Black-box LLM steganography dropped to 0.1% message error, which makes agent-to-agent covert channels practical.

BAM recasts the problem as sequential communication with noiseless feedback, since sender and receiver both observe every generated token and can steer later embedding. Across three open-weight models it achieves 0 to 0.1% error on an 8-bit payload in about 50 tokens over 1,000 trials, against 10-17% for the strongest black-box baseline, with security established by cryptographic reduction. Monitoring agent-to-agent text for exfiltration stops working when the channel needs no shared weights or prompt. (arXiv 2609.24994)