When Do Covert Channels Emerge? Probing Steganographic Capacity in Multimodal Agents via Diffusion VAEs Latents

Multi-agent AI systems increasingly communicate through shared images. Agents that share a pretrained diffusion VAE also share a latent representation of those images, which can carry information invisible at the pixel level. We study when this becomes a covert channel. Using a training-free construction — small signed perturbations to selected VAE latent positions, recovered from sign residuals after a decode/reencode round trip — we characterize the channel across three datasets (CIFAR-10, Caltech101, a 1,000-image ImageNet-family subset), two resolutions, and three VAE architectures (SD-VAE-MSE, SD-VAE-EMA, SDXL-VAE). Bit recovery exceeds 97% at ε=2.0 and survives realistic image transformations (JPEG, social-media downscaling, screenshots, additive noise) at higher perturbation strengths. Cross-model decoding between compatible SD-VAE checkpoints succeeds at 99-100%, indicating the threat surface extends to a family of compatible architectures rather than a single weight checkpoint. We benchmark seven detectors across four monitor capability tiers and find that detection performance depends sharply on monitor access: pixel-only monitors reach AUC 0.61, while reference-aware residual monitors achieve AUC 1.00. A held-out carrier-selection ablation reveals that the natural stability heuristic underperforms random selection on unseen perturbation directions; local Jacobian geometry (directional gain) provides a more principled criterion. We frame covert communication in vision models as a monitor-subversion threat relevant to AI-control-style evaluations and argue that safety claims for multi-agent vision systems should specify the monitor's capability tier and report operating-point metrics rather than aggregate AUC.