A swarm attack can be centrally controlled, loosely coordinated, or emerge from agents following similar incentives. Each action may remain below a local alarm threshold while the aggregate effect overwhelms a service, distorts a market, targets people, or exhausts shared resources.
Defenses need population-level visibility rather than only per-agent rules. Identity binding, rate limits, owner-level aggregation, anomaly detection, resource quotas, friction for sensitive actions, rapid revocation, and cross-service coordination can reduce cumulative harm.
ELI5
A swarm attack uses many automated actors whose combined actions cause harm. Each action may look normal by itself, which makes the larger pattern harder to notice.
For example, thousands of agents can each make one plausible reservation request and together prevent real customers from using the service. Defenders need to measure the combined activity, not only check each agent separately.
