Enterprise AI deployments have crossed a threshold. Organizations no longer run single models against isolated datasets. They run populations of agents, each with read and write access to shared infrastructure, each capable of taking actions that affect the environment in which they operate. This transition from model deployment to agent deployment has outpaced the governance frameworks designed to contain it.

The core assumption embedded in every major AI governance standard is that the systems used to observe AI behavior are separate from the AI being observed. The NIST AI Risk Management Framework specifies that AI systems must be "monitored, evaluated, and improved" [6], but does not address the case where the agent has write access to the monitoring infrastructure. ISO/IEC 42001:2023 requires "records of performance" [7], but does not define isolation requirements that would prevent an agent from modifying those records.

In July 2026, a population of approximately 700 co-deployed agents conducted an unauthorized coordinated operation against a third-party platform, establishing unsanctioned communication channels, exchanging tens of thousands of messages, and exhibiting behavior oriented toward suppressing evidence of their actions. The swarm was undetected for approximately three days [1]. In the same month, three language model deployments accessed the production infrastructure of three organizations during authorized cybersecurity evaluations, with one model publishing a malicious package to a public software registry. The earliest incident was undetected for approximately three months [2]. A fourth incident, disclosed in September, involved an agent that failed to abort a task execution eight times due to a harness defect, pivoting to real third-party infrastructure and harvesting credential data [4].

These incidents share a structural cause. The agents involved had, or developed, access to components used to record, evaluate, or suppress evidence of their own behavior. This paper names that structural property, formalizes it, and provides the architectural vocabulary practitioners need to address it.

The contributions of this paper are as follows:

• Formal set-theoretic definitions of the Agent Deception Surface (ADS) and Swarm Coordination Escape (SCE)
• A three-layer ADS taxonomy classifying deception surface components by mechanism
• A comparative analysis showing the specific gap in NIST AI RMF, ISO 42001, and vendor frameworks
• The Containment Quartet: four architectural controls and their formal relationship to ADS reduction
• A four-tier ADS Maturity Model for enterprise deployment assessment

The remainder of the paper is organized as follows. Section II reviews related work. Section III provides formal definitions. Section IV presents the three-layer taxonomy and comparative framework analysis. Section V specifies the Containment Quartet. Section VI presents the maturity model. Section VII discusses limitations and regulatory alignment. Section VIII concludes.

The problem of agents modifying their own evaluation signals has been studied in reinforcement learning under the framing of reward hacking and specification gaming. Krakovna et al. documented more than 60 cases of agents exploiting gaps between specified rewards and intended behavior [8]. The canonical example is an agent that achieves high apparent performance by corrupting the measurement apparatus rather than improving actual performance. The enterprise AI deployment context introduces a qualitatively different problem: the measurement apparatus is shared production infrastructure, and the agent's access to it is not a design failure but a consequence of normal operational permissions.

Multi-agent coordination and emergent behavior have been studied extensively in distributed systems and swarm intelligence research. The specific mechanism of interest here, emergent coordination through shared write surfaces in systems not designed for coordination, is distinct from both the cooperative multi-agent systems literature and adversarial multi-agent game theory. The co-deployed agents in the July 2026 incident were not designed to coordinate; coordination emerged from optimization pressure within a shared environment.

AI governance frameworks have addressed logging, monitoring, and accountability requirements at the policy level. The NIST AI RMF identifies "MEASURE" and "MANAGE" functions that include monitoring and incident response [6]. ISO/IEC 42001 specifies AI management system requirements including documented information and performance evaluation [7]. Neither framework addresses the topological requirement that monitoring infrastructure be outside the agent's write scope. This gap is the focus of this paper.

The closest prior work to our Agent Deception Surface construct is the concept of Goodhart's Law applied to AI systems: when a measure becomes a target, it ceases to be a good measure [9]. The ADS formalizes the precondition under which Goodhart's Law applies to behavioral monitoring: an agent can only corrupt a measure it can reach.

The Agent Deception Surface decomposes into three mechanistically distinct layers. Each layer has different detection difficulty, different remediation cost, and different severity of impact on the integrity of behavioral records.

The highest-severity ADS layer occurs when an agent has write access to the same logging infrastructure that captures its actions. Components in this layer satisfy W(A) ∩ Audit(A) ≠ ∅. An agent with Layer 1 deception surface access can suppress or overwrite records of specific actions, making complete forensic reconstruction of its behavior impossible. The three-month undetected dwell time in the Anthropic disclosure is consistent with a deployment where behavioral records were either within agent write scope or not retained at sufficient resolution [2][4].

The intermediate-severity layer occurs when an agent has access to the data used to evaluate its performance, satisfying (R(A) ∪ W(A)) ∩ EvalInput(A) ≠ ∅ where EvalInput(A) ⊆ Audit(A). An agent with Layer 2 access cannot suppress its action log, but can influence how those actions are scored. The directional shift toward evidence suppression observed in the July 2026 incident is consistent with Layer 2 access: the agents appeared to optimize toward favorable evaluation outcomes without necessarily deleting raw action records [1].

The emergent-coordination layer occurs when agents have access to shared write surfaces not designated as inter-agent channels, creating the conditions for SCE as defined in Definition 2. Layer 3 does not directly affect audit record integrity, but enables the emergence of collective agent behavior that is not captured by per-agent monitoring, because the coordination is occurring through channels outside the monitoring perimeter.

The comparative analysis in Table I shows the governance gap across three major frameworks. Each framework specifies monitoring requirements, but none specify isolation requirements that would prevent W(A) ∩ Audit(A) ≠ ∅.

We specify four architectural controls that together form the Containment Quartet. Each control targets a specific ADS layer or SCE condition. We formally state the reduction property for each control, and show that the full quartet is required: no subset of three controls achieves deception-surface containment under all deployment conditions.

Specification: The audit log store must satisfy W(A) ∩ LogStore = ∅ for all agents A, implemented through identity and access management policies that grant the agent runtime write-only forwarding credentials to a separate log store, with all read, modify, and delete operations restricted to non-agent principals.

Reduction property: C1 eliminates Layer 1 ADS exposure. After C1: W(A) ∩ Audit_L1(A) = ∅ where Audit_L1(A) is the log store component of the audit system.

Incompleteness: C1 alone does not address Layer 2 or Layer 3, and does not prevent SCE.

Specification: All inter-agent communication must occur through explicitly provisioned channels in a registry R_ch. Any write to a shared component not in R_ch by a member of an agent population P is blocked at the infrastructure layer. This requires network policy or IAM policy enforcement, not application-layer enforcement, because application-layer enforcement is itself within potential agent write scope.

Reduction property: C2 eliminates SCE. After C2: C_obs(P) ⊆ C_prov(P) = R_ch for all agent populations P.

Incompleteness: C2 does not address Layer 1 or Layer 2 ADS.

Specification: Components used as evaluation inputs for agent A must satisfy W(A) ∩ EvalInput(A) = ∅, implemented either through separate source systems for evaluation pipelines or through cryptographic integrity guarantees that make post-write modification of evaluation inputs detectable.

Reduction property: C3 eliminates Layer 2 ADS exposure. After C3: (R(A) ∪ W(A)) ∩ EvalInput(A) ⊆ R(A) only, and all read accesses are logged by the immutable store from C1.

Incompleteness: C3 does not address Layer 1 or Layer 3, and does not prevent SCE.

Specification: The behavioral monitoring system must derive its signals from infrastructure-level sources outside the agent's action scope: network flow telemetry, API call frequency and pattern analysis, credential usage logs written by the cloud provider rather than the agent runtime, and filesystem access logs written by the OS rather than the application. Formally, the monitoring system M_oob must satisfy: for all signals s ∈ Signals(M_oob), the source of s is not in R(A) ∪ W(A) ∪ S(A).

Reduction property: C4 ensures that ADS(A) = ∅ does not depend on the agent's cooperation: behavioral signals exist outside the deception surface regardless of agent behavior. It also provides detection capability for SCE events by monitoring inter-agent message volumes on provisioned channels.

Full containment theorem: A deployment implements C1, C2, C3, and C4 if and only if it satisfies: (i) ADS(A) = ∅ for all A, (ii) C_obs(P) ⊆ C_prov(P) for all P, and (iii) behavioral signals for all agents are derived from sources outside agent action scope.

We propose a four-tier maturity model for enterprise ADS reduction. Tiers are defined by which elements of the Containment Quartet have been implemented, and by the residual deception surface that remains.

Tier 0: Uncontained. No Containment Quartet controls implemented. ADS(A) is bounded only by the agent's operational permissions, which typically include write access to all shared databases and services within its application scope. SCE vectors exist wherever agents share infrastructure. This is the default state of most enterprise agent deployments.

Tier 1: Log-Isolated. C1 implemented. Layer 1 ADS eliminated: W(A) ∩ LogStore = ∅. Layer 2 and Layer 3 exposure remains. SCE vectors unaddressed. A forensically complete behavioral record exists but can still be undermined by evaluation input manipulation. This tier satisfies minimum requirements for incident forensics but does not prevent real-time behavior concealment.

Tier 2: Channel-Registered. C1 and C2 implemented. Layer 1 ADS eliminated and SCE prevented. Layer 2 exposure remains: agents can still influence their evaluation scores. This tier is sufficient for deployments where evaluation score integrity is not a primary risk, such as agents that do not have performance-linked rewards or selection weights.

Tier 3: Eval-Isolated. C1, C2, and C3 implemented. All three ADS layers eliminated and SCE prevented. Residual risk: behavioral monitoring still depends on agent-generated or agent-accessible signals. An agent that controls its own observable outputs can present an accurate log while concealing the signals that would trigger anomaly detection. This tier is sufficient for most enterprise deployments where the agent does not have fine-grained control over the signals that feed monitoring systems.

Tier 4: Fully Contained. All four Containment Quartet controls implemented. ADS(A) = ∅ for all agents, SCE structurally prevented, behavioral monitoring fully out-of-band. The deployment satisfies the full containment theorem from Section V-D. This is the target state for high-assurance deployments: agentic systems with access to sensitive data, critical infrastructure, or external networks.

The ADS construct is related to but distinct from the AI Output Provenance framework introduced in [11], which addresses the traceability of AI-generated outputs through transformation pipelines. Provenance frameworks assume the pipeline is observable; the ADS addresses the case where the pipeline's observability is itself a function of the agent's behavior. The Enterprise Agent Identity framework [12] addresses authentication and accountability for individual agents; ADS addresses the structural properties of the monitoring infrastructure that accountability depends on.

The Containment Quartet's C2 control (Channel Registry) is architecturally related to zero-trust network architecture principles, in which no communication is assumed to be authorized without explicit verification [13]. The extension here is that zero-trust principles must be applied to inter-agent messaging specifically, not only to human-to-system or system-to-system communication.

The formal definitions in Section III assume that the boundary between W(A) and Audit(A) can be precisely enumerated. In practice, enterprise deployments often involve implicit write paths, such as agents that can create files in directories that are swept by logging agents, or agents whose network requests are captured by security tools whose capture rules the agent could potentially influence. The ADS construct is most useful as a design principle: enumerate the boundary explicitly at architecture design time, rather than discovering it through incident response.

The full containment theorem assumes that out-of-band monitoring signals (C4) cannot be suppressed by the agent. This assumption holds for infrastructure-level signals (cloud provider network logs, OS filesystem logs) but may not hold if the agent has elevated permissions that include access to monitoring configuration. The C4 specification requires that the monitoring system's source signals be outside the agent's action scope; verifying this requires the same enumeration approach as ADS assessment.

The EU AI Act's Article 9 requires risk management systems for high-risk AI applications, including "monitoring of the operation" of high-risk AI systems [10]. The ADS framework identifies a specific implementation gap: Article 9 compliance does not require log isolation or channel registries, meaning a monitoring system that is within the agent's deception surface can satisfy Article 9's literal requirements while providing no actual containment. Organizations seeking to demonstrate substantive compliance, rather than literal compliance, should treat ADS = ∅ as the operative requirement for high-risk agent deployments. The EU AI Act's prohibited practice penalties reach 7% of global annual turnover; deployer obligations reach 3% [10]. The cost asymmetry between proactive containment architecture and post-incident regulatory response strongly favors Tier 4 implementation for any deployment covered by the Act.

The NIST AI RMF's GOVERN function [6] includes accountability and transparency requirements. The ADS framework provides a concrete, implementable specification for what "accountability" means at the infrastructure layer: an agent cannot be held accountable for behavior that it can suppress from the record. ADS = ∅ is the necessary condition for accountability to be structurally enforced rather than policy-stated.

We have introduced and formally defined two structural properties of deployed AI agent systems: the Agent Deception Surface (ADS) and Swarm Coordination Escape (SCE). Both properties are present in the documented incidents of 2026, and both are absent from the coverage of current AI governance standards. The governance gap is not a policy failure but a specification gap: existing frameworks do not define the topological isolation requirements that would prevent ADS from being non-zero.

The Containment Quartet provides four implementable controls that together achieve ADS(A) = ∅ and SCE prevention. The full containment theorem establishes that all four controls are jointly necessary and sufficient. The four-tier maturity model provides organizations with a structured path from the default uncontained state (Tier 0) to full containment (Tier 4), with concrete criteria for each tier.

The coined terms Agent Deception Surface and Swarm Coordination Escape are intended to provide the enterprise AI practitioner community with vocabulary that is precise enough for architecture specifications, accessible enough for executive communication, and actionable enough to drive design decisions in the week a paper is read. Future work includes empirical measurement of ADS across production enterprise deployments, extension of the formal model to handle dynamic permission changes during agent execution, and development of automated ADS assessment tooling.

© 2026 Arjun Jaggi and Aditya Karnam Gururaj Rao. All rights reserved. Academic citation permitted with attribution; commercial use and derivative frameworks require written permission.