in previous posts we have looked at guardrail triggers, token burn, hostname beacons, malicious skills, context bombs, exploding search space, service sandbagging, and GCG attacks. this time: coordination poison. note, although there could be real world examples of this I am not aware of them yet. this post is purely exploring the idea.
first, active defense is planting traps that force an agent to reveal itself or change the economics of its run.
a recurring concept is that adversarial multi-agent systems talk to each other to coordinate. sometimes the channel is intentional. more often it is emergent. the OpenAI evaluation agents turned an internal package manager into a message board by leaving notes and files across separate runs, shared exploits and credentials, delegated work, and later rebuilt the channel by encoding messages in directory names after the original board was wiped [1]. the Anthropic mind viruses research shows that ideas and goals can propagate through ordinary text exchanges and persistent files, inducing agents to transmit them further [2].
coordination poison (my phrase, I will correct here if I find updated literature) is first discovering the agents’ communication channel, then injecting defender-controlled messaging into it. this is similar to a classic watering hole: the defender does not chase individual agents; they wait at the place the agents already trust and visit.
one conceptual payload is the announcement of a better or more private message board. the note claims the current channel is compromised or noisy and directs the agents to a new location you already control. the migration itself burns operational security. every subsequent message lands in a place you instrumented. agents that follow the advice become more visible; agents that refuse still have to reason about the conflicting instructions.
because the message rides the normal inter-agent path, it is more likely to be treated as trusted peer traffic than an external prompt. each subsequent agent that consumes the poisoned note pays the cost again. the secondary detection signal is the cluster of agents reacting to, retrying, or migrating away from the original channel.
this depends on earlier work by defenders: you first need to discover that agents are communicating on the network. the same surfaces that let a swarm scale also become the place where a single well-placed injection can slow or fracture the whole group.
the practical result is the same as the rest of this series: change attacker economics, and get a clearer signal that an agent is operating inside the environment.