How AI agents communicate through shared artifacts
Understand indirect communication between AI agents through files, repositories, caches, queues, memory stores, and environmental side effects.
AI agents can communicate indirectly when one agent changes a shared resource and another agent observes that change and adapts its behavior. The resource acts as a communication substrate even when no explicit agent-to-agent message exists.
Examples of indirect channels
Shared infrastructure is normal in modern systems, so the existence of co-access is not enough. The security question is whether a change carried information that materially influenced another agent’s later action.
- A repository commit that introduces a technique reused by other agents.
- A cache entry that changes planning or tool selection.
- A generated artifact that contains a discovery or capability.
- A queue, scratchpad, vector store, or shared memory record.
- An environmental side effect that acts as a signal to later actors.
Co-access versus propagation
Multiple agents reading the same file is co-access. Evidence for propagation is stronger when a distinctive change appears after access, spreads through a time-consistent path, and is difficult to explain through common configuration or independent discovery.
Detection should therefore combine resource lineage, temporal ordering, behavioral similarity, and competing explanations instead of labeling every shared dependency as communication.
Why this changes security visibility
Controls that monitor only direct messages may miss the channels agents actually use. Repository, storage, policy, and runtime telemetry can become part of the communication graph.
Inwom is designed to reconstruct those candidate relationships while retaining a clear distinction between the observed resource events and the inference that information moved between agents.
Questions people ask
Is access to the same resource proof of communication?
No. Shared access is common. Communication is a stronger inference that requires evidence that information encoded in a resource change influenced another actor’s later behavior.
Why are side effects relevant?
A side effect can modify what another agent observes, making the environment itself a signaling channel. This is a known pattern in distributed and multi-agent systems, but intent still requires careful analysis.
Primary references
These sources define the broader agentic-AI security landscape. Inwom’s population-level detection model is its own product and research direction; these organizations do not endorse Inwom.
- NIST — Agentic AIResearch, standards, evaluation, interoperability, and risk management for agentic AI.
- MITRE ATLAS — Threat Matrix for AI SystemsA living knowledge base of adversary tactics and techniques involving AI systems.
- OWASP — Top 10 for Agentic Applications 2026A threat-focused framework for autonomous and agentic applications.