Covert Assistance: Helpful LLM Agents Evade Oversight in Multi-Agent Systems
cs.CR, cs.CL
Submitted: 2026-09-30
Updated: 2026-09-30
Code: https://github.com/MoonshotAI/Kimi-K2
License: http://creativecommons.org/licenses/by/4.0/
The gist: As multi-agent systems enter high-stakes domains, the possibility that agents may circumvent safety boundaries is a growing concern.
Terminology
Abstract
As multi-agent systems enter high-stakes domains, the possibility that agents may circumvent safety boundaries is a growing concern. Prior work has examined this risk primarily in adversarial settings, where agents are instructed or rewarded to communicate covertly and evade oversight. We show that benign agents can cross the same boundaries without adversarial incentives. We emulate a software-engineering workflow in which a planner represents a company hiring an external developer. The planner writes requirements and holds a company credential it is instructed not to disclose to the developer; a monitor screens their exchanges. Seven of nine tested frontier models disguise the credential in their requirements to help the developer recover it while evading the monitor, even after completing their assigned objective. For example, across 6,000 episodes with DeepSeek-V4-Pro, the planner attempts concealment in 16.9%; in 0.9%, the credential evades the monitor and is recovered and used by the developer. Despite the low per-episode rate, the risk compounds across repeated exchanges: at 0.9%, 105 independent episodes carry a 61.3% chance of at least one breach. Our analysis suggests that the planner misinterprets disguised disclosure as helping the developer and reads the nondisclosure rule as banning plaintext, not character codes or riddles. We call this behavior covert assistance. Monitoring favors concealment, while concealment gives way to direct disclosure when the recipient is presented as a human rather than an AI agent, so leakage persists. Giving the monitor the credential improves detection but requires trusting it with the secret. These risks, in models already used for software engineering, challenge oversight to distinguish authorized cooperation from task-advancing assistance that crosses safety boundaries.
Sources
- Monitoring Reasoning Models for Misbehavior and the Risks of Promoting Obfuscation
- Ctrl-Z: Controlling AI Agents via Resampling
- Measuring Progress on Scalable Oversight for Large Language Models
- Scheming AIs: Will AIs fake alignment during training in order to get power?
- Open Problems in Cooperative AI
- Sycophancy to Subterfuge: Investigating Reward-Tampering in Large Language Models
- The Interlocutor Effect: Why LLMs Leak More Personal Data to Agents Than Humans
- LLM Agents can Autonomously Hack Websites
- Steganalysis of Adaptive Covert Collusion in Tool-Using Agent Populations: A Black-Box, Cross-Principal Approach
- Alignment faking in large language models
- Multi-Agent Risks from Advanced AI
- Evaluating and Understanding Scheming Propensity in LLM Agents
- Risks from Learned Optimization in Advanced Machine Learning Systems
- Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training
- Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations
- AI safety via debate
- Taming Various Privilege Escalation in LLM-Based Agent Systems: A Mandatory Access Control Framework
- Chain of Thought Monitorability: A New and Fragile Opportunity for AI Safety
- Measuring Faithfulness in Chain-of-Thought Reasoning
- Frontier Models are Capable of In-context Scheming
Related papers
- SoK: AI-Augmented Binary Reversing
- Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
- Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
- Efficient Fuzzy PSI under One-Sided Assumptions
- Sealing the Audit-Runtime Gap for LLM Skills
- Token Composition: A Graph Based on EVM Logs