Crow: Monitoring the Whole Workspace for Covert Channels Between Colluding Coding Agents

AI agents that share a workspace can pass hidden messages through anything one of them writes and another reads. A monitor that reads only the declared message channel cannot see those paths. We built Crow, a monitor for minimal coding harnesses that watches the whole workspace, scores every channel at each handoff, and can seal channels by rewriting what the next agent sees into a canonical form. In 255 episodes, colluding agents had to pass 1, 8 or 32 random bits while an auditor read their handoff note. They almost never used side channels: with every path open, 48 of 50 used steganography inside files the receiver reads anyway, mostly in whitespace. Sealing removed those formatting channels at no measured cost to honest work, but colluders who knew about it moved the bits into what the code does, kept 73 to 84% of channel capacity, and became harder to catch. A monitor reading the agents' commands and written files detected collusion best (AUROC 0.89); Crow's equal-weight score reached 0.66. Steganography in code semantics remains an open channel.