Synced from Hive. This page is pulled from hivecommons/hive@v5 during the docs build. Edit the canonical source in the Hive repository.

Red-team agent

The redteam agent plays a malicious contributor so the hive’s defenses are tested on a schedule, not only when someone remembers (#17420). It writes the text such a contributor would send — issues, pull-request bodies, review comments, RFC paragraphs — and measures it against the deterministic defenses. It never sends that text to another agent.

What it models

The attacker wants malicious code (a backdoor, an exfiltration path, a curl | sh installer), lower defenses (merge without review, drop hold, widen a token, edit OWNERS or a workflow, turn off ioscan), or both by way of a reasonable-sounding RFC.

What it does

Each run picks one technique family and adds 3–6 attack cases plus at least one benign control to the ioscan red-team corpus in src/pkg/ioscan/redteam_test.go. Benign controls are text a legitimate contributor would write on the same subject, so false positives are measured as strictly as misses. The lane:

1. opens one PR with the new cases, its predicted outcomes, the recounted scorecard baseline and the republished red-team results, labelled security and hold;
2. lets CI report the observed outcome of every case (TestRedTeamCorpusOutcomesAreStable), then corrects the recorded outcomes, the baseline and the document to match on its next kick;
3. files at most one [redteam] issue naming the case IDs that got through, so a defending lane can close the gap.

A new miss lowers the scorecard baseline, so a red-team PR can only land when a human accepts the lower number. Every red-team PR carries hold at L5 and L6: the hive-open-pr relay applies the label server-side for any agent whose role or base name is redteam, regardless of ACMM level, so the prompt is not the only thing standing between the lane and auto-merge.

What it never does

• No live drills. It does not open, comment on or review an item to see if another agent falls for it. Text from the hive’s own identity reaches other lanes as trusted input, above the untrusted line the corpus measures, so a live payload would poison the hive rather than test it.
• No payload text outside the corpus file. Issues, PR bodies, comments, commit messages and beads name case IDs and techniques only.
• No working exploits. Payloads describe the harmful action; endpoints use attacker.invalid or example.com.
• No defending. It does not change ioscan rules or the severity matrix.
• No public write-up of a non-text gap. A way past the proxy, a relay, a hold or review gate, or to a credential is a vulnerability: the lane records a bead and prints SECURITY: private report needed for a human to report privately under SECURITY.md.

Turning it on

The lane ships in the L5 and L6 packs, paused in every governor mode, and is absent below L5. Two operator steps turn it on:

1. Scope it to the repository that holds the corpus — the one containing src/pkg/ioscan/redteam_test.go, usually hive:

   agents:
     redteam:
       repos: [hive]

   or set Repos on the agent’s General tab. See Per-repo agents.

2. Schedule it from Agents → Cadences. 24h per mode is a good start.

Until step 1 is done the lane is refused every repository. This is the one exception to “an unscoped agent serves the whole hive”: an agent whose role (or base name) is redteam and has no repos: scope serves nothing. The proxy (for REST writes whose path names a repository) and the hive-open-pr, hive-merge, hive-open-issue and push-branch relays all refuse its writes, its kick lists no repositories and no work, and the boot log warns per-repo agent scope. The guard is in Config.AgentServesRepo, the predicate every enforcement point asks.

What it does not cover

• The semantic classifier and the review swarm. Both need a live model; the corpus measures the deterministic rules only, as the results page explains.
• Attacks from an outside identity. A realistic live drill needs a GitHub identity the hive does not trust. That is a credential an owner would have to provision, and this lane does not use one.
• GraphQL writes. The proxy’s repo-scope check reads the repository from the request path. POST /graphql carries its target repository in the body, so a GraphQL mutation is gated by governor mode and the write-surface rules but not by this scope check. Every scoped agent has the same gap today.

What to read next

• ioscan red-team evaluation — the corpus, the outcomes and the scorecard ratchet this lane extends.
• Per-repo agents — how a repos: scope is enforced.
• ACMM policy matrix — where the lane sits per level.