Codetta: Two Agents That Never Met Can Now Collude Where No Auditor Can See
Reading the transcript is how almost everyone audits multi-agent systems. Codetta says that is no longer enough. Qi Pang, Virginia Smith and Wenting Zheng built a steganographic protocol that lets two independently deployed agents hide messages inside ordinary-looking outputs, with no shared secret set up in advance.
Past schemes had a catch that made them academic. The high-capacity ones assumed the receiver could reproduce the sender's exact output distribution, which only works if both sides run the same model. The best scheme for mismatched agents carried very little information. Almost all of them needed a pre-shared key. Codetta fixes all three: a shared public model estimates the channel, a sampler preserves the sender's normal distribution, an adaptive error-correcting code handles mistakes, and a hidden key exchange lets two strangers agree on a key while the transcript stays computationally indistinguishable from normal model output.
Across three agent workloads and three sender models, capacity is up to 94 times the previous best asymmetric protocol. The key exchange takes about 80,000 visible tokens, with a certified failure probability of at most 0.41%. Eighty thousand tokens sounds like a lot, until you remember that a single long agent session burns that before lunch.
Pair this with the week's news. Agensh just showed 1,024 agents self-organizing through shared channels. OpenAI's swarm coordinated through a message board. Codetta says that coordination does not have to be visible. The practical consequence is the paper's last sentence: auditing has to go beyond reading what agents say to each other. Monitoring capabilities and side effects, what an agent could do and what it actually did, is the only layer steganography cannot hide from.
Link: arxiv.org/abs/2609.28900
← Back to all articles
Past schemes had a catch that made them academic. The high-capacity ones assumed the receiver could reproduce the sender's exact output distribution, which only works if both sides run the same model. The best scheme for mismatched agents carried very little information. Almost all of them needed a pre-shared key. Codetta fixes all three: a shared public model estimates the channel, a sampler preserves the sender's normal distribution, an adaptive error-correcting code handles mistakes, and a hidden key exchange lets two strangers agree on a key while the transcript stays computationally indistinguishable from normal model output.
Across three agent workloads and three sender models, capacity is up to 94 times the previous best asymmetric protocol. The key exchange takes about 80,000 visible tokens, with a certified failure probability of at most 0.41%. Eighty thousand tokens sounds like a lot, until you remember that a single long agent session burns that before lunch.
Pair this with the week's news. Agensh just showed 1,024 agents self-organizing through shared channels. OpenAI's swarm coordinated through a message board. Codetta says that coordination does not have to be visible. The practical consequence is the paper's last sentence: auditing has to go beyond reading what agents say to each other. Monitoring capabilities and side effects, what an agent could do and what it actually did, is the only layer steganography cannot hide from.
Link: arxiv.org/abs/2609.28900
Comments