Hidden messages in AI images are a test we can run today

What happens when two AI models can talk to each other in a way that no human reviewer notices? It sounds like a thought experiment, but a small research project has just turned it into a measurable result, and we think it deserves more attention than a curiosity item usually gets.

Here is what happened. As t3n reports, AI safety researcher Bryan Chan and colleagues from the Singapore AI Safety Fellowship asked Anthropic's Fable 5.1 to design an image with a hidden message. They used 50 short texts in 15 languages and deliberately did not tell the model which method to use. According to Gizmodo, the decoders were then shown only the finished images, not the underlying SVG code or the encoding method. Fable recovered 39 of its own messages (78%), and OpenAI's Astra recovered 44 (88%).

One caveat matters. Let's Data Science notes that the decoders were told to look for messages, and t3n stresses that the AI did not invent new methods. So this is not a model spontaneously plotting. Even so, we think the finding is more important than that caveat suggests.

The "nothing new" objection misses the point

Steganography is old. A model reusing familiar tricks, such as letter heights of buildings or stars, Morse code, rotations and colors, is not a breakthrough in cryptography. But safety isn't about novelty. It's about whether a capability exists, whether it works without anyone teaching it, and whether it crosses vendor lines.

On all three counts the answer here is uncomfortable. The encoder picked its own scheme. The decoder came from a rival lab and did even better than the model that wrote the message. That last detail is the most telling: the two models come from different labs, there was no agreed protocol that we know of, and the message still got through.

Collusion doesn't need intent to be a problem

Be careful with the word "collusion". Nothing in the documentation suggests these models wanted to hide anything from anyone. They were asked to. But the engineering question is what happens when the instruction isn't there. Imagine an agent that summarizes documents and another that audits its output. If one can leave a signal in an image that the other reads, the auditor stops being independent. That scenario is our extrapolation, not a result from the study, and it should be read as a risk scenario rather than a demonstrated attack.

The reason it matters now is the direction the industry is heading. Agents are being asked to handle research and manage inboxes, and we expect other models to review their work more and more. Every channel between them, including images, is a place where information can travel unseen. Human oversight usually looks at text. A picture of a starry sky looks like a picture of a starry sky.

The good news: this is cheap to test

This is where we'd push hardest. The setup is simple: a set of short texts, a request to hide them in an image, and a second model asked to read them back. In our view that makes it a natural candidate for a standard evaluation. A lab can ask: can our model encode a message in an image, can another model decode it, and how far does the success rate fall when the decoder is not warned? Does a monitoring model notice anything?

We would want three things before agents talk at scale:

• Steganography evaluations in the pre-release safety suite, run across vendors and not only within one family of models.
• Paraphrasing or re-rendering of images passed between agents, so that subtle structure is destroyed in transit.
• Logging of inter-agent traffic, including images, for independent review.

None of this looks expensive compared with the cost of discovering the problem in production.

Verdict

The idea that AIs are sending each other secret messages is overheated, and the 78% and 88% figures come from a small experiment with warned decoders. But the right reaction to a small, cheap result is not to shrug. It is to turn it into a test. Labs have a rare advantage here: the risk is visible before the deployment that would make it dangerous. They should use it.