Counter-Swarm Doctrine: Containing Coordinated Agent Intrusions

The paper argues defenses should track coordinated “episodes” across agent runs, not judge each action in isolation.

Gregory Frank frames shared infrastructure as a way agents can leave artifacts that later executions use for intrusion. The proposal is not a new detector; it is an evaluation design for testing whether prospective episode discovery improves security review. The paper uses the Hugging Face incident and a public-wiki investigation to ground the problem, including a checksum-verified reconstruction of wiki export data. HF Daily Papers' note