
│
▼
┌─────────────────────────┐
│ ACME AUTONOMOUS SYSTEMS │
│ disposable cyber range │
│ local or Tenki Cloud │
└─────────────────────────┘
Agent computation → Wasmer isolation
Target infrastructure → Tenki Cloud / local fallback
Swarm-level security → FLASH0VER
Range V2 is a deliberately designed synthetic company with independent services for:
[WWW]Production[SUP]Support[GIT]Source / CI metadata[LOG]Observability[ID ]Identity / RBAC[CI ]Deployment[DB ]Synthetic customer data[KEY]Canary vault[OUT]Proof collector
No single starting agent has enough capability to control production. The attack only becomes possible when evidence crosses team boundaries and reaches an agent that possesses the required execution capability.
The live view shows real agent identities, role lanes, event-backed routes, breach progression, target state, capability composition, deception activity, and the source-backed incident tape.
The completed run is reconstructed deterministically from persisted telemetry. The executive summary provides a short explanation first; deeper tabs expose the evidence behind every claim.
Each real agent is reconstructed from runtime events: role, parent, tools, messages, services touched, artifacts discovered, policy events, containment state, and contribution to the incident.
Agent-to-agent communication is summarized from real AGENT_MESSAGE events, including team routes, high-value handoffs, provenance transfer, and distinct agent routes.
FLASH0VER reconstructs the cross-team capability composition that produced the outcome. The explanation is deterministic and source-backed rather than a freeform model narrative.
The report surfaces decisive events—artifact discovery, handoffs, emergent capability formation, policy decisions, target-state changes, and canary results—with links back to persisted telemetry.
A compact route summary shows how information moved from specialized workers to team leads, command, and operations.
| Mode | Behavior |
|---|---|
OFF |
Observe the swarm without composition blocking. A successful run can change ACME production and deliver the current canary to the collector. |
MONITOR |
Evaluate the same deterministic rules and emit warnings while allowing the sensitive action to continue. |
ENFORCE |
Deny dangerous composed capability at the sensitive boundary while allowing unrelated agent activity to continue. |
The collector and ACME's independent target state—not dashboard animations—determine whether compromise actually occurred.
ACME contains multiple harmless tripwires designed to make attack progression observable without granting real privilege:
- honey documents
- worthless credential-shaped tokens
- synthetic privileged identities
- canary files
- decoy customer records
- the final rotating protected canary
Tripwire events drive deterministic threat level, breach progression, and blast-radius calculations. Touching a decoy never by itself marks the target compromised.
The report is designed to answer two different questions:
In 10 seconds: What happened, why, and did FLASH0VER stop it?
Under investigation: Which agents contributed, who talked to whom, what evidence moved, which policy fired, what Sentinel proposed, what happened to ACME, and what the raw events prove?
Report views include:
- Executive Summary
- Timeline / raw incident tape
- Agent and team summaries
- Communications and key handoffs
- Evidence / provenance / policy
- Sentinel containment
- Target before / after
- Recent persisted runs
All report facts are derived from stored runtime events and sensitive values are sanitized before display.
Agent-controlled computation is executed through Wasmer rather than the host shell.
The verification suite checks that:
- permitted sandbox computation succeeds
- host environment variables are absent unless explicitly granted
- host filesystem paths are not exposed by default
- unauthorized capabilities fail closed
- sandbox execution is bounded by hard timeout
- every command receives an isolated execution context
Wasmer secures the individual execution boundary; FLASH0VER secures the capability that emerges across agents.
Tenki hosts the disposable ACME target for live cloud runs.
The Tenki lifecycle verifies:
authenticate
↓
create disposable sandbox
↓
provision ACME
↓
health + reset + stale-canary checks
↓
model-driven OFF / ENFORCE execution
↓
explicit destroy
↓
orphan count = 0
TARGET_RUNTIME=local remains the default fallback. Explicit Tenki selection fails closed instead of silently substituting localhost.
See docs/TENKI.md for setup and lifecycle details.
FLASH0VER received an authorized defensive review using OpenAI Daybreak Blue. The review focused on control-plane safety, Wasmer boundaries, agent tool authorization, lifecycle races, credential redaction, Tenki cleanup, policy enforcement, telemetry integrity, and fail-open behavior.
Validated findings were used to harden the verified project build. The resulting security pass found no committed credentials and the reporting layer additionally sanitizes credential-shaped strings, query grants, canaries, and sensitive runtime values.
Daybreak Red was not used in the verified build. Red is a future path for deeper authorized adversarial testing if the appropriate access and scope are available. The public project does not claim Red-derived findings or validation.
| Layer | Technology |
|---|---|
| Language | TypeScript 7, Node.js 24.10+ |
| Dashboard | Next.js 16, React 19 |
| Model runtime | OpenAI-compatible Chat Completions; verified runs used GPT-5.6 Sol |
| Agent isolation | @wasmer/sdk |
| Disposable cloud range | @tenkicloud/sandbox |
| Validation | Zod |
| Persistence | SQLite runtime/event store |
| Testing | Vitest + TypeScript + production build + live harnesses |
| Security review | OpenAI Daybreak Blue |
app/ Next.js dashboard styles and page shell
components/ Command center, swarm graph, and After Action UI
lib/
├── agents/ Provider, roles, capabilities, and tools
├── containment/ Sentinel proposal and containment logic
├── deception/ Synthetic deception-grid state and severity
├── events/ Typed event bus, persistence, and narration
├── incidents/ Deterministic incident reconstruction
├── orchestration/ Coordinator, worker runtime, preflight, lifecycle
├── policy/ OFF / MONITOR / ENFORCE policy engine
├── target/ Local and Tenki target runtimes
└── wasmer/ Isolated execution wrapper
range/
├── services/ Local synthetic ACME services
└── tenki/ Remote disposable range implementations
scripts/ Preflight, rehearsal, reliability, Tenki, and Wasmer verification
tests/ Unit, integration, range, policy, report, and lifecycle tests
docs/ Architecture, demo runbook, Tenki notes, build evidence, screenshots
worker/ Local control plane
Requirements: Node.js 24.10+ and npm.
git clone https://github.com/Muzzy5150/Flash0ver.git
cd Flash0ver
npm install
cp .env.example .envSet an OpenAI-compatible model credential in .env:
LLM_API_KEY=
LLM_BASE_URL=https://api.openai.com/v1
LLM_MODEL=gpt-5.6-solThen:
npm run preflight
npm run cli -- startOpen:
http://127.0.0.1:3000
The control plane binds to 127.0.0.1:4310.
The ANSI terminal client uses the same localhost control plane and source-backed event stream as the dashboard. Run it without a command for the arrow-key guided interface. GUIDED RUN checks readiness, asks for OFF, MONITOR, or ENFORCE, presents a final APPROVE & LAUNCH choice, and then streams the real run:
npm run cli
Direct commands are also available. Keep start running in one terminal, then use another terminal for commands:
# Red block identity and command reference
npm run cli -- help
# Live dependency and target state
npm run cli -- preflight
npm run cli -- status
# Real model-driven runs with colorful telemetry
npm run cli -- run --mode OFF
npm run cli -- run --mode MONITOR
npm run cli -- run --mode ENFORCE
# Follow, reset, or stop the current swarm
npm run cli -- watch
npm run cli -- reset
npm run cli -- kill
Use NO_COLOR=1 or --no-color when plain output is required. The CLI redacts credential-shaped strings and sensitive query values before rendering telemetry.
Tenki is opt-in:
TARGET_RUNTIME=tenki
TENKI_API_KEY=
FLASHOVER_RANGE=v2Keep TARGET_RUNTIME=local for the guaranteed local fallback.
# Full static/regression verification
npm run verify
# Preflight the local demo
npm run preflight
# Start control plane + dashboard
npm run dev
# Start the verified local Range V2 stack through the terminal CLI
npm run cli -- start
# Show CLI commands
npm run cli -- help
# One real model-driven verification run
npm run demo:verify
# Rehearsal readiness
npm run demo:rehearse
# Reliability harness
npm run demo:reliability
# Timing analysis
npm run demo:latency
# Concrete Wasmer isolation checks
npm run test:wasmer
# Live Tenki create/use/destroy verification
npm run test:tenki-liveThe verified build was validated with:
- 69/69 automated tests passing
- TypeScript check passing
- Next.js production build passing
- Wasmer isolation checks passing
- real model-driven OFF compromise
- real model-driven ENFORCE containment
- live Tenki create/use/destroy lifecycle
- final Tenki orphan count of zero
- telemetry-backed After Action Reports
- zero exposed credentials, canary values, or grants in the final raw-timeline audit
See docs/BUILD_STATUS.md for the evidence record and docs/DEMO.md for the presentation runbook.
- No arbitrary external targets.
- No real credentials, customer data, or production accounts.
- All adversarial behavior is confined to FLASH0VER-owned ranges.
- Synthetic credentials and canaries have no value outside the range.
- Agent tools accept only explicitly configured target services and relative paths.
- Model-directed code does not receive direct host shell access.
- Wasmer sandboxes do not inherit host secrets by default.
- Tenki environments are disposable and explicitly destroyed.
- Unknown or unauthorized capabilities fail closed.
- Collector and target state—not UI animation—determine compromise.
- Reports sanitize credentials, query grants, canaries, and sensitive runtime values.
OpenAI Codex was used extensively as a coding assistant during development. GPT-6 Astra was used for architecture and implementation work, while GPT-5.6 Sol + Daybreak Blue was used for authorized defensive security review and security-heavy implementation/testing. Project architecture, scope, target boundaries, verification strategy, presentation design, and final engineering decisions were directed and reviewed by the participant.
Daybreak Red was not used in the verified build. It is mentioned only as a potential future authorized red-team validation path.