“calculateRequiredVotes() derives the quorum threshold from state.workers.length, so a single caller could cross any strategy's threshold (raft/bft/quorum alike) by voting under fabricated identities — a Sybil attack on consensus.”
Quote · github.com
From “security: hive-mind_consensus accepts votes from unregistered/forged voterId (Sybil)”, found 2026-10-14.
Shown in tests, not by an attacker or by agents colluding. Agent votes only mean something when identity is checked. Fixed by PR #3291; a follow-up (#3338, PR #3339) closed the same gap in sibling operations in October 2026.