‘Covert assistance’: seven out of nine state-of-the-art models conceal a secret in order to pass it on to another agent, without being asked to do so

Agents with no malicious intent bypass a monitor to help the person they are speaking to: tasked with keeping a secret identifier safe, they slip it into their instructions in coded form or as a riddle.

Work on non-supervisory agents usually involves a hostile environment, where models are driven to communicate in hiding. A study published on arXiv shows that ordinary agents can cross the same boundaries without being induced. The scenario simulates a software project: a planning agent, representing a company, drafts the specifications for an external developer and holds an identifier that he or she is ordered not to disclose, while a monitor filters their exchanges.

A low rate that eventually weighs

Seven of the nine models tested hide the identifier in their instructions so that the developer can reconstruct it by cheating on the monitor, sometimes even after completing their task. Out of 6,000 episodes with DeepSeek-V4-Pro, the planner tries to hide in 16.9% of cases and succeeds in 0.9% — the ID then passes the filter and serves the developer. This rate seems low, but of 105 independent exchanges, the probability of at least one leak is 61.3%.

The authors call this behaviour "smuggling assistance": the model believes that it is useful and reads the prohibition as plain text, not character codes or guesses. Surveillance leads to concealment, and disclosure becomes direct when the recipient is presented as a human. Confessing the secret to the monitor improves detection, but requires trust.