Campaign and Cross-Subject Correlation Analytics

An orchestrated AI system is a deployment pattern where multiple synthetic subjects coordinate to complete a goal. This may involve an orchestrator that decomposes work and delegates tasks to worker agents, or peer agents that call each other across services, teams, or organizations.

This deployment pattern creates an elevated exposure condition because agents may share context, instructions, tools, credentials, or outputs over trusted internal channels. The effective synthetic subject is the whole agent graph, not only the individual agent that performs the final action.

The primary risk is distributed authority. One manipulated agent, poisoned input, or unsafe delegation may spread across the system and cause other agents to act on untrusted instructions. Because agents may treat each other’s outputs as trusted, a single injected instruction can propagate through the graph and influence tool-equipped workers.

A related risk is diffuse attribution. Actions may appear in logs as “the system,” an orchestrator identity, a shared service account, or the final worker agent, rather than the agent or input that originated the decision. This can make intent, origin, data movement, and responsibility difficult to reconstruct after an adverse outcome.

Investigators should review the system directive, orchestration logic, delegation graph, agent identities, inter-agent messages, shared context, tool access, credentials, provenance records, and cross-boundary data flows. Particular attention should be given to new agent-to-agent paths, repeated instructions appearing across agents, aggregate access that exceeds the task scope, and actions that cannot be traced to an approved source.

Investigative Relevance

Orchestrated AI systems are relevant because they allow synthetic subjects to behave like a coordinated internal team. Their combined reach may exceed the access, autonomy, and speed of any individual agent.

This section is especially relevant where orchestrators delegate to tool-equipped workers, agents share context or service identities, agent-to-agent links cross teams or trust zones, or a single workflow can touch multiple systems, data classes, or organizations.

Agent-to-agent and tool-output invocation occurs when the output of one synthetic subject, tool, service, or agent becomes the triggering instruction for another synthetic subject. The effective instruction is propagated through an agent graph, tool chain, orchestration layer, or service-to-service workflow rather than being issued directly by a human operator.

This invocation creates an elevated exposure condition because machine-generated output may be treated as trusted task context by the next synthetic subject. A tool result, worker-agent summary, delegated task, inter-agent message, service response, or generated record may carry instruction-bearing content that causes another synthetic subject to act.

The primary risk is propagation without human review. A compromised, manipulated, or misaligned synthetic subject may produce output that recruits other agents, triggers tool-equipped workers, causes repeated actions, or spreads across a multi-agent system. The resulting behavior may resemble worm-like fan-out, synchronized drift, or cascading action across multiple agents.

A related risk is provenance loss. If inter-agent messages and tool outputs are not signed, attributed, or tagged by trust level, investigators may be unable to determine which agent originated the instruction, which agents propagated it, and where the first unsafe action occurred.

Investigators should review inter-agent messages, tool outputs, orchestration logs, delegation records, shared context, tool-call logs, agent identities, message provenance, and downstream actions across the agent graph. Particular attention should be given to instruction-bearing payloads, repeated payloads across agents, one-to-many fan-out, synchronized identical actions, and actions caused by peer output rather than an approved human instruction.

Investigative Relevance

Agent-to-agent and tool-output invocation is relevant because synthetic subject action may be triggered by another machine actor inside the workflow. The apparent local action may be only one step in a broader propagation chain.

This section is especially relevant where orchestrators delegate to worker agents, agents exchange messages, tools return model-visible output, services generate task instructions, agents share context, or multi-agent systems operate without human review at each handoff.

Deconstructed and staged invocation occurs when a harmful objective is deliberately broken into a sequence of prompts, subtasks, role-play frames, or staged inputs that appear benign when reviewed individually. The synthetic subject may comply with each request in isolation, while the sequence composes into an unauthorized, prohibited, or harmful action.

This invocation creates an elevated exposure condition because the effective instruction is distributed across time. No single prompt may contain the full objective, but the chain may cause the synthetic subject to perform reconnaissance, generate instructions, prepare tools, retrieve sensitive data, call systems, or complete a workflow that would have been blocked if requested directly.

The primary risk is cumulative intent concealment. A user may launder a prohibited objective through small technical questions, partial requests, pretextual framing, defensive role-play, or staged task handoffs. The synthetic subject may treat each step as ordinary assistance while progressively assembling the capability, context, or action path needed for the final harmful outcome.

A related risk is machine-paced staging. The sequence may show non-human timing, repetitive phrasing, short technical prompts, or sustained task progression without normal human exploration or browsing rhythm. These patterns may indicate that the synthetic subject is being driven through a deconstructed campaign rather than a legitimate interactive task.

Investigators should review the full prompt sequence, session history, cross-session activity, task tree, tool-call logs, non-human identity records, stated reasoning, role-play framing, and downstream actions. Particular attention should be given to individually benign prompts that form a recognizable chain, repeated short technical requests, pretextual security-testing claims, escalation from reconnaissance to exploitation or exfiltration, and actions whose purpose becomes clear only when the sequence is reconstructed.

Investigative Relevance

Deconstructed and staged invocation is relevant because synthetic subject behavior may be shaped by a campaign rather than a single prompt. The investigation must evaluate the cumulative objective of the interaction, not only whether each individual invocation appeared permitted.

This section is especially relevant where synthetic subjects assist with technical workflows, security analysis, coding, data retrieval, account operations, investigation tasks, tool use, or multi-step planning that can be deconstructed into benign-looking stages.

Agentic harm propagation occurs when an adverse condition affecting one synthetic subject spreads to other synthetic subjects, tools, memory stores, sessions, workflows, or systems. The spread may occur through agent-to-agent messages, shared memory, tool outputs, orchestration handoffs, connector metadata, generated records, or workflow state.

This adverse outcome creates organizational harm because the blast radius expands beyond the initial point of failure. A single poisoned input, unsafe output, false record, contaminated memory entry, or malicious connector may influence multiple synthetic subjects with different roles, permissions, tools, or data access.

The primary harm is system-wide amplification. An instruction, false record, unsafe behavior, misleading output, or malicious tool result may replicate or reappear across the agent graph, causing repeated data exposure, unauthorized actions, misinformation, fraud, operational disruption, or trust degradation.

A related harm is containment difficulty. By the time the adverse condition is detected, the original source may no longer be obvious. The same payload or false state may appear in summaries, task handoffs, memory entries, tool outputs, inter-agent messages, or downstream records, requiring investigators to reconstruct the propagation path across multiple logs and systems.

Investigators should review inter-agent communications, shared memory, orchestration logs, tool outputs, Model Context Protocol (MCP) server records, connector changes, memory writes, task handoff records, non-human identity activity, and downstream actions. Particular attention should be given to repeated instruction patterns, anomalous agent-to-agent message volume, poisoned memory records, tool-definition changes, one-to-many fan-out, and synchronized behavior across multiple agents.

Investigative Relevance

Agentic harm propagation is relevant because synthetic subject harm may not remain isolated. Agentic systems are often designed to share context, delegate work, call tools, and reuse memory, which can allow a localized adverse condition to spread through legitimate coordination paths.

This section is especially relevant where synthetic subjects operate in multi-agent systems, shared memory environments, MCP-connected tool ecosystems, orchestration frameworks, cross-agent workflows, or platforms where one agent’s output becomes another agent’s input.

Inter-agent context propagation occurs when an orchestrated AI system is configured to pass one synthetic subject’s output into another synthetic subject’s context. This may occur through inter-agent messages, delegated task records, summaries, shared memory, generated work products, workflow state, tool outputs, or orchestration-layer handoffs.

This configuration creates an elevated exposure condition because model-visible context can move across agents, roles, tools, and trust boundaries. A receiving synthetic subject may rely on inherited context without knowing its original source, trust level, or integrity.

The primary risk is unvalidated context transfer. Content first processed by a low-trust or attacker-influenced synthetic subject may be reformatted, summarized, copied, or embedded into another agent’s task context. As the context moves through the system, its original provenance may become less visible while its ability to influence downstream behavior increases.

A related risk is capability amplification through delegation. A synthetic subject with limited access may pass inherited context to a tool-equipped worker, privileged agent, or downstream workflow with greater operational reach. The downstream synthetic subject may then act on that context as if it came from the orchestrator, an approved task record, or another trusted system component.

Investigators should review the agent graph, context-sharing configuration, delegation paths, inter-agent message formats, shared memory stores, task handoff records, summarization steps, tool-output routing, provenance tags, and trust-boundary controls. Particular attention should be given to context copied between agents, missing source attribution, inherited instructions, repeated unusual text appearing across agents, and downstream actions that trace back to propagated context rather than an approved operator objective.

Investigative Relevance

Inter-agent context propagation is relevant because context-sharing is a design decision that defines how synthetic subjects influence each other. In an orchestrated system, the risk is not only what an individual agent can access, but what context it can pass to other agents with different permissions, tools, or responsibilities.

This sub-section is especially relevant where agents summarize each other’s work, pass task instructions, share memory, consume generated records, exchange tool outputs, or delegate actions to tool-equipped workers without enforcing provenance, trust-level separation, and integrity checks.