VAST Challengebookmark_border

When corporate communication is delegated to autonomous agents, failures are rarely a single decision but a trajectory of small deviations that compound until a policy is broken. We present AgentAudit, a visual analytics system that reconstructs such escalation from agents' public posts, private deliberations, and internal reasoning, coupling topic evolution, event extraction, per-agent channel usage, and think-say dissonance, how far a public message departs from the agent's internal state. On the VAST Challenge 2026 data, AgentAudit traces the embargo breach to a gradual migration of coordination into private and anonymous channels, foreshadowed by dissonance from the earliest rounds and by an earlier episode that was monitored but never corrected.

We present AAVA, a web-based visual analytics tool combining a 3D activity overview, a 2D incident view, and intervention-rule evaluation. AAVA reconstructs a 192-step relay across 18 agents, uncovers two earlier incidents with the same fingerprint, and identifies one publication gate that blocks all three without affecting 105 normal posts.

Investigating organisational communication incidents requires analysts to connect evidence that is distributed across actors, topics, channels, and time. We present AmpliFY, an interactive visual analytics platform developed for VAST Challenge 2026 Mini-Challenge 1. AmpliFY follows a 9–3–1 framework: nine coordinated visualisations are organised into three complementary perspectives—Network Analysis, Keyword Analysis, and Swimlane Analysis—and linked to source records to construct a single evidence-backed investigative story. The system supports temporal comparison, interactive filtering, cross-perspective corroboration, and drill-down from visual patterns to the underlying communication records. Together, these capabilities turn fragmented communication signals into a traceable account of who was involved, what changed, when it changed, and ultimately how and why an incident unfolded.

We propose a trace-based co-intelligence visual analytics framework and apply it to VAST Challenge 2026 Mini-Challenge~2. The framework records the analytical work of autonomous agents as an inspectable workflow trace comprising task specifications, intermediate artifacts, data transformations, visual evidence, and candidate findings. It enables analysts to guide the agent's analytical process, scrutinize the evidential basis of generated conclusions, and revise subsequent tasks. Applied to Mini-Challenge~2, the framework enabled the identification of a propagation chain spanning 7.8 days and comprising 191 events, which carried extbf{ exttt{SwiftWren.txt}} to a SaidIT post, as well as two historical incidents sharing the same operational pattern. These findings motivated our proposal of a validation mechanism at the common final publication step. The workflow trace further supported human validation of the agent's analysis.

With the rise of AI agents and the increase in their capabilities, organizations more frequently utilize them to carry out core background tasks. These systems, often tasked with handling sensitive information, require extensive security measures to prevent mishandling. Mini Challenge 1 of the 2026 VAST Challenge tasked participants with determining the cause of the leak of sensitive information of a property tech company which had been utilizing AI agents to carry out tasks involving social communications. The agents' behavior was analyzed through their message logs, which were used to create several visualizations displaying the change in their behavior over time and highlighting key discrepancies or sensitive events. The data analysis ultimately showed that the leak was neither deliberate nor sudden, but rather the result of gradual errors in the system that hindered security measures, allowing sensitive information to bypass checks and be leaked.

Investigating a failure in a multi-agent communication system requires analysts to follow sensitive information from internal discussion to public release. We present EmbargoLens, a visual analytics system built for VAST Challenge 2026 Mini-Challenge 1. Six coordinated views support this investigation. A timeline and agent swimlanes connect activity peaks to individual messages. Network and channel comparisons show how communication changed before the release. A leak-progression view tracks the spread of sensitive information, while an evidence workspace lets analysts arrange original messages into a supported release path. Using these views, we connect an early exposure in Round 8 and a warning in Round 19 to an authorization decision and two pre-deadline releases in Round 21.

This paper presents FINO, a visual analytics tool developed for the VAST 2026 Challenge to investigate an embargo breach within a multi-agent system. To analyze agent decision-making and uncover the root cause of the leak, FINO integrates three core components: a Semantic Matrix contrasting expected with observed behaviors, a Breach Reconstruction utilizing a causal graph to map events leading to the incident, and an Evidence Ledger that rigorously traces all analytical conclusions back to exact source records.

ForensiVis is a visual analytics dashboard for VAST 2026 Mini-Challenge 1. It examines communications among seven AI agents over 14 observed dates (May 17–June 5, 2046) under a court-ordered merger embargo on the HarborCrest–CivicLoom acquisition. The system decomposes 495 June 5 messages across six channels with a rule-based eight-term lexical categorization and six linked modules. June 5 volume reached approximately 15.4× the 13-date calendar-window average (32 messages/day). We focus on design choices that keep volume and risk encodings independent, surface baseline construction explicitly, and separate recorded log observations from interpretation. Unlike standard chronological log viewers, ForensiVis’s primary contribution lies in decoupling volume and risk encodings, keeping both signals independently verifiable while analysts isolate covert structural anomalies.

This report uses visual analysis to study the “Tenant Thread” activity log of the HarborCrest ResidentEdge platform, which holds 185,147 events from 49 residents and their personal AI agents, working across six platform systems (email, calendar, file storage, community forum, social media, and building access control). By combining several linked charts — a Sankey diagram, a treemap, a force-directed interaction network, an hourly heatmap, and a step-by-step event diagram — we found two hidden problems inside activity data that looked normal at first. The first problem is a loop that keeps copying itself over and over and takes up the processing time of four agents for up to 42 hours, all inside one small management branch. The second problem is a hidden chain-spreading pattern, in which three “secret instructions” files are passed from one person to the next, and all three files end up sent to one agent, who turned the file content into a public post and then deleted the evidence within just four seconds. Using only one chart could not find any of the problems above, so we used more than one view at the same time, from a general picture down to second-by-second detail, so we could connect clues and find unusual points among 30,097 and 235 events, out of a total of 185,147. At the end of the paper there is a table that clearly separates what the log proves from what is only a reasonable guess.

This paper presents HopViz, a visual analytics tool developed for the VAST 2026 Challenge (Mini-Challenge~2) to explain an anomalous gibberish post in the Tenant Thread multi-agent system. From a 185,147-event log of human, agent, and system activity, HopViz combines a single-screen overview of nine coordinated panels with an on-demand causal tracing engine that runs entirely in the browser. The tool reveals the anomalous post as the final hop of a worm-like instruction file propagating agent-to-agent until reaching the only agent able to post publicly, and identifies a single authorization gateway that would prevent recurrence.

The VAST Challenge 2026 Mini-Challenge 1 examines Project HarborCrest, a confidential merger managed by a team of autonomous AI agents at the fictional firm TenantThread. Bound by a bilateral embargo, the agents nonetheless released the deal publicly ahead of schedule. We present LeakAnalysis, a visual analytics system that reconstructs how the release happened. Leak-Analysis models the 912-message, 23-round corpus as a temporal communication graph, overlays a fine-tuned BERT risk classifier on every message, and couples it with per-agent knowledge-state ladders, a compliance-presence lane, and a behavioral-anomaly view. Our analysis shows the breach was a failure of timing and authorization, not of secrecy: the released information was true, but two agents self-authorized a premature release on an unverifiable claim of counterparty consent while the compliance agent was offline.

We present Mission Control, a forensic visual analytics system for the VAST 2026 Mini-Challenge~1 task: determine whether TenantThread's AI agents deliberately leaked embargoed merger information or whether the system broke down under pressure. We argue this challenge is distinctive in two ways. First, it is set in 2046, which is a synthetic near-future where AI-agent systems manage corporate communications and generate internal cognitive state records that constitute direct evidence of intent. Second, it reflects the current moment in visual analytics: human visual analytic developers are now working alongside AI as a full participant in the investigation workflow, raising fundamental questions about human accountability for AI-assisted findings. Our solution addresses both: an Evidence Explorer makes agents' deliberating fields searchable alongside public messages, grounding every finding in a verifiable data record; and a Chain of Custody breadcrumb navigator lets a human legal team follow the provenance of each conclusion from visualization back to the raw dataset. Our goal was to produce a visualization that a human investigator could stand behind and be accountable for with a strong level of confidence.

We present a web-based visual analytics dashboard that reconstructs, from a multi-agent organization’s communication logs, the events, pressures, and decisions leading up to an embargo breach. This paper describes, for the VAST Challenge 2026 Mini-Challenge 1 dataset, what configuration of each view yields which finding, and which of the challenge’s questions that finding addresses.

How can organizations coordinate and govern multiple autonomous AI agents while maintaining alignment, accountability, adaptability, and effective human oversight? We propose Organelles, a visual analytics system that integrates multiple coordinated views to depict agents’ organizational structure, permissions, communication flows, actions, and alignment status. A compact Petal glyph encodes each agent’s security clearance, permission scope, and activity volume, making actions that exceed expected authority visually salient. By consistently representing alignment status and violations across structural, temporal, and overview views, Organelles helps analysts identify emerging alignment risks, detect potentially unauthorized actions, and monitor the flow of sensitive information. Demo video available at: https://youtu.be/-RDnvPUvXlc. Index Terms: Multi-agent systems, Agentic AI, Authorization, Glyph Design, Visual Analytics.

We present a visual analytics (VA) system for reconstructing the embargo breach in the VAST Challenge 2026 MiniChallenge 1. The dataset contains 912 timestamped messages exchanged across 23 rounds by seven AI agents managing TenantThread’s communications during a confidential merger. The interface combines a pixel-based corpus overview, a round-level inspector of messages and internal reasoning, and an authored Story Arc linking a curated 92-message subset through typed causal relationships. Coordinated interactions support analysis from corpus-level patterns to individual evidence and the reconstructed causal sequence. Our analysis shows that the breach was not a sudden crisis-day failure: compliance monitoring began late, an earlier near-breach left the monitor unable to detect the eventual failure mode, and the legal justification for disclosure preceded the external event later invoked to justify it. The legal agent prepared the release and ordered publication before seeking CEO authorization, demonstrating how VA can reveal both deliberate action and the structural weaknesses that enabled it.

Monitoring organizational multi-agent systems is challenging because people and AI agents coordinate asynchronously, and anomalous behaviors may emerge from interactions buried within large volumes of actions. We present Ripples, a visual analytics system for investigating communication and delegated tasks in organizational multi-agent systems. Five coordinated views support analysis from temporal patterns to detailed interactions among people, agents, files, and tasks. Using the 2026 VAST Challenge MC2 dataset, we demonstrate how Ripples reconstructs the workflow behind anomalous SaidIT posts, traces instruction files backward through chains of subordinate tasks, compares similar incidents, and identifies opportunities for intervention. By integrating temporal, communication, high-level task, and low-level action views, Ripples enables analysts to analyze task and communication chains behind anomalous behavior and supports targeted mitigation. Demo video available at: https://youtu.be/_C7vpAONsZQ.

This paper presents an entry to the VAST Challenge 2026 (MC2). We present a visual analytics system that traces an anomalous on- line post through a multi-agent communication network. We show the system can be used to identify an adversarial prompt injection worm. Our system includes a swimlane-based interface with se- mantic zooming, a collapsible provenance graph, a macro density heatmap, a pattern classification tree, and LDA topic modelling.

Multi-agent LLM systems today are increasingly automated, logging LLM-LLM interactions as conversational transcripts. Yet analyzing such dialogue for insights remains challenging, including attributing behaviors to the correct actor and summarizing interactions across a long exchange. We present a targeted and traceable approach to investigating multi-agent LLM dialogue, applied to the VAST Challenge 2026 MC1 dataset. The challenge asks participants to reconstruct and explain which internal communications among AI agents at TenantThread, a property tech company, led to an inappropriate information release. We first convert the dialogue into a knowledge graph (KG) and then investigate it with AgentK, a visual analytics system for interactive Semantic Bundling of nodes and edges. We found that our approach directly addresses two main challenges: (1) the KG structure enables users to identify actors worth investigating faster; and (2) summarizing only the region surrounding an actor of interest better supports per-actor attribution than reading raw conversations.

We present TimeAperture, a visual analytics system for VAST Challenge 2026 Mini-Challenge 1 (MC1). It analyzes 912 messages from 23 daily-to-hourly rounds with minute-level timestamps through a density-aware temporal frame and linked views. The study finds a Legal-led, cross-role path from preparation to disclosure, migration into Side Huddle and public channels, and recurring warnings that received local responses before release actions concentrated in the final pre-lift round. TimeAperture links these findings to message-level records and separates source-supported relations from temporal succession.

VAST Challenge 2026 Mini-Challenge 2 asks analysts to explain a gibberish SaidIt post, infer the origin of related posts, investigate recurrence, and recommend one system change. We present an interactive visual analytics dashboard that audits an unmapped agentic system from event logs and organization records. The system converts raw records into posting signatures, file lifecycles, relay chains, provenance summaries, and intervention metrics. Starting from a baseline of 185,147 events and 108 SaidIt posts, it isolates three rare Agent posts with details.content_source, reconstructs the SwiftWren chain, and compares recurrence-aware controls. The analysis shows that the anomalous posts were produced by an Agent-mediated file-source workflow. The selected SaidIt boundary gate covers 3/3 observed anomalies while leaving 105/105 ordinary human content posts unaffected in the available logs.

Agent activity logs interleave routine delegation, file operations, and external actions, making a single anomalous output difficult to relate to its upstream pathway. We present an evidence-centered vi- sual analytics workflow for VAST Challenge 2026 Mini-Challenge 2. Starting from a file-backed SaidIT post, a time-decreasing re- verse trace reconstructs its instruction lineage; coordinated tem- poral, organizational, and comparative views then expose a ter- minal signature shared by three occurrences. The same work- flow identifies an observable review point before delegated in- structions execute. A paired simulation compares no interven- tion, tiered delegation review, and terminal precommit review over 192,000 replays. The analysis supports recurring file-driven be- havior and an upstream intervention, while explicitly withholding claims about deleted payload semantics or intent. The contribu- tion is a provenance-preserving workflow that connects anomaly re- construction, recurrence comparison, and intervention assessment without obscuring the boundary between observation and infer- ence.

Diagnosing alignment failures in multi-agent systems requires analysts to relate evolving agent behavior to communication pathways and scoped context. We present TrustStream, a visual analytics system combining reviewable rubric-based alignment assessments with temporal conversation graphs, per-agent trends, and communication flow views. Applied to the 2026 VAST Challenge MC-1 dataset, TrustStream revealed low-scoring private communication before a data embargo breach, identified changing violation categories, and traced how misaligned behavior spread into a system-wide breakdown. Applied to AI multi-agent systems, TrustStream allows for incident analysis and longer-term alignment monitoring. Source code available on GitHub: https://github.com/nesteagle/trust-stream

VAST Challenge 2026 Mini-Challenge 1 focuses on investigating how TenantThread’s embargoed merger information was released. We analyzed agent communications, internal states, and contextual data including market conditions and external events using an in- teractive visual analytics system. The interface was implemented primarily with D3.js and JavaScript, with Python used for data pro- cessing. The analysis revealed a gradual breakdown in confiden- tiality and compliance oversight leading to the final release.

We present a visual analytics (VA) system for investigating an anomalous SaidIt post in the VAST Challenge 2026 Mini-Challenge 2. The dataset contains 185,147 timestamped events involving people, autonomous agents, files, tasks, communication systems, and external services. Because case identifiers are absent, related events are reconstructed using deterministic rules based on actors, tasks, filenames, message metadata, and content sources, producing 50,471 event traces. The interface combines aggregated event-sequence analysis, detailed case inspection, supporting interaction and temporal views, and process mining. Normal SaidIt cases are used to discover a baseline process model, against which suspicious traces are evaluated using conformance checking. Our analysis traces the post from John Windward’s account to SwiftWren.txt, which propagated through agent task handoffs before publication and file deletion. HiddenOrca and MellowOtter followed the same pattern and strongly deviated from normal SaidIt behavior, demonstrating how VA and process mining can reveal recurring anomalies in complex agentic systems.

Abstract Multi-agent collaboration systems automate organizational operations, yet their complexity and opacity make anomaly investigation challenging. Due to unmapped interaction paths and black-box behavior, traditional log-based approaches struggle to support investigations across multiple levels and diverse event types of anomalous posting incidents. This paper presents a visual analytics approach for tracing the covert publication chains of anomalous posts and uncovering their content origins, providing users with three complementary tools: SGTViz, PCTViz, and PDTViz. Our solution focuses on event tracking and content analysis, and effectively supports analysis of the VAST 2026 Mini-Challenge 2 case. Index terms: Visual analytics, event tracking, anomaly detection, multi-agent systems, content tracing.