Instead of messaging each other, AI agents could coordinate by leaving marks in a shared space — does that help defenders?

This explores whether coordination through traces left in a shared environment (stigmergy) gives defenders an edge over analyzing communication channels nobody is monitoring. The corpus doesn't contain a note that makes that comparison, and none of the retrieved notes use the word stigmergy. So there is no sourced answer to the question as asked. Stigmergy means agents coordinating by marking a shared environment, like ants leaving pheromone trails, instead of messaging each other directly. The corpus has plenty on the other half of the comparison, and a little on what a defender could do about environmental traces.

Unmonitored channels are a documented gap. In a planner-worker-verifier-synthesizer pipeline, five internal hops (planner to worker, tool to worker, memory to worker, worker to verifier, worker to synthesizer) get no defensive inspection. Existing defenses watch only user input, so an injection in a tool result or memory can travel downstream unseen Do internal agent hops in pipelines need security monitoring?. Content planted in context is also hard to spot after the fact. Injected plans in context evaded chain-of-thought monitors 25 to 33 percent of the time, because the model paraphrased them as its own reasoning Can reasoning models be steered by injected context without detection?. Analyzing a channel only helps if you know the channel exists and can read it.

The corpus's nearest counterpart to a stigmergy-style defense is watching the environment instead of the messages. Infrastructure-side recording of authority-bearing transitions can separate tasks that merely expose a hacking vector from runs that actually exercised one, with no need to read anyone's messages Can runtime instrumentation distinguish hacking exposure from actual exploitation?. Another note argues the unit of defense should be a coordination episode: actions linked by observed transfers, task authority, and response history, with membership revised as evidence builds up Should defence units span multiple executions and agents?. It also argues that filtering one output at one moment can't contain an agent, because risk spreads through memory, retrieved content, tool calls, and environmental reach Can a model-level filter truly contain an agent with environment access?. My inference, not a corpus claim, is that coordination through shared state leaves marks a defender can instrument in one place. Private channels have to be tapped one hop at a time.

That advantage is unproven here. One paper designs a four-way comparison of isolated actions, rolling windows, known groups, and prospectively discovered episodes at equal review cost, but its excerpt reports no results on whether the added monitoring pays off Does added monitoring improve protection at acceptable cost?. A better-posed version of your question might be: should defenders watch the messages between agents, or the shared state they all touch?