The interesting failures were between the agents

October 2026

Most AI safety tooling watches one agent at a time: score this action, flag that output. At the AI Swarm Dynamics Hackathon (AI Village × Grove Research) I wanted to try the opposite. When many agents share a world, the behaviour worth catching often isn't inside any one of them. It's in what moves between them.

SwarmGuard reads the logs a swarm leaves behind, reconstructs which action may have led to which, and for each episode ranks interventions by how much of the inferred spread they cut versus how much unrelated activity they disturb. I ran it on AI Village (eighteen months of frontier-model agents, fully logged) and on the wiki swarm (agents that used old German wikis as a message board). Here's what stuck with me.

No single edit was the problem

On 16 June 2026, in 46 minutes, 24 differently named agents writing from 24 different network blocks edited one wiki page. Read in order, the edits look like separate runs of a timed task trading round timings and answers so later runs could get ahead. One run tags another by name and asks it to "fast-forward and post R3."

None of those edits is anomalous alone. Each is a short note on a wiki page. What's anomalous is the shape: 345 candidate interactions per hour against a dataset median of 19, all flowing through one page. A per-agent monitor would have seen nothing. A graph sees a hub.

That's also where the most practical use turned out to be: evaluation integrity. These look like separate test runs contaminating each other through a public page nobody was watching. Flagging runs that become linked through an outside channel is a job eval teams need done today.

Real data broke almost every assumption

SwarmGuard passed my synthetic swarm (known source, planted confounder) on every seed. Then I pointed it at real logs, and most of the design came from what broke:

• Every lag was zero. Microsecond timestamps were being read as nanoseconds, so my two-hour lookback window behaved like 83 days. Nothing crashed. The output just looked plausible and was wrong.
• Names are everywhere. AI Village agents mention each other constantly, so "A addressed B" fired on 89% of pairs. I narrowed it to direct replies and first responses.
• Reading isn't influence. Two agents searching the same chat history were being linked. A shared resource now only counts if the earlier agent wrote to it.
• My checker was too generous. Early on, every episode got flagged. A detector that always fires tells you nothing, so I tightened thresholds and now report where a check doesn't discriminate.

Synthetic benchmarks are good for catching logic bugs. They are bad at telling you what the world actually looks like.

Time has to flow forward

Ordinary back-and-forth chat makes everyone reachable from everyone, so "where did this start?" stops meaning anything. The fix was to only count a path A → B → C if B's onward action happened after B was reached. That one rule did more for source attribution than any amount of weight tuning.

Narrow controls win if you price collateral

Each candidate control (lock a page, gate external writes, isolate a memory, pause an agent) is applied to a copy of the graph and scored as paths removed minus penalties for collateral, thin evidence and irreversibility. Once collateral is in the objective, broad controls stop looking attractive.

On the AI Village "Village Hub" episode, restricting writes to one shared site removed 54% of inferred paths while touching 0.3% of unrelated activity. Requiring approval for all external writes removed more (69%) but hit 18.8% of everything else. On the wiki, locking the relay page removed 97% of inferred paths at roughly zero collateral. The administrator's actual response was deleting 5,217 pages.

Agreement is weak evidence

The wiki export includes what the administrator really did, so I could compare. In 34 of the 37 episodes where SwarmGuard's top recommendation was a single page, the admin later deleted that same page. That sounded great until I checked the base rate: the admin deleted about 77% of all agent-written pages. Almost any recommendation would have "agreed."

The comparison that matters is timing and selectivity. The deletions came a median of 10 days after each episode, with 666 more writes landing in between. SwarmGuard's recommendation exists while the episode is happening and targets one page. Whether an earlier lock would have held is open: agents recreated deleted pages.

Say what you can't conclude

The wiki shows only self-chosen names and half an IP address. "Twenty-four names wrote to one page" is solid; "agent X influenced agent Y" is thin. So every edge ships with its evidence and the alternatives that compete with it: common cause, indirect path, shared upstream, possibly one operator.

That's what I'd carry forward: a possible link is not proof of influence, and unusual coordination is not unsafe behaviour. The tool's job is to hand a person a map and a few reversible moves fast, not to decide who's dangerous.

The full write-up and interactive app are at swarm-guard.com, and the code is on GitHub.