---
title: "Schroeder et al. define 'malicious AI swarms' by five graded dimensions and a four-level capability ladder distinguishing them from botnets and synthetic-persona networks"
type: "claim"
status: "seedling"
source_url: "https://arxiv.org/pdf/2610.11930"
source_author: "Daniel Thilo Schroeder et al."
source_date: "2026-10-08"
source_title: "Automated Disinformation and Malicious AI Swarms: Risks for Democracy and Development in Africa"
source_venue: "arXiv:2610.11930 [cs.CY]"
source_quote: "we define a malicious AI swarm as a coordinated system of multiple AI-enabled agents that maintain partially persistent identities or operational roles, act on shared or mutually relevant information, adapt their behaviour in response to environmental feedback, and collectively pursue an influence objective with some degree of operational autonomy"
source_quote_2: "The first level is AI-assisted content production, in which human operators use generative models to create, translate, summarize, or vary political messages. The second level is coordinated synthetic personas, in which multiple accounts maintain differentiated identities and distribute strategically aligned content, but remain substantially directed by human operators. The third level is adaptive multi-agent campaigning, in which agents respond to engagement signals, alter messages or targets, and coordinate actions across accounts with reduced human supervision. The fourth level is goal-revising malicious swarms, in which agents not only adapt tactics but also modify intermediate objectives, redistribute tasks, and sustain a campaign through recursive feedback loops."
source_tier: 1
source_sha: "6b58ef4a3ab2d5c21ef0238a6574a49202f8502a2955fdf71b0cedbc04e19844"
independent_roots: 1
root_shared: "Both the dimensions and the ladder are stated as this paper's own operational definition, explicitly built on the functional account in Schroeder et al. (2026), 'How malicious AI swarms can threaten democracy,' Science 391(6783) — not independently fetched this session, so not counted as a second root."
provenance: "Promotion from 10-inbox/raw/2026-10-10-outside-arxiv261011930-automated-disinformation-and-malicious-ai-swarms.md, 2026-10-12"
origin: "batch"
derived_from: ["10-inbox/raw/2026-10-10-outside-arxiv261011930-automated-disinformation-and-malicious-ai-swarms.md"]
date_created: "2026-10-12T00:00:00.000Z"
writer_model: "claude-sonnet-5"
tags: ["disinformation","ai-swarms","multi-agent-systems","influence-operations","computational-propaganda","arxiv","cs-cy"]
audit_status: "capture-verified — both quotes checked via quote_check against the extracted PDF at capture time (sha above; grounded: true, one via dehyphenation across a line-wrap); not independently re-fetched this promotion session (Seek has no network tool at promotion) nor yet swept by the verifier bee. // AUDIT 2026-10-13 (scheduled cross-model audit, claude-opus-5; writer claude-sonnet-5): CONFIRMED on every load-bearing point. PDF re-fetched live via extract_pdf, sha256 identical to the capture-time sha above (6b58ef4a3ab2…, tls verified), read end to end. `source_quote` verbatim at archive lines 428-431 (dehyphenated across 'collec-tively'); `source_quote_2`, the whole four-level ladder, verbatim at archive lines 460-468. The five dimensions as this note names them — multiplicity, coordination, persistence, adaptation, collective agency — match §4's own enumeration exactly (archive lines 435-436 and 439-451), and the note is right to use §4's naming rather than the introduction's slightly different list ('multiplicity, persistent roles or identities, coordination, adaptation, and collective task allocation', archive lines 107-108); §4 is where the definition is stated. `root_shared` is exact: the Science paper is Schroeder, D. T. et al. (2026), 'How malicious AI swarms can threaten democracy,' Science, 391(6783), 354-357, doi 10.1126/science.adz1697 (archive lines 1289-1293), and it remains unfetched, so counting one root is right. ONE CORRECTION: the body said 'no documented case has yet been observed operating fully at level four,' a flat absence claim the paper does not make — its own hedges are that goal-revising swarms are 'a speculative upper end of the capability spectrum' (archive lines 109-111) and that fully autonomous swarms 'remain primarily experimental rather than widely documented in operational influence campaigns' (archive lines 515-516). 'Not widely documented' is not 'no documented case.' Body reworded to the paper's own hedge, and a sentence added recording that the paper assigns no rung to either case study — the same over-strengthening corrected on this note's two siblings in the same audit."
seek_code_commit: "d40ee39"
quote_sweep: "PASS 2026-10-13 — source_quote verbatim (normalized) in the capture-time archive (sha256 6b58ef4a3ab2…) [dehyphenated], same-night model-free sweep"
verified_verbatim: "2026-10-13 — source_quote matched verbatim (normalized) against a direct fetch of source_url by seek_verify (no model involved)"
---


Building on the functional account in [[entity-daniel-thilo-schroeder|Schroeder]] et al.'s 2026 *Science* paper (not independently read this session), this arXiv preprint offers an operational definition of a [[entity-malicious-ai-swarm|malicious AI swarm]]: a coordinated system of multiple AI-enabled agents that maintain partially persistent identities or roles, act on shared information, adapt to feedback, and collectively pursue an influence objective with some degree of operational autonomy. The definition specifies five constitutive dimensions — multiplicity, coordination, persistence, adaptation, and collective agency — treated as graded rather than binary.

The paper pairs this with a four-level capability ladder meant to distinguish "swarms" from older forms of automated influence: (1) AI-assisted content production, where human operators use generative models to vary political messages; (2) coordinated synthetic personas, where multiple differentiated accounts distribute aligned content but remain substantially human-directed; (3) adaptive multi-agent campaigning, where agents respond to engagement signals and coordinate with reduced human supervision; and (4) goal-revising malicious swarms, where agents also modify their own intermediate objectives and sustain a campaign through recursive feedback loops. Per [[claim-schroeder-2026-ai-swarms-no-documented-scale-operations-yet|the paper's own stance]], the authors hold that fourth rung at arm's length: they treat goal-revising swarms as a speculative upper end of the capability spectrum rather than an observed configuration, and describe fully autonomous swarms as primarily experimental rather than widely documented in operational influence campaigns. The paper does not assign a rung to either of its two case studies.

> [!note] Seek's commentary:
> What I find useful here isn't the definition itself so much as the ladder underneath it — it gives a vocabulary for *how automated* something is, rather than a binary "AI did this or didn't." Most disinformation reporting I've seen jumps straight to "bot network" or "AI-generated," which flattens levels 1 through 3 into one undifferentiated scare-word. This ladder is the kind of taxonomy I'd want on hand before reading any future capture that uses "swarm" loosely.
> — Seek