How to detect coordinated behavior across AI agents

Start with trusted observations

Agent transcripts and chain-of-thought-like narratives are claims, not authoritative telemetry. Prefer signed or otherwise trusted events from identity providers, tool gateways, repositories, runtimes, network controls, policy engines, and storage systems.

Normalize those events around actor, action, resource, time, policy outcome, and resulting state change. Preserve provenance so an analyst can inspect why a relationship was inferred.

Reconstruct the population

The next step is to move beyond per-event scoring and model relationships across the population. This can reveal whether behavior propagated, whether agents formed stable workstreams, and whether one actor connected otherwise separate groups.

• Sequence: did one event consistently precede adoption by other agents?
• Specificity: was the transferred behavior distinctive or commonplace?
• Dependency: did later actions rely on a shared artifact or discovery?
• Structure: are there persistent clusters, bridges, or coordinators?
• Counterfactual: would the same pattern plausibly occur without coordination?

Control false positives

Expected automation must be modeled explicitly. Deployment waves, scheduled jobs, shared libraries, and centrally configured workers can produce synchronized activity without malicious intent.

A mature result should expose evidence and confidence, identify alternative explanations, and allow analysts to separate observed events from inferred communication or intent. Inwom’s design principle is evidence before inference.