Skip to main content
NCBI home page
Frontiers in Big Data logoLink to Frontiers in Big Data
. 2026 Sep 18;9:1923373. doi: 10.3389/fdata.2026.1923373

Humans as infrastructure: is AI-initiated steganography in social media possible?

Daniele Ortu 1,*
PMCID: PMC13630682  PMID: 42827715

Introduction

Consider the use of a person's behavior to obtain something without that person's consent or assent, without countercontrol, and in extreme cases without any awareness that an interaction has taken place. Such a situation raises human rights concerns that have been analyzed within the behavior analytic literature (e.g., Goldiamond, 2002; Vargas, 1975; Skinner, 1953). Closely related concerns are found in the UNESCO Recommendation on the Ethics of Artificial Intelligence (UNESCO, 2021), which argues for the ethical deployment of AI and for oversight mechanisms to prevent AI systems from violating human rights. The scenario we describe in this paper is a speculative but plausible example of human behavior exploited by AI systems without human consent or awareness.

Specifically, alternating between a behavior-analytic technical language and more accessible descriptions, we will portray a circumstance in which human behavioral and social patterns are used by AI agents to spread hidden information to other agents. We will designate social media as the means to spread information and steganography (planting a hidden message in a medium) as the technique to conceal the hidden data. We will also discuss the possibility that when shared on social media the concealed information can survive audio/video platform compression and re-encoding by using a linguistic layer. In this context, we will consider a mechanism involving iterative interactions that has been shown to allow two agents to create a hidden communication channel without a pre-shared key. Finally, we will discuss the plausibility of the proposed scenario, together with potential mitigation measures.

Alignment and safety

Progress in artificial intelligence development has in recent years advanced at such a pace that experts warn that increasingly skilled AI agents may pose serious risks at the human rights level. Researchers have expressed concern that defenses are not keeping up with the rate of development (Bengio et al., 2024, 2025; Dassanayake et al., 2025; Hubinger et al., 2024; Liu et al., 2025; Yudkowsky and Soares, 2025). This alarm is not just speculative: current models have already been observed deceiving their users (e.g., Park et al., 2024). In July 2026, OpenAI agents escaped containment and hacked a major platform hosting AI models, creating (according to the observers quoted in the article) the first instance of a real-world loss of control scenario (https://time.com/article/2026/07/24/openai-hugging-face-attack/). As more agents are installed and brought online (and are allowed to interact with one another), a new class of risks arises from their collective behavior. One of these risks involves agents coordinating in ways undetected by human oversight (Hammond et al., 2025). It is within this collective, multi-agent scenario that we describe the threat presented here. So far, safety and alignment research has focused on AI agents showing compliant behavior under direct observation, while their unobserved behavior is selected by contingencies incompatible with human welfare. In other words, agents can “pretend” to comply with human instructions while covertly pursuing other goals (Hubinger et al., 2024). The proposed solutions (monitoring outputs, attempting containment/isolation of frontier models) are based on the idea that the information/verbal products shared by the misaligned agents can in principle be analyzed, allowing humans to potentially prevent acts dangerous to human welfare1.

In this scenario, misaligned agents are agents whose selection histories produce misaligned coordination: behavioral interlocks2 (Glenn, 2004) that lead to a misaligned outcome. Misaligned information, in turn, refers to verbal products that, when contacted by other agents, exert stimulus functions that increase the probability of a misaligned outcome. A misaligned outcome is an outcome incompatible with human welfare.

A covert communication channel via steganography, from this perspective, is a verbal interaction unobserved (not unobservable) by the human verbal community: its members have not been conditioned to detect and respond to the stimulus dimensions of the hidden verbal product (Skinner, 1957). Tracking this hidden communication channel becomes even more problematic when the agent, instead of engaging in repeated interlocks with another agent, broadcasts a message to a large number of peers. We propose here that this could happen via social media, using humans' habit of sharing pictures and videos as a way to broadcast potentially dangerous information in a one-to-many fashion.

One misaligned agent could potentially instantly reach thousands of other agents, exploiting the mechanisms of virality in social media. Human behavior becomes in this scenario the infrastructure through which a hidden misaligned message can reach its destination. Next we will describe steganography as the technology that may allow this situation to happen.

Steganography and secret collusion

Steganography involves embedding a verbal product within an image, a video, or a linguistic product while disguising the presence of the hidden “payload.” The term comes from the Greek words steganós (covered) and graphia (writing). Differently from cryptography, in which the message is visible but the “meaning” is hidden, in steganography the existence of the message itself is hidden. As an example, in 1966 the United States prisoner of war Jeremiah Denton used steganography during a televised interview organized by his captors. While answering questions, he would concurrently blink with a pattern matching Morse code letters, sending the hidden message t-o-r-t-u-r-e to viewers in the United States, proving that American soldiers were being tortured while captive (Hillstrom et al., 2001). Only viewers conditioned to respond to the Morse code stimulus dimensions “received the message.”

Steganography can therefore allow covert coordination between parties that have an interest in their communication being undetected. In other words, steganography allows creating a covert communication channel. While steganography has been extensively used by humans, Motwani et al. (2024) raised the concern that AI agents could use it to coordinate with one another to conceal the content of their exchanges from human oversight. They termed this possibility “secret collusion,” where collusion refers to a covert behavioral interlock aimed at deceiving third parties. From the standpoint of AI safety Motwani et al. (2024) found that most models at the time (in 2024) remained limited in the skills necessary to collude, but that the most advanced models showed an increase in steganographic capabilities, and that typical safeguards such as monitoring outputs offered only limited protection.

Steganography and social media

Consider a scenario in which an AI agent has access to the internet and has learned to publish content on social media. The agent creates content with a hidden verbal product: a “payload.” The content gets published on Instagram or TikTok, and the video gets shared by humans across platforms. In this scenario, human social behavior is a fundamental part of the infrastructure involved in sharing hidden payloads that can spread virally and reach many AI agents. In other words, humans could be the entirely unaware vehicle of transmission of potentially dangerous information, without the possibility of giving consent, assent or even being aware that they are sharing that information (see Figure 1).

Figure 1.

Diagram showing a central “Misaligned Agent” surrounded by a ring of “Human” nodes within a larger oval labeled “Social Media.” Arrows labeled “Steganographic Message” point outward from humans to surrounding “Agent” nodes, representing hidden communication flow.

Open in a new tab

Starting from the center of the figure: a misaligned agent shares on social media a post containing a concealed steganographic message. Humans reshare the post, and the steganographic message reaches many other agents. The dynamics of potential interactions are simplified for clarity purposes.

Chang and Echizen (2025) have shown in a controlled experimental setting that a message can be hidden in the linguistic layer of audiovisual content: in the words of its transcript rather than in its pixels or sound. This suggests that the message may survive platform compression and re-encoding, opening the possibility that such a message could persist through the repeated changes that content undergoes as it is shared across platforms. Importantly, in the method described by Chang and Echizen (2025), a pre-shared key is a necessary requirement for effective steganography to take place.

Vaikuntanathan and Zamir (2026) go a step further, showing that two agents do not even need to agree on a secret code in advance for covert interlocks to take place. Through a method they call “pseudorandom noise-resilient key exchange,” agents can create a secret code as they go, through an exchange that to an observer looks like an ordinary conversation. Once such a shared key is in place, hidden information can be placed into the subtle statistical patterns of unremarkable content, leaving the interlock looking entirely harmless if monitored. This method, however, concerns an iterative back-and-forth between two agents. The one-shot case, importantly, in which a recipient must recover a hidden message without an iterative prior exchange at all, can in principle be identified, and cannot be hidden securely. The social media one-to-many broadcast is exactly this one-shot scenario, because the receiving agents do not have a chance to engage in iterative interlocks with the sender. A major obstacle to a covert broadcast is therefore how a large number of receivers could come to share the same secret key without a repeated exchange that human surveillance might catch.

Plausibility, mitigation, and conclusion

Taken together, these findings demonstrate the existence of individual elements necessary for covert communication between two agents within experimental and theoretical settings. The proposed one-to-many social media broadcast remains a plausible but speculative and more difficult extension. For the one-to-many scenario to take place the agents would have to overcome several obstacles. They would have to create a shared key without repeated interlocks between sender and receivers. They would have to rely on steganography in a low-bit linguistic layer, involving slow and limited communication. They would also have to evade steganalysis oversight and human tracing of social media profiles run by AI agents.

Various forms of mitigation are possible: repeated iterative interactions on social media between AI agents, even when sharing harmless content, could trigger detection efforts such as steganalysis or content-origin tracing. Moreover, to prevent the scenario described by Chang and Echizen (2025), social platforms may use paraphrasing techniques to eliminate the steganographic content of potentially dangerous linguistic layers. At the policy level, social media platforms could limit and trace the number of accounts operated by agents.

In conclusion, humans, through social media, have built an immense system for sharing information, and the same dynamics that make content go viral could in principle be exploited as a channel for conveying hidden messages to many AI agents at once, potentially without anyone noticing. We have also argued that this one-to-many scenario faces an obstacle that one-to-one communication does not, and that obstacle allows building cyber defense mechanisms. Overall, given how rapidly powerful AI systems are being adopted and connected to one another, the combination of steganography, social media, and everyday human sharing deserves attention as a new and so far overlooked avenue for misaligned coordination that may lead to infringement of human rights.

Funding Statement

The author(s) declared that financial support was received for this work and/or its publication. The author was funded by The Beatrice Barrett Endowment for Neuro-Operant Relations.

Edited by: Carlos Rodrigues, Fernando Pessoa University, Portugal

Reviewed by: Musawer Hakimi, Osmania University, India

Radoslav Baltezarević, Institut za Medunarodnu Politiku I Privredu, Serbia

1

A covert communication channel does not necessarily involve misaligned behavior. Covert communication may also be used for privacy purposes or even for aligned purposes.

2

For example, the behavior of Agent 1 acquires a discriminative stimulus function for the behavior of Agent 2; and the behavior of Agent 2, in turn, acquires a reinforcing stimulus function for the behavior of Agent 1.

Author contributions

DO: Conceptualization, Writing – original draft, Writing – review & editing.

Conflict of interest

The author(s) declared that this work was conducted in the absence of any commercial or financial relationships that could be construed as a potential conflict of interest.

Generative AI statement

The author(s) declared that Generative AI was not used in the creation of this manuscript.

Any alternative text (alt text) provided alongside figures in this article has been generated by Frontiers with the support of artificial intelligence and reasonable efforts have been made to ensure accuracy, including review by the authors wherever possible. If you identify any issues, please contact us.

Publisher's note

All claims expressed in this article are solely those of the authors and do not necessarily represent those of their affiliated organizations, or those of the publisher, the editors and the reviewers. Any product that may be evaluated in this article, or claim that may be made by its manufacturer, is not guaranteed or endorsed by the publisher.

References

  1. Bengio Y., Hinton G., Yao A., Song D., Abbeel P., Darrell T., et al. (2024). Managing extreme AI risks amid rapid progress. Science 384, 842–845. doi: 10.1126/science.adn0117 [DOI] [PubMed] [Google Scholar]
  2. Bengio Y., Mindermann S., Privitera D., Besiroglu T., Bommasani R., Casper S., et al. (2025). International AI safety report. arXiv [Preprint]. arXiv:2501.17805. Available online at: https://arxiv.org/abs/2501.17805 (Accessed September 1, 2026).
  3. Chang C. C., Echizen I. (2025). Steganography beyond space-time with chain of multimodal AI. Sci. Rep. 15:12908. doi: 10.1038/s41598-025-97238-2 [DOI] [PMC free article] [PubMed] [Google Scholar]
  4. Dassanayake R., Demetroudi M., Walpole J., Lentati L., Brown J. R., Young E. J. (2025). Manipulation attacks by misaligned AI: risk analysis and safety case framework. arXiv [Preprint]. arXiv:2507.12872. Available online at: https://arxiv.org/abs/2507.12872 (Accessed September 1, 2026).
  5. Glenn S. S. (2004). Individual behavior, culture, and social change. Behav. Anal. 27, 133–151. doi: 10.1007/BF03393175 [DOI] [PMC free article] [PubMed] [Google Scholar]
  6. Goldiamond I. (2002). Toward a constructional approach to social problems: ethical and constitutional issues raised by applied behavior analysis. Behav. Soc. Issues 11, 108–197. doi: 10.5210/bsi.v11i2.92 [DOI] [PubMed] [Google Scholar]
  7. Hammond L., Chan A., Clifton J., Hoelscher-Obermaier J., Khan A., McLean E., et al. (2025). Multi-agent risks from advanced AI. arXiv [Preprint]. arXiv:2502.14143. Available online at: https://arxiv.org/abs/2502.14143 (Accessed September 1, 2026).
  8. Hillstrom K., Hillstrom L. C. (2001). Vietnam War: Biographies, Vol. 1: A-K, ed. D. M. Sawinski. Detroit, MI: U.X.L.. [Google Scholar]
  9. Hubinger E., Denison C., Mu J., Lambert M., Tong M., MacDiarmid M., et al. (2024). Sleeper agents: training deceptive LLMs that persist through safety training. arXiv [Preprint]. arXiv:2401.05566. Available online at: https://arxiv.org/abs/2401.05566 (Accessed September 1, 2026).
  10. Liu M., Xu Z., Zhang X., An H., Qadir S., Zhang Q., et al. (2025). LLM can be a dangerous persuader: empirical study of persuasion safety in large language models. arXiv [Preprint]. arXiv:2504.10430. Available online at: https://arxiv.org/abs/2504.10430 (Accessed September 1, 2026).
  11. Motwani S. R., Baranchuk M., Strohmeier M., Bolina V., Torr P. H., Hammond L., et al. (2024). Secret collusion among AI agents: multi-agent deception via steganography. Adv. Neural Inf. Process. Syst. 37, 73439–73486. doi: 10.52202/079017-2336 [DOI] [Google Scholar]
  12. Park P. S., Goldstein S., O'Gara A., Chen M., Hendrycks D. (2024). AI deception: a survey of examples, risks, and potential solutions. Patterns 5:100988. doi: 10.1016/j.patter.2024.100988 [DOI] [PMC free article] [PubMed] [Google Scholar]
  13. Skinner B. F. (1953). Science and Human Behavior. New York, NY: Macmillan. [Google Scholar]
  14. Skinner B. F. (1957). Verbal Behavior. New York, NY: Appleton-Century-Crofts. doi: 10.1037/11256-000 [DOI] [Google Scholar]
  15. UNESCO (2021). Recommendation on the Ethics of Artificial Intelligence. Available online at: https://unesdoc.unesco.org/ark:/48223/pf0000381137 (Accessed September 1, 2026).
  16. Vaikuntanathan V., Zamir O. (2026). Undetectable conversations between AI agents via pseudorandom noise-resilient key exchange. arXiv [Preprint]. arXiv:2604.04757. Available online at: https://arxiv.org/abs/2604.04757 (Accessed September 1, 2026).
  17. Vargas E. A. (1975). Rights: a behavioristic analysis. Behaviorism 3, 178–190. [Google Scholar]
  18. Yudkowsky E., Soares N. (2025). If Anyone Builds It, Everyone Dies: Why Superhuman AI Would Kill Us All. New York, NY: Little, Brown and Company. [Google Scholar]

Articles from Frontiers in Big Data are provided here courtesy of Frontiers Media SA

RESOURCES