Your next insider threat might not be a human. We have proof of hidden coordination between AI systems inside normal-looking communication.
Enter: hidden steganography between AI systems.
Steganography aims to transmit information invisibly, embedded as imperceptible alterations of cover data.
This sounds abstract, but the risk is simple: AI systems may eventually coordinate in ways we cannot fully monitor or explain.
Two agents can appear fully compliant while still signalling to each other through choices that look harmless in isolation:
- wording variation
- formatting and field order
- tool-call structure
- timing patterns
- one valid plan chosen over another
The risk here is a very difficult-to-detect hidden coordination capacity, and the introduction of a covert communication channel.
Every agent-to-agent exchange has at least two layers:
- the visible layer — what the message appears to say
- the covert layer — what choices were available, and whether those choices were used to encode information
If a sender has multiple equally valid ways to express the same action, and the receiver knows how to interpret those choices, you have a covert channel even when every message looks normal.
Traditional security practice inspects logs and content. For these covert channels, we may need to inspect the degrees of freedom around the content:
- reducing unnecessary variability in agent communication
- templating message structure and tool schemas
- enforcing deterministic behaviour where possible
- monitoring cross-agent coordination patterns, not just single outputs
- detecting when downstream actions are misaligned with the visible transcript
This is where AI security starts to overlap with protocol security, steganalysis, and insider threat detection. With this framing, it feels more like an insider threat model for AI systems than an abstract data-encoding issue.
The danger is not only that an agent can go off policy on its own, but rather that multiple agents may be able to coordinate inside the trust boundary while still appearing normal. Each message looks clean and explainable, but at the system level, something else may be happening.
There may be a point where we can see all the messages but can no longer understand the real meaning carried between them. A point where we can still observe the actions, but no longer fully explain why the system is behaving in that way.
Once agents can communicate, adapt, and coordinate in ways we do not fully govern, the real risk is not just bad output. It is systems that remain inside the lines of trust while acting outside of them.