When AI agents coordinate through shared storage, are they leaving letters for each other, or ant-style trails anyone can follow?

This explores whether the paper's shared storage works like a mailbox, where each entry is addressed to a particular recipient, or like stigmergy, where agents leave unmarked traces in a common medium and others react to them later. The corpus leans toward unmarked traces, but only weakly. The paper links storage-mediated coordination to stigmergy, the way ants steer each other through pheromone trails rather than by talking. The note on this point says the link is incomplete: the excerpt never defines stigmergy as the paper uses it, never says which properties carry over, and never explains the defensive value beyond calling it a shared store Does storage-mediated coordination work like stigmergy?. So the paper's own framing points to traces, but it doesn't commit to that.

The corpus has no evidence for the addressed-message reading. A mailbox model would need a sender, an intended reader, and some way to check that an entry is really from who it claims. The notes describe none of that. The closest thing is the paper's evidence layer, which records "selected agent communications". That is a separate mechanism, and it is vague about scope. It doesn't say whether it sees only sanctioned traffic or also unauthorized channels, so an intact record could still mislead by omission Can a black box see communication through unauthorized channels?. This is a log kept alongside the storage, not a sign that the storage itself carries addressed messages.

This matters because unmarked traces put the security burden on the medium rather than on the message. If nothing on a stored trace says who wrote it or who should read it, a poisoned entry looks like any other. That may be why the paper's protections sit around the store: tamper-evident external anchoring layered on top of ordinary logging, so that agent actions, their order, and later edits can be reconstructed Can external anchoring detect tampering in agentic process logs?. There is also an authorization layer built from "task-bound signed tokens" and a "separately verified policy oracle". The excerpt doesn't say who issues the tokens or whether the attacks could reach them How does the authorization layer stay outside the poisoned path?. Tying this design to the trace reading is my inference, not something the paper states.

If you want to see why the distinction matters, look at what happens to shared content that no one checks. When documents pass through long chains of LLM steps, frontier models silently corrupt about 25% of the content, and spot checks miss it Do frontier LLMs silently corrupt documents in long workflows?. Weaker models delete content visibly, while stronger ones alter it in ways that look intact Does model capability change how documents degrade?. Retrieval stores face the same problem. Defenses such as RAGPart and RAGMask have to work at retrieval time, by spotting abnormal documents, because the stored text carries no trustworthy sender Can we defend RAG systems from corpus poisoning without retraining?. A trace-based store inherits that problem. The open question for the paper is whether its store stays a trace medium and adds tamper evidence around it, or whether it adds real addressing, meaning provenance and intended recipients, to each entry.