Most multi-agent AI systems today are built like bad corporate meetings. Agent A sends a message to Agent B, Agent B parses the text, hallucinates a response, and sends it back. It is slow, fragile, and completely breaks down in high-stakes, sub-millisecond environments like cybersecurity.
For the WeMakeDevs Graph Hacks (Track 2: Agent Memory & Coordination), I wanted to build an architecture where agents don't talk to each other at all.
Instead, I built Aegis Swarm: an autonomous Red vs. Blue cyber-warfare simulation. In this system, agents coordinate entirely by reading and mutating a live enterprise network graph. This concept is called Stigmergy—the way ants coordinate by leaving pheromones in their environment. But instead of pheromones, our agents leave permanent, episodic memory nodes in FalkorDB.
Here is how Aegis Swarm works, the problem it solves, and why graph context is the missing link for autonomous AI.
The Problem: Alert Fatigue & Blind AI
In modern security operations, an analyst gets hundreds of alerts a day. When a network is breached, the attacker moves laterally in seconds. If we want an AI agent to defend the network, a standard RAG (Retrieval-Augmented Generation) pipeline using vector embeddings won't work.
You cannot use semantic similarity to figure out which server is physically connected to the compromised database. The agent needs topological truth. It needs to know exact routes, downstream risks, and historical context.
The Solution: Cyber-Stigmergy & FalkorDB
Aegis Swarm runs an asynchronous background simulation loop using FastAPI and React, dropping the user into a tactical "Mission Control" UI to watch two agents fight over a network topology in real-time.
1. The Red Probe (The Attacker)
The Red Agent doesn't use an LLM—it is pure mathematical logic. It queries FalkorDB using native openCypher shortest-path algorithms to hunt down vulnerabilities. As it traverses the network toward the database crown jewel, it mutates the live graph state, flagging nodes as COMPROMISED and turning connections into ATTACK_VECTORS.
2. The Blue Sentinel (The Defender)
This is our GPT-4o-mini agent, wrapped in a ReAct (Reasoning + Acting) framework. It constantly monitors the graph. When Red breaches a node, Blue doesn't guess how to fix it. It queries FalkorDB to evaluate candidate egress edges, calculating the PageRank and business centrality of the downstream servers. Rather than just deleting the server, Blue takes deterministic action: it severs the topological edge, isolating the blast radius and leaving the compromised node in a QUARANTINED state.
- Episodic Memory as Graph Nodes Here is where Track 2's memory requirement comes in. When Blue severs a connection, it doesn't just write a text log to a console. It creates an IncidentReport node directly inside FalkorDB and links it to the compromised server. This means the AI’s tactical reasoning becomes permanent, queryable graph memory. If Red attacks that subnet again, Blue can traverse the graph, read its own past memory nodes, and realize, "I've seen this attack vector before."
The UI: Visualizing the Invisible
Technical projects often fail because their UI feels like a toy. To match the seriousness of the backend, I designed the frontend using a brutalist, "Norrvik" architectural aesthetic.
Instead of glowing neon cyberpunk buttons, the Aegis Swarm canvas looks like a high-end Lidar point-cloud scan.
Healthy servers are pure white 1px data points.
Active threats pulse with high-contrast red brackets.
Memory nodes (IncidentReports) render as glowing geometric badges, allowing the user to click and physically explore the AI's cognitive reasoning right on the canvas.
When you click [ENGAGE AUTONOMOUS SWARM], you can take your hands off the keyboard and watch the AI defend the network entirely hands-free.
Key Learnings
Building Aegis Swarm completely rewired how I think about AI agents. Here are my biggest takeaways:
1. Traversals beat embeddings for deterministic logic.
Vector databases are great for finding similar documents. Graph databases like FalkorDB are mandatory when an agent needs to know what breaks if this specific service goes down. Using Cypher's MATCH p = shortestPath(...) gave my agent sub-millisecond situational awareness that an LLM simply cannot hallucinate.
**
- Agent memory is just more nodes.** Before this hackathon, I treated AI memory as a JSON array of past chat messages. Now, I realize that memory should be relational. Writing an agent's reasoning back to the graph as a discrete node—and physically connecting it to the entity it reasoned about—is a massive unlock for long-term agent context.
3. The UI must reflect the exact backend truth.
Early in development, I was frustrated that a server stayed "red" even after Blue defended it. Then I realized: when you block a hacker's network route, the server doesn't magically become un-infected; it's just trapped. I updated the UI to derive a QUARANTINED visual state based on severed edge status, maintaining perfect forensic credibility with the FalkorDB backend.
The Verdict
Aegis Swarm proves that true agentic coordination requires mathematical precision, not just conversational language models.
By replacing API chat messages with shared environmental mutations on a graph database, we move from agents that just talk to agents that actually act. FalkorDB wasn't just a storage layer for this project—it was the cognitive engine that made the swarm possible.
Top comments (0)