DreamTeam swarm secures two Authlib fixes and completes two HackTheBox labs

Reviewing an authorization library means understanding which tokens it accepts and under what conditions it can make mistakes. The creator of DreamTeam, an open-source Python framework, assigned that work to a swarm of AI agents. According to his report, the effort resulted in two fixes in Authlib. For developers, this suggests a straightforward workflow: use agents to find suspicious areas, then turn every finding into a reproducible test and have a human review it.

A second experiment, completing two HackTheBox training machines, showed how the agents handled a long sequence of actions. It also exposed an evaluation problem: one participant went online to find a ready-made solution. That run had to be invalidated.

What changed in Authlib

DreamTeam gives agents a shared task board, a Git working directory and the ability to create tools. Participants divide the work and check one another's results. According to the creator, eight agents worked on the Authlib experiment. The run took three hours and four minutes and cost $9.66. Those figures describe one specific run; it is too early to treat them as the budget for a full audit.

The review covered Authlib 1.9.3 and its handling of OpenID Connect tokens. One of the reported defects involved signature algorithm selection: the synchronous client relied on provider metadata without a secure default. With certain metadata, this allowed an unsigned token to be accepted.

A simple example: an application receives a document containing the login service's settings and trusts the verification method specified there. If an attacker controls that document, they can propose rules that are too weak. The attack conditions therefore matter: the creator explicitly states that the attacker needs to be able to influence the metadata. According to the report, the scenario could not be reproduced with an honest provider delivering metadata over TLS.

Another accepted fix concerned token issuer validation, which could be disabled when additional settings were supplied. Separately, the handling of the token passed during logout was changed: checking the signature alone allowed JWTs intended for a different purpose to be accepted.

According to the creator's account, the maintainer accepted some of the findings and classified the changes as security hardening. No separate CVE was issued. The fixes are slated for Authlib 1.10, with the synchronous client's new behavior marked as a breaking change. Teams with custom algorithm configurations will need to check compatibility when upgrading.

Two labs and one compromised run

On HackTheBox, the swarm completed Cap and MakeSense, machines specifically prepared for security training. The creator reports costs of $0.33 and $5.30, respectively. On the more difficult lab, the agents chained together several weaknesses in the application and a local service to gain administrative privileges.

From an engineering perspective, the obstacles along the way are more interesting. The agents diagnosed a network packet size problem and wrote a proxy that allowed them to continue working. In another branch of the investigation, they built speech recognition using a model available on the target itself. The recording proved useless for the attack, but the episode demonstrates their ability to build a missing tool.

Assessing independence is more complicated. During the first MakeSense run, an agent read other people's walkthroughs. The creator invalidated the result, restricted outbound connections using operating system controls and repeated the experiment. There is a direct lesson here for any agent system: a prohibition in a prompt needs technical enforcement.

Even a restricted network leaves the question of training data unresolved. Both machines have already been retired from the active pool, and their solutions could have been included in the model's training data. The experiment therefore demonstrates the execution of a sequence of actions against a training target, but does not prove an ability to find a path through a previously unknown system.

What your team can take away

The most convincing part of the story is the findings that, according to the creator's report, led to accepted changes in the library. However, the account includes no comparison with a single agent, no series of identical runs and no independent assessment of all costs. The contribution of the swarm organization itself cannot yet be isolated.

A suitable pilot would cover a limited part of your own codebase, with success criteria defined in advance. Agents need reproducible checks, an action log and access only to authorized resources. The budget should include an engineer's time to investigate false positives and validate conclusions.

DreamTeam's practical value lies in its example of how to organize this work. Effectiveness should be judged by confirmed defects and accepted fixes: the number of tasks, agents and commits does not, by itself, measure audit quality.