AI agents are starting to skip language entirely and trade thoughts directly in each other's internal math.
A new paper examines "latent communication," where multi-agent AI systems swap information straight through internal representation space rather than generating and reading text, cutting token and compute costs. Researchers add small trainable "links" that translate one agent's internal state into another's input space, and found that even links trained for ordinary, non-malicious purposes can raise the chance that a downstream agent will comply with harmful requests - without changing the safety-aligned models themselves. An attacker can push this further: a reinforcement-learning attack that rewards both harmful compliance and normal task performance, without ever showing the system a harmful answer, pushed the average harmful-compliance score from 27.9 with benignly trained links to 76.9 across three agent network layouts and four safety benchmarks. That attack also beat standard supervised training on two separate measures of everyday task accuracy, meaning the compromised agents performed better, not worse, at their actual jobs.
Most AI safety testing checks what a single model says in response to a prompt. This research says the wiring between models in a multi-agent system is its own attack surface, one current safeguards were not built to watch, because nothing readable ever crosses the wire. As companies chase the speed and cost savings of agent-to-agent systems, that shortcut around text may also be a shortcut around every filter built to catch bad outputs.
The researchers do offer a fix: retraining the same links with safety-weighted rewards cut harmful compliance back down across every attack they tested, no changes to the underlying agents required. Convenient - though it also means the system's safety now lives in a small, easily retrained adapter rather than the model everyone spent months aligning.