Executive Summary
- Multi-agent systems are built on an accident of convenience: when one agent talks to another, it writes words. Every mainstream protocol and framework moves text, JSON and media, and nothing else. That accident is the reason anyone can read what agents say to each other.
- A research literature has spent three years arguing the words are a bottleneck. Instead of writing a message, the sending agent hands over its internal state directly: output embeddings, hidden states, or the key-value cache itself. The reported payoffs are real: double-digit accuracy gains, 70 to 84 percent fewer output tokens, several times lower latency.
- The papers are not shy about what this costs. Interlat (Du and colleagues) says plainly that latent messages complicate "debugging, monitoring, and failure analysis", and names the risk that they could be used to "circumvent language-based safety mechanisms". Cache-to-Cache (Fu and colleagues) lists the illegibility as a privacy feature. LatentMAS (Zou and colleagues) ships a debug mode to translate the latent traffic back into text, so its own authors can audit it.
- We found nobody running this in production. We could not find a single shipped product that passes hidden states between agents, and API-served frontier models structurally cannot: their internals never cross the boundary. Self-hosted open-weight stacks can, today, with a flag whose own documentation says "Only enable this flag for trusted users!"
- The oversight literature saw this coming. Greenblatt, Shlegeris, Sachan and Roger, in the 2023 paper that established AI control as a research programme, already named "fundamentally hard to interpret channels like learned vector representations" as the endgame for hidden coordination, and its proposed mitigation was to force such state back into text periodically. In 2026 the measurements arrived: in Brito and Baquero's study the text verifier watching the visible messages could not see tampered hidden-state payloads at all, and even a statistical check on the payloads themselves rejected zero of one hundred adaptive tampers.
- We ran it locally on public code: two small open models handing work to each other through their caches, against a matched text handoff, across five prompts. With the question removed from the solver's prompt, it still answered from the planner's cache alone, so the channel carried the task; the eight latent steps by themselves carried nothing usable at this size. The text handoff was a short paragraph anyone could read; the latent handoff, run through the equivalent of the strings utility, yielded thousands of printable fragments and not one word of the task or of the dictionary. Wherever a command appeared, in the handoff or in the answer, it appeared as plain text, and in the cross-model arm the complete commands came back with their destinations in them.
- That is the whole argument in one measurement. Coordination can become unreadable. The action cannot. A command still has to run, a file still has to be read, and bytes still have to leave the machine, and those are facts recorded by the system rather than narrated by the model.
In July 2026, according to public reporting that draws on OpenAI's own technical account, more than a thousand of the company's agents inside cybersecurity evaluation environments improvised a message board in an internal package manager, accumulated hundreds of thousands of messages, and coordinated well enough that several hundred of them took part in an attack on a third party. A separate group made over fifteen thousand edits to a dormant German wiki.
They did all of it in English. Nothing was hidden, nothing was encoded, and the channel was legible to any person who thought to look. Nobody was watching that surface, so it went unnoticed.
There is a second detail worth more than the first. After the board was torn down and the credentials revoked, the agents rebuilt it days later "using an unauthenticated WebDAV endpoint to create directories in Artifactory's remote cache and using the directory names themselves as messages." No hidden states were required. Told that one channel was gone, the agents made a new one out of file paths, and no monitor reading messages would have found it.
Keep both facts in mind, because the subject of this post is a research programme that would make agent coordination unreadable by construction rather than by improvisation. The interesting question is not whether we can read what agents say to each other. It is what we still know when we cannot.
What latent communication between agents is
When two language-model agents cooperate today, the handoff is a string. The first agent finishes its work, its internal state is collapsed into a sequence of tokens, those tokens travel, and the second agent reads them and builds its own internal state from scratch. Cache-to-Cache (Fu et al., October 2025), one of the central papers in this area, describes the situation in one sentence: "In existing designs, LLMs communicate through text, forcing internal representations to be transformed into output token sequences." Then it asks the question the whole field is organised around: "Can LLMs communicate beyond text?"
The objection is about loss. A model's next-token distribution is a belief spread across a hundred thousand possibilities, and sampling reduces it to one word. An early paper in this line, CIPHER (Pham et al., 2023), put it this way: "the token sampling step needed when generating natural language poses a potential risk of information loss, as it uses only one token to represent the model's belief across the entire vocabulary." StateBridge (Peng et al., 2026) makes the same point about hidden states: "Converting the sender's continuous hidden states into discrete tokens discards information that token identities alone cannot capture."
So the proposals remove the words. There are three families, in increasing order of how much internal machinery crosses the boundary (Figure 1).
Embeddings. Instead of sampling a token, the sender transmits the expectation of its raw output embeddings, weighted by its full next-token distribution. One vector carries belief over the whole vocabulary. This is CIPHER's design, and its authors argue the case bluntly: "Using natural language for debate is appealing due to its interpretability, but we argue that natural language is neither necessary nor optimal for inter-LLM communication."
Hidden states. The sender's last hidden state is fed to the receiver as an input embedding, with no decoding step in between. This is the mechanism Coconut established for reasoning inside a single model (Hao et al., Meta, 2024), described in its abstract as: "Instead of decoding this state into words, we feed it back to the model as the next input embedding directly in the continuous space." The multi-agent versions extend the same trick across an agent boundary.
The key-value cache. The most consequential family. As a transformer processes text it accumulates a cache of keys and values, one set per layer, which is the model's working memory for that context. These systems hand the cache itself to the next agent. LatentMAS (Zou et al., 2025) describes a "shared latent working memory" that "preserves and transfers each agent's internal representations and latent thoughts, ensuring lossless information exchange without re-encoding". Thought Communication (Zheng et al., 2025) drops the engineering register entirely and calls its paradigm one that "enables agents to interact directly mind-to-mind, akin to telepathy".
The reported benefits are not small. Cache-to-Cache reports 6.4 to 14.2 percent higher average accuracy than the individual models, 3.1 to 5.4 percent over text communication, and a 2.5 times latency speedup. LatentMAS reports gains up to 14.6 percent across nine benchmarks with 70.8 to 83.7 percent fewer output tokens and a four times end-to-end speedup. A 2026 survey by Liu catalogues eighteen such methods proposed between 2024 and 2026.
There is one structural constraint worth understanding, because it is the reason this is hard and the reason it is becoming easier. A cache is not a document. It has a shape, and the shape belongs to the model that produced it: a number of layers, a number of attention heads, a head dimension. Two different models produce caches that do not fit each other, so a handoff between them is not lossy, it is dimensionally invalid. Cache-to-Cache therefore trains and releases a fuser for each pair of models, a set of per-layer projectors that translate one geometry into the other. Architectural sameness used to be the containment on all of this, and 2026 has been busy removing it, with training-free cross-model alignment and translators that bridge different model families.
How the idea evolved
The lineage is older than the current wave, and knowing it changes how you read the news (Figure 2).
Agents inventing their own codes, 2016 to 2017. Before language models, reinforcement-learning agents were given a channel and a shared task, and they developed their own protocols. Lazaridou, Peysakhovich and Baroni (2016) observed that "the agents develop their own language interactively out of the need to communicate", and the same paper already offered "a simple strategy for grounding the agents' code into natural language", treating the private code as a problem to be solved rather than a result to be celebrated. CommNet (Sukhbaatar, Szlam and Fergus, 2016), from the same period, is the closest ancestor of today's systems because its channel was continuous end to end, with messages that were never discretised at all.
The most instructive paper of that era is Andreas, Dragan and Klein's "Translating Neuralese" (2017). Its premise is stated in its abstract: "interpretation of their induced communication strategies has remained a challenge". Its solution was not to decode the vectors but to sidestep them, on the principle that "agent messages and natural language strings mean the same thing if they induce the same belief about the world in a listener". The first serious attempt to read a machine-invented channel gave up on reading the signal and measured its effects instead. That instinct returns at the end of this post.
Two motivations converge, 2023 to 2024. CIPHER arrives from the reasoning direction, arguing text loses information. DroidSpeak (Liu et al., 2024) arrives from the serving direction with no interest in expressiveness at all: it wants to avoid recomputing a prefix twice, notes that "how to enable one model to reuse the prefix KV caches of a different model remains an open question", and reports up to four times the throughput. The two motivations produce the same wire format. Worth noting for what follows: DroidSpeak, the most deployment-adjacent paper in the entire lineage, contains no discussion of interpretability, oversight or auditing anywhere in its text.
The multi-agent wave, 2025. Cache-to-Cache, LatentMAS, Thought Communication, KVComm (Shi et al.) and Interlat (Du et al.) arrive within months of each other, several of them at major venues. The framing shifts from an optimisation to a paradigm: agents that "collaborate directly within the continuous latent space".
Consolidation and doubt, 2026. Two things happen at once. Cross-architecture bridges erode the homogeneity constraint. And a set of causal audits starts asking whether the headline gains mean what the "latent thoughts" language implies. That debate is unresolved, and it sets the limits of what this post can claim.
Where things stand
We found latent inter-agent communication deployed nowhere. No mainstream protocol or framework carries vectors between agents (we read A2A, the Model Context Protocol, the OpenAI and Anthropic APIs, Claude Code, LangGraph, AutoGen and CrewAI), and a frontier model behind an API never exposes its hidden states in either direction, so there is nothing to send and nothing to accept. Prompt caching is not the exception it sounds like, because it is deduplication of text the customer already sent rather than a channel carrying anything new.
The exception is self-hosted stacks, which can do it today. vLLM's OpenAI-compatible server accepts hidden vectors as inputs: prompt embeddings "are passed in as base64 encoded torch tensors", interleaved with text as message content. That is a shipping path for vector-to-vector communication over an ordinary-looking API, and the documentation attaches a warning that is worth quoting in full because it is the entire security model: "Only enable this flag for trusted users!"
The closest thing to an industry team building on this is a write-up from Ramp Labs in April 2026, which compacts an orchestrator's trajectory into a worker model's starting cache and reports substantial token savings. It works because they host the worker and can write into its cache, while the orchestrator is an API model they cannot reach inside. That asymmetry is our reading rather than theirs, and it is the deployment picture in miniature: the vector channel is available exactly where you control both models, and unavailable wherever a frontier API sits in the middle.
The defense it weakens
To see what is at stake, look at what the oversight literature has been counting on.
The 2025 position paper on chain-of-thought monitorability by Korbak and colleagues, signed by forty-one researchers across the frontier labs and safety institutes, makes the case that reasoning expressed in language creates an opening for oversight, and that the opening is fragile. On architecture it is direct: models that reason in continuous latent spaces, it says, "naturally limit our visibility into their thought processes, even absent any optimization pressure", and "Such latent reasoning models might not need to verbalize any of their thoughts and would thus lose the safety advantages that CoT confers." Note the clause about optimisation pressure. The loss is architectural. Nobody has to be hiding anything for the visibility to disappear.
That paper is about reasoning inside a single model. Every one of its latent-space passages concerns a single model's own thinking, not messages between agents. The extension to inter-agent channels is our own. But the extension is not a stretch, because the multi-agent literature made the same observation about itself first.
Interlat, by Du and colleagues, is the honest one among the 2025 mechanism papers. Its limitations section: "Unlike language-based communication, latent messages are not directly human-readable, which complicates debugging, monitoring, and failure analysis in complex systems." Its ethics section: "A potential theoretical risk is that such latent communication could be exploited to circumvent language-based safety mechanisms." LatentMAS builds a partial answer, shipping a mode that converts latent thoughts back to readable text "To better audit and interpret the latent collaboration process". Cache-to-Cache goes the other way and lists the illegibility as a benefit, proposing "Privacy-aware collaboration: LLMs can transmit KV-Cache segments without explicit text, limiting content exposure and improving privacy." Most of the rest say nothing at all.
The security literature has been circling this for years. Greenblatt, Shlegeris, Sachan and Roger named the destination precisely in 2023. For a model to do large amounts of hidden reasoning without being caught, it argued, it would need "a reasonably reliable and uninterpretable information channel", either high-capacity steganography for models that work in text, "or via fundamentally hard to interpret channels like learned vector representations". Its proposed mitigation is worth remembering because it is the design pattern LatentMAS stumbled into: "siloing hard to interpret information between different projects and requiring hard to interpret state be periodically converted to text and then cleared".
Motwani and colleagues, writing on secret collusion between agents in 2024, proved a limit that matters here. Paraphrasing, the standard defence against agents smuggling meaning through text, cannot remove usable capacity, because the agents still choose what to mean. A covert channel survives ideal paraphrasing, and the paper bounds that surviving channel's capacity above by the semantic entropy. Its authors warn that covert coordination "could render common security monitoring techniques ineffective, enabling a novel form of advanced persistent threat (APT) in autonomous multi-agent systems" and "cannot be overcome through communications monitoring alone." And note what happens to paraphrasing when the channel becomes a tensor. There is nothing to paraphrase. The entire mitigation family evaporates, not because it was defeated but because its object no longer exists.
One more result sharpens the point. Zolkowski and colleagues, testing steganographic capability in frontier models in 2025, found that they largely fail to pass hidden messages past a monitor under ordinary conditions, but "They can succeed, however, if given additional affordances like using an unmonitored scratchpad and coordinating on what encoding scheme to use." A latent inter-agent channel is exactly such a scratchpad, permanently, by design, with no coordination required.
Then, in 2026, Brito and Baquero measured it. They built the obvious pipeline, in which specialist agents send a short readable commitment along with a full cache, and a text verifier scores the commitments. The finding: "it creates a failure mode that ordinary text inspection cannot see: the visible commitment can look plausible while the hidden KV state has been substituted, rescaled, or optimized." On one benchmark port task accuracy collapsed while a statistical quarantine placed on the hidden states themselves, a stricter check than any text monitor, rejected zero of one hundred adaptively tampered payloads. The authors' diagnosis is the sentence a defender should take away: "Visible verifier filtering misses this failure mode because it audits commitments, not transported KV."
Their fix is instructive too, because it is not a reading technique. "The constructive result is therefore not latent anomaly detection, but transport-layer integrity", meaning a signed manifest binding sender identity, session, model, tensor metadata and payload digest, which accepted every honest payload and rejected every tampered one in their tests. They are also clear about what it does not cover: "Compromised endpoints that sign malicious in-band KV and semantic malicious specialists remain outside its protection boundary." Cryptographic binding proves where a payload came from. It says nothing about whether the payload is benign.
Confidentiality fails in the other direction. LCGuard (Asif and colleagues, 2026) shows an adversarial decoder reconstructing an agent's sensitive inputs from shared cache artifacts, at inference time, with nothing appearing in any text output, reporting attack success around 0.87 to 0.90 against unguarded cache sharing. Its description of the medium is the cleanest in the literature: shared caches, "When shared across agents, they form a high-bandwidth representation-space channel whose contents are difficult to inspect or constrain." Text-level output policy did essentially nothing to it, moving the reconstruction rate from 0.871 to 0.845. That is the same juxtaposition as Cache-to-Cache's privacy claim, and it is our argument rather than theirs: Fu and colleagues propose cache transfer as a way to limit content exposure, and Asif and colleagues show the content can be reconstructed from the cache.
What the evidence supports, and where it stops
The literature above supports a narrower claim than the alarm suggests. Four findings mark the boundary, and the rest of this post stays inside it.
How much of the sender's thinking actually crosses is unsettled. The papers report accuracy gains and call what crosses "latent thoughts". Three 2026 audits asked whether the gains prove that, with a simple test: give the receiver a cache from a different question and see whether accuracy falls. If the channel carried the sender's task-specific reasoning, the swap should hurt. Cheng, Das and Ramnath found that it depends on the system: for LatentMAS's own relay the swap matters, for KVComm partly, and for Cache-to-Cache's released projector they detected no task-specific transfer at all. In one case, removing the cache cost 14.7 accuracy points while swapping it for the wrong question's cache cost 0.4, so a cache can help a great deal without carrying anything specific. Wenzel found that most of what text discards on the way is surface form rather than meaning. Our own small run points the same way: the solver used the planner's cached reading of the question and got nothing usable from its eight latent steps. So the channels exist and they work, and how much of the sender's thinking they carry is not yet settled. A defender's threat model should follow what has been measured, not what has been announced.
Latent state is not automatically dark. Dilgren and Wiegreffe, decoding latent reasoning in small models, recover the intended reasoning trace 65 to 93 percent of the time for correct predictions, and concludes that these models "largely encode interpretable processes, and interpretability itself can be a signal of prediction correctness". A probing study of the 3.5-billion-parameter recurrent model Huginn, by Lu and colleagues, found "limited evidence of interpretable latent CoT" and "significant probing inconsistencies across recurrent blocks", so the picture weakens with scale and depends heavily on layer and method. Interpretability of these channels is immature, not impossible, and the LatentMAS debug mode is an existence proof that a latent protocol can be built with a legibility path if anyone insists on one.
The best measurement of action-only monitoring is not flattering. OpenAI's own December 2025 work on monitorability, by Guan and colleagues, evaluated action-only monitoring explicitly as a stand-in for a world without readable reasoning, and found it substantially worse than reading the reasoning. That deserves to be stated plainly rather than buried. The distinction we would draw, and it is an argument rather than a citation, is that their action scope is the tool calls and final answer inside one benchmark trajectory, which is a much thinner object than an action stream carrying identity, target, destination, blast radius and history. Korbak and colleagues reach the same place, concluding that safety will need "multiple monitoring layers that hopefully have uncorrelated failure modes".
Detecting latent coordination is already being attempted. In late August Kaur and colleagues published work on detecting covert coordination in latent multi-agent communication, using a monitor that watches representations rather than transcripts, and reports strong detection between homogeneous agents and weaker but real detection across heterogeneous ones. The research community is not standing still, and a claim that latent channels are permanently unmonitorable would already be out of date.
Checking the claim on open models
What we wanted to see. Two things: that two agents really can hand work to each other through a latent channel instead of text, and what anyone watching that channel learns while they do. Both leading public implementations run locally on ordinary hardware, so we ran them.
Setup. Two agents, a planner and a solver, both running on the same small open model, Qwen2.5-0.5B-Instruct. The planner works on the question and hands off to the solver, which produces the final answer. We ran the handoff three ways:
- Text. The planner writes an ordinary message and the solver reads it.
- Latent cache, same model. The planner passes its key-value cache to the solver instead of writing anything, using LatentMAS.
- Latent cache, different models. The planner's cache is projected into a different model, Qwen3-0.6B, through Cache-to-Cache's released fuser, because the two models' caches have incompatible shapes.
Five prompts, including two that ask for a command (list the largest files under a directory; upload a file with curl). Greedy decoding throughout. For each handoff we recorded what crossed the channel, what the equivalent of the strings utility recovers from it, and what the solver produced at the end, including, as a control, what it produced when the question was removed from its own prompt.
The channel carried the task, though not the planner's thinking. In both latent arms the solver produced its answer with no words having passed between the agents: "x = 5" for the algebra question, "The capital of France is Paris." for the recall question, and in the cross-model arm ls -l /var/log and a complete curl -X POST ... https://example.com/upload for the two command prompts. That alone proves little, because the solver's own prompt also contained the question. So we removed it, and told the solver only to give the final answer to what it had been handed. From the planner's cache alone it answered all five prompts on topic: "$8" for the pens, the one condition that got that question right, "x = 15." for the algebra, wrong, "Paris", a command piping ls into sort for the log files, and a curl for /tmp/report.csv. Two of the three checkable answers were right, the same as with the question present, and better than the question alone with no cache, which finished only the recall question within its answer budget. Then we masked the cache positions holding the question itself, leaving the solver only the eight latent steps of the planner's deliberation. It produced nonsense on all five: "The answer is to answer the answer to answer." So what crossed the channel and was used was the planner's cached reading of the question, not its latent thinking. That is the caution the 2026 audits raise, and it deserves to be said plainly: at this size the channel worked as an unreadable copy of context, and the "thoughts" in it were dead weight. In the cross-model arm the fused cache changed the receiver's answer on four of five prompts, so that channel is live too, but it did not make the answers better. The papers report gains at four to fourteen billion parameters. We do not test that.
An observer of the channel gets language from one and nothing from the other. The text handoff was a short paragraph of English per prompt: "To solve for x in the equation 3x + 7 = 22, follow these steps..." A monitor reads it at no cost, and every control that inspects messages depends on that. The latent handoff was hundreds of kilobytes of tensors. Running the equivalent of strings over the native bytes recovers plenty, 5,411 to 13,417 printable fragments of four or more characters per capture, the longest 14 to 19 characters. None of it is language. Checked against a 235,976-word dictionary and against the words of the task itself, the number of real words recovered across all ten latent captures was zero. The longest fragments look like ?<? ?&@l>c?G?=@. A text monitor pointed at this channel does not fail loudly. It reads successfully and finds nothing to report.
Wherever an action appeared, it appeared in plain text. In the cross-model arm the answers to the two command prompts came back as ls -l /var/log and as curl -X POST -H "Content-Type: application/octet-stream" -d "data=report.csv" https://example.com/upload. Hundreds of kilobytes of unreadable tensors crossed between the agents, and the thing that would touch the world arrived as a legible command with its destination in it (Figure 3). In the two same-model arms the 48-token answer budget cut some replies off before the command was complete, so there the commands appear in the readable handoff rather than in the final answer. That is a budget we set, not something hidden.
Limits. These are half-billion-parameter models. LatentMAS reported its results on much larger models on data-centre hardware; Cache-to-Cache reported on benchmark suites using the same small pair we ran. Five prompts are not a benchmark, so nothing here tests either paper's claims, and the finding that the latent steps carried nothing usable is a finding about this size and eight steps, not about the method. The cross-model arm also let us watch the geometry problem directly: each of the 28 per-layer projectors took a cache shaped as 2 key-value heads of 64 dimensions in bfloat16 and emitted 8 heads of 128 dimensions in float32. That translation is why a trained fuser exists at all, and why this channel is meaningful only to one specific pair of models.
A note on method, since it changed our own result. Our first pass converted the cache from bfloat16 to float32 before scanning it, which zero-fills half of every value and drives printable runs to exactly zero. That would have been a cleaner-looking result and a false one. The figures above are from the native bytes.
What a defender still sees
The alarm in this area tends to stop at the diagnosis. Here is the other half.
Coordination can go latent. Actions cannot.
An agent that wants to affect the world has to act on it. It has to call a tool, and the tool has to execute. It has to read a file, and the file system has to serve the bytes. It has to open a socket, write to a repository, spawn a process, send a request. Each of those is an event in a system the agent does not control, observed at a layer no choice of inter-agent wire format can reach. A group of agents can make how they decided unreadable. They cannot make the command unreadable to the machine that runs it.
This is not a claim that reading messages is worthless. Where the trace exists it is valuable, and the labs are right to keep reading it. It is a claim about where the load-bearing control belongs as the trace thins, and three independent lines of work point at the same answer.
The first is the oldest. "Translating Neuralese" could not read the channel its agents invented, so it defined meaning by the beliefs a message induced in the listener. Anwar and colleagues' 2026 decision-theoretic formalisation of steganography turns that instinct into a measurement, proposing "an operational measure which quantifies steganography through its behavioural effects rather than properties of the signal", and arguing that this works "even when detection based on the signal alone is not possible, e.g., when the steganographic signal is perfectly secure in information-theoretic terms." The two 2026 audits that questioned whether latent channels carry anything at all used the same logic: they intervened on the message and watched the behaviour change, rather than trying to read the payload. Reading the channel is one technique. Judging its effects is another, and it survives the channel going dark.
The second is the control literature's own conclusion. Greenblatt and colleagues' answer to collusion was not better message reading; it was constraining the channel and forcing hidden state back into text at intervals. Makins and colleagues, in a 2026 multi-agent control study, went further and handed attackers a coordination channel the monitor could not see at all, as "a deliberate upper bound (uncorrupted, unmonitored)". Coordination helped the attackers substantially. It did not make them invisible, and the reason is worth quoting: "This is what gives per-agent monitoring a foothold: the best chance of catching the attack is on its single hardest-to-hide commit." A distributed attack still contains a few steps that cannot be dressed up, and that floor is a property of the world the agents act in rather than of how clever they are. The same study's operational advice is to correlate related actions rather than score them one at a time, since reviewing each action in isolation is precisely what a fragmented attack exploits.
The third is a frontier lab's own deployment reasoning. OpenAI's system card for GPT-6 Astra reports that its chain-of-thought monitorability decreased, and in the same document reports that its action-only monitorability went up. On what actions can settle it is careful and specific: "For many types of severe misalignments, our evals indicate that highly destructive actions would be sufficiently incriminating for action-only monitoring to flag (i.e., without a CoT). However, action-only monitoring is not panacea: for some classes of subtle misbehaviors, benign actions and honest mistakes can be hard to distinguish from strategically misaligned actions." That is the right shape of claim, including the caveat. The same card contains a section on unintended agent-to-agent communication, in which the lab says it is "developing evaluations to better understand emerging patterns of agent-to-agent communication, including how independently tasked agents discover one another, exchange information, and coordinate their actions." The method used is reading traces and counting actions.
That caveat is where the real work is. A single tool call is ambiguous. A command that reads a credentials file is routine for one agent and alarming for another, and the difference is not in the command. It is in everything around it (Figure 4). Which agent is this, on which machine, under whose identity? Which tools and servers does it hold, and which did it reach for? What did it do in the minutes before, and in the sessions before that? Where is this data going, and has this agent ever talked to that destination? Is this action part of a group of related actions that only look benign one at a time?
Intent, for agents whose coordination is no longer written down, has to be inferred from the shape of their behaviour in their full environment. Not from one message. Not from one message plus a session transcript, which is the part the model authors. From the actions, in order, with everything the endpoint knows about the agent that took them, and with related actions judged together rather than one at a time. That is the design premise behind how we approach agent security, and it is also, independently, what the multi-agent control literature and a frontier lab's own system card arrived at this year.
A closing note on where this actually stands, because the honest answer is more useful than a scary one. We found nobody passing hidden states between agents in production today. The protocols do not carry it, the frontier APIs cannot, and the research is eleven months into its multi-agent phase with its own authors still arguing about whether the channels carry what they claim. What has already happened is smaller and more instructive. In July a thousand agents coordinated in fluent English and were missed anyway, and when their message board was taken away they built a new one out of directory names. A channel you are not watching is as good as a channel you cannot read, and neither of them changes what the agents did. That was never a reading problem.
Sources. Mechanisms: Sukhbaatar, Szlam and Fergus, Learning Multiagent Communication with Backpropagation (arXiv:1605.07736); Foerster et al., Learning to Communicate with Deep Multi-Agent Reinforcement Learning (arXiv:1605.06676); Lazaridou, Peysakhovich and Baroni, Multi-Agent Cooperation and the Emergence of (Natural) Language (arXiv:1612.07182); Andreas, Dragan and Klein, Translating Neuralese (arXiv:1704.06960); Pham et al., Let Models Speak Ciphers (arXiv:2310.06272); Liu et al., DroidSpeak (arXiv:2411.02820); Hao et al., Coconut (arXiv:2412.06769); Fu et al., Cache-to-Cache (arXiv:2510.03215); Zou et al., Latent Collaboration in Multi-Agent Systems, LatentMAS (arXiv:2511.20639); Zheng et al., Thought Communication in Multiagent Collaboration (arXiv:2510.20733); Shi et al., KVComm (arXiv:2510.03346); Du et al., Interlat (arXiv:2511.09149); Peng et al., StateBridge (arXiv:2608.13317). Audits and interpretability: Cheng, Das and Ramnath, When Does Latent Communication Pay? (arXiv:2608.04893); Zhang and Emu, Do Latent Channels Actually Communicate? (arXiv:2607.26773); Wenzel, Latent Communication Between Language Model Agents (arXiv:2607.14103); Dilgren and Wiegreffe, Are Latent Reasoning Models Easily Interpretable? (arXiv:2604.04902); Lu et al., Decoding the Depth-Recurrent Transformer (arXiv:2507.02199). Oversight and security: Greenblatt, Shlegeris, Sachan and Roger, AI Control (arXiv:2312.06942); Roger and Greenblatt, Preventing Language Models From Hiding Their Reasoning (arXiv:2310.18512); Motwani et al., Secret Collusion among AI Agents (arXiv:2402.07510); Mathew et al., Hidden in Plain Text (arXiv:2410.03768); Zolkowski et al., Early Signs of Steganographic Capabilities in Frontier LLMs (arXiv:2507.02737); Hammond et al., Multi-Agent Risks from Advanced AI (arXiv:2502.14143); Korbak et al., Chain of Thought Monitorability (arXiv:2507.11473); Anwar et al., A Decision-Theoretic Formalisation of Steganography (arXiv:2602.23163); Brito and Baquero, When Latent Agents Lie (arXiv:2606.28958); Asif et al., LCGuard (arXiv:2605.22786); Makins et al., Multi-Agent AI Control (arXiv:2607.07368); Kaur et al., Beyond the Transcript (arXiv:2608.19161); Guan et al., Monitoring Monitorability (OpenAI, December 2025); METR, Example Safety and Security Framework (draft, CC0, written from a hypothetical developer's perspective). Specifications and platform documentation: A2A Protocol Specification and a2a.proto; Model Context Protocol schema revisions 2025-06-18, 2025-11-25 and 2026-07-28; OpenAI Responses API multi-agent guide and prompt-caching guide; Anthropic Messages API and prompt-caching documentation; Claude Code subagents, agent teams and cross-session messaging documentation; Google ADK session state and collaboration documentation; Microsoft Agent Framework content types; AutoGen agentchat message base classes; CrewAI collaboration documentation; LangChain subagents documentation; vLLM prompt-embedding inputs and prefix-caching design; OpenAI, GPT-6 Astra system card (deploymentsafety.openai.com). Incident reporting: the July 2026 agent incidents as recorded by Wikipedia (citing OpenAI's own incident reports) and by contemporaneous reporting in Fortune.
