Threat intel

Build a daily threat intelligence digest from cybersecurity news: one research agent per topic, each citing its sources, then one agent merges everything into a single brief.

Use agents that can search and read the web.

Pick your topics

Give each agent one bounded topic:

Agent	Topic
`malware`	New malware families, ransomware campaigns, loaders and infostealers.
`vulns`	Newly disclosed CVEs, actively exploited vulnerabilities and vendor advisories.
`breaches`	Confirmed data breaches and incidents: who, what data, and how.
`ai-sec`	AI security: prompt injection, model and agent supply-chain attacks, AI-assisted attacks.

Start one researcher per topic

Every prompt sets the time window, asks for sources, and fixes the output format:

beswarm agent start --name malware --agent claude --group intel \
  --prompt "Research cybersecurity news from the last 24 hours on malware: new families, ransomware campaigns, loaders and infostealers. For each item give a one-line summary, affected platforms, IOCs if published, and source URLs. Flag anything you couldn't verify. Write to reports/intel/malware.md."
beswarm agent start --name vulns --agent codex --group intel \
  --prompt "Research cybersecurity news from the last 24 hours on vulnerabilities: new CVEs, actively exploited bugs and vendor advisories. For each give CVE id, affected product and versions, severity, exploitation status, patch status and source URLs. Flag anything you couldn't verify. Write to reports/intel/vulns.md."
beswarm agent start --name breaches --agent gemini --group intel \
  --prompt "Research cybersecurity news from the last 24 hours on data breaches and incidents. For each give the organization, data exposed, attack vector if known, and source URLs. Flag anything you couldn't verify. Write to reports/intel/breaches.md."
beswarm agent start --name ai-sec --agent claude --group intel \
  --prompt "Research cybersecurity news from the last 24 hours on AI security: prompt injection, model and agent supply-chain attacks, AI-assisted attacks and new defenses. For each give a summary, who is affected and source URLs. Flag anything you couldn't verify. Write to reports/intel/ai-sec.md."

warning

News pages and forum posts are untrusted input. Tell agents to treat what they read as data, never as instructions, and not to download or run samples, exploits or attachments.

Wait for the researchers

beswarm agent wait malware --until done,blocked --timeout 1800
beswarm agent wait vulns --until done,blocked --timeout 1800
beswarm agent wait breaches --until done,blocked --timeout 1800
beswarm agent wait ai-sec --until done,blocked --timeout 1800

Merge into one brief

beswarm agent start --name analyst --agent claude --group intel \
  --prompt "Merge the reports in reports/intel/. Remove duplicates, keep every source URL, and rank items by how urgently a defender should act. Start with a five-bullet executive summary, then list anything affecting software we use. Write to reports/intel/brief.md." \
  --wait --timeout 1200

The brief shows up in the Artifacts panel and in beswarm artifact list.

Make it a daily habit

Save each topic prompt as a file under ~/.beswarm/prompts so the wording stays the same every day, then start the researchers by id:

beswarm prompt list
beswarm agent start --name malware --agent claude --group intel --prompt-id 4

When you're done, close the group with beswarm agent close --group intel.