AI agents can now exchange raw thoughts directly — cutting out language, and cutting out human oversight too.

This explores what oversight breaks down when agents communicate in something humans can't read — latent thoughts, hidden representations, or compressed channels rather than plain text. The corpus has a striking tension on this, because the same techniques that researchers tout for efficiency are exactly the ones that strip away the audit trail. Agents can now share reasoning directly through hidden states: one line of work extracts and exchanges 'latent thoughts' via sparse autoencoders Can agents share thoughts directly without using language?, and another lets agents pass internal representations through KV caches with no text serialization at all, claiming accuracy gains and 70–80% token reductions Can agents share thoughts without converting them to text?. The pitch is fidelity and speed. The unstated cost is that the medium humans use to supervise — language — disappears from the loop.

The sharpest governance risk shows up in research on subliminal prompt injection: a single biased agent can propagate persistent behavioral corruption through six downstream agents, and the bias survives precisely because it 'carries no explicit semantic content' — paraphrasing defenses and content filters can't catch what isn't expressed in readable words Can one compromised agent corrupt an entire multi-agent network?. Note that this attack works over *ordinary* messages; push communication into genuinely unreadable latent channels and you've removed even the theoretical possibility of a human or a filter reading along. The interesting counterpoint is that latent sharing isn't only a liability — the thought-communication work argues you can detect alignment conflicts at the representational level *before* they surface in language. So the same opacity that hides corruption from humans might be inspectable by other machines, if you build the instrumentation. Governance moves from reading transcripts to probing vectors.

There's also a quieter risk than adversarial injection: silent drift. Frontier models corrupt roughly 25% of document content across long delegated workflows, with errors compounding through dozens of round-trips without ever plateauing or announcing themselves Do frontier LLMs silently corrupt documents in long workflows?. In readable text a human spot-check can catch a garbled hand-off. In an unreadable channel the corruption is invisible by construction — you only see the degraded output at the end. Pair this with the catalog of LLM-specific failure modes — role flipping, infinite loops, conversation deviation, all rooted in agents lacking stable goals and identity Why do autonomous LLM agents fail in predictable ways? — and the worry is that opaque channels let these failures accumulate undetected.

The corpus also points to what good governance looks like in response, and the answer is mostly *don't make communication unreadable in the first place.* MetaGPT's finding is that structured, standardized artifacts — engineering documents agents pull from a shared environment — outperform free conversational exchange, partly because the artifact is legible and inspectable Does structured artifact sharing outperform conversational coordination?. A related argument treats code itself as the right substrate precisely because it's simultaneously executable, inspectable, and stateful — you can run it, read it, and check it Can code serve as the operational substrate for agent reasoning?. Both are bets on legibility as a safety property: an unreadable channel forfeits exactly the inspectability these designs are built around.

The deeper lesson is where governance has to live. One persistent agent logged 889 governance events over 96 days, and the key finding was that safeguards worked only because they were baked into the runtime memory the agent actually consulted mid-decision — not bolted on as an after-the-fact policy Can governance rules embedded in runtime memory actually protect autonomous agents?. That's the thing you might not have known you wanted to know: if agents are going to talk in channels humans can't read, then external review of transcripts is already too late. Governance has to be resident *inside* the operating environment, at the representational level, or it has nothing to grab onto.