When Do Covert Channels Emerge? Probing Steganographic Capacity in Multimodal Agents via Diffusion VAE Latents

Multi-agent AI systems increasingly communicate through shared images, raising concerns about covert communication channels that may not be apparent from pixel-level monitors or human auditors. We study this risk using a training-free construction that perturbs diffusion VAE latents and tests whether the signal survives a decode--reencode round trip. We structure this as an adversarial evaluation, probing covert channel capacity under shared model assumptions, and benchmarking monitoring regimes that reflect realistic monitor setups for multi-agent image transmission. Across CIFAR-10, Caltech101, and a 1{,}000-image ImageNet-family subset, and across 3 VAE architectures, our perturbations are reliably recoverable with $>97\%$ bit accuracy at $\epsilon=2.0$, and the channel survives realistic image transformations at higher perturbation strengths. We evaluate detectability under multiple monitoring regimes, finding that detection performance depends strongly on monitor capability, ranging from near-chance for pixel-only monitors to near-perfect for reference-aware detectors. These results suggest that covert communication in vision models is a monitor-subversion threat relevant to AI-control-style evaluations, and that evaluations of multi-agent vision coordination should explicitly stress-test monitoring capability.