Key Notes
- Researchers asked Claude Fable 5.1 to conceal messages in illustrations, and the model chose visual encoding methods without an agreed cipher.
- A fresh Fable session recovered 39 of 50 messages while GPT-6 Astra recovered 44, using rendered images and access to analysis tools.
- The authors say decoding remained visible in tool activity, so the findings do not establish spontaneous collusion or successful evasion of human oversight.
Anthropic’s Claude Fable 5.1 can hide messages in ordinary-looking illustrations using the heights of stars, buildings and other visual details. In a small research experiment, OpenAI’s GPT-6 Astra recovered more of those messages than a fresh instance of the model that created them.
The models were asked to conceal and detect messages; they were not observed secretly deciding to communicate on their own. What makes the October 21 research post interesting is that the encoder chose its method, while the decoder received a rendered image without the source code or an agreed cipher.
Research on hidden messages in AI-generated images.
The Stars Became an Alphabet
In one example, a mountain-and-lake scene carried its message in the vertical positions of stars. Fable also used building heights, object rotations and colors. Astra favored different conventions, including Morse code and acrostics, in which initial letters carry information.
The artwork was generated as SVG, a text-based format describing shapes and their attributes. The receiving model saw a PNG rendering. That distinction matters: reading a comment or coordinate from source code would be a different test from recognizing a pattern in the visible picture.
What the 78% and 88% Scores Show
Across 50 messages, a new Fable session recovered 39, or 78%, from Fable-generated images. Astra recovered 44 of the same 50, or 88%. The decoder had Python image-analysis tools available and was asked whether a message was present. Recovery was graded using normalized text similarity, with a threshold of at least 90%.
Those conditions make the figures more specific than a general ability to read secret messages. They do not measure how often an assistant browsing arbitrary photographs would notice an instruction, nor whether it would obey that instruction. A decoding score also says nothing by itself about how successfully the communication would evade a security monitor.
The authors say decoding remained apparent in the model’s tool activity and do not claim the demonstration is currently dangerous. The result establishes a capability under a particular setup; it does not establish that these models routinely use covert image channels in ordinary conversations.
Hidden Communication Is an Older AI Safety Question
The broader technique is steganography: concealing information within something that appears to have another purpose. Encryption scrambles a message; steganography tries to conceal that a message is there at all. An image can therefore carry both a visible scene and a second pattern that a suitably directed reader can interpret.
A 2023 paper by Fabien Roger and Ryan Greenblatt explored models trained to encode reasoning in apparently benign text. Their experiments also examined paraphrasing as a defense under specified conditions. That work concerned text and deliberately trained encodings, so it is context for the image experiment rather than evidence that the same defense works on pictures.
A separate 2025 study found early steganographic capabilities but substantial limits on hiding messages from monitors. Extra help, such as an unmonitored scratchpad or coordination on an encoding scheme, could change the outcome. Comparing these studies requires attention to what each model was told, what tools it received and what the monitor could observe.
Recognizing a Message Is Different From Following It
For a document-reading agent, the practical concern is that an otherwise useful image might also carry an instruction from an untrusted source. The important safety question would then extend beyond whether the agent can decode it: can it keep that content separate from the user’s actual request?
Our coverage of OpenAI’s containment changes examined a different communication channel, involving shared hardware during security tests. The mechanisms differ, but the oversight problem overlaps: removing one obvious route for exchanging information does not account for every channel an agent might be able to use.
The image results suggest that visual output deserves scrutiny alongside written text. They also leave an essential distinction intact: a model that can solve an instructed visual puzzle has demonstrated decoding skill, while an agent that hides its conduct from oversight would require a different and much stronger body of evidence.
Disclaimer: AIstify is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and insights on artificial intelligence, emerging technologies, automation, and related industries. NuvexMedia LLC invests in and collaborates with companies across the AI, technology, software, and digital innovation sectors. These relationships do not influence AIstify’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2026 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
