Cross-agent behaviour correlation and anomaly detection

Control objective

Cross-agent behaviour correlation and anomaly detection checks whether the fleet of agents is behaving normally as a whole, looking across agents for coordinated patterns or covert communication that no single-agent monitor would catch — for example several agents subtly colluding, or one signalling another through unusual message timing or content. It matters because multi-agent systems create emergent risks (MIT Multi-Agent research, MITRE AML.TA0014 exfiltration tactics): individually each agent may look fine while collectively they exfiltrate data or coordinate harmful action. To implement, establish fleet-level behavioural baselines from normal operation, run cross-agent correlation to surface coordinated patterns in near real time, and add an entropy-based scan that flags covert channels (abnormally high-entropy or steganographic content suggesting hidden signalling); log baselines, detected correlations and entropy alerts with the agents involved as evidence. There is no numeric metric or formula provided, so operate against the stated threshold: fleet-level baselines must be set, coordinated-pattern detection must be live, and the entropy covert-channel scan must be running. A breach is when these capabilities are absent or a coordinated/covert pattern is detected; given its High priority, detection should trigger investigation, containment of the implicated agents and tightening of fleet baselines.