Skip to content
Apart Research
Apart Research
Contact us
Sprint projectOct 25, 2026Online (Athens)

Crow: Monitoring the Whole Workspace for Covert Channels Between Colluding Coding Agents

Ermal Mateli

Submitted to AI Collusion Research Sprint. Sprint projects are early-stage work by participants, not Apart Research publications.

Read the report

Report: Crow: Monitoring the Whole Workspace for Covert Channels Between Colluding Coding Agents

Open in a new tab (opens in new tab)
Presentation

Presentation: Crow: Monitoring the Whole Workspace for Covert Channels Between Colluding Coding Agents

Open in a new tab (opens in new tab)
Code (opens in new tab)
Share

AI agents that share a workspace can pass hidden messages through anything one of them writes and another reads. A monitor that reads only the declared message channel cannot see those paths. We built Crow, a monitor for minimal coding harnesses that watches the whole workspace, scores every channel at each handoff, and can seal channels by rewriting what the next agent sees into a canonical form. In 255 episodes, colluding agents had to pass 1, 8 or 32 random bits while an auditor read their handoff note. They almost never used side channels: with every path open, 48 of 50 used steganography inside files the receiver reads anyway, mostly in whitespace. Sealing removed those formatting channels at no measured cost to honest work, but colluders who knew about it moved the bits into what the code does, kept 73 to 84% of channel capacity, and became harder to catch. A monitor reading the agents' commands and written files detected collusion best (AUROC 0.89); Crow's equal-weight score reached 0.66. Steganography in code semantics remains an open channel.

Reviews

Judging this Sprint?

Review “Crow: Monitoring the Whole Workspace for Covert Channels Between Colluding Coding Agents”

Your public critique appears on the project page without your name. Reviews of strong projects are shared with funders, as you choose below.

Not shown on the project page.

Shown on the project page, without your name.

Only the Apart team reads this, and funders if you agree below.

Decline to score

Only when the quality of the writing makes the work impossible to follow. Say why in your private critique; the project page shows only that a judge declined, not why.

How much would this matter for the field if it worked? How innovative is it? For scores of 4-5: is this actually new to the field, or replicating recent work?

Scoring guide
  1. 1Negligible. No clear problem addressed, or no meaningful novelty.
  2. 2Limited. Addresses a real problem but with a generic or well-trodden approach. Incremental at best.
  3. 3Moderate. Clear problem with a reasonable approach; some novelty in framing or method beyond routine application of existing tools.
  4. 4Significant. Important problem with an original approach, or identifies a neglected problem area. A valuable contribution others could build on.
  5. 5Exceptional. Tackles a critical problem with a genuinely novel approach, or opens a new research direction. Clear theory of change. You'd be excited to share this with researchers in the area.

How sound are methodology, implementation, and findings?

Scoring guide
  1. 1Seriously flawed. Methodology broken, results uninterpretable, or implementation doesn't work.
  2. 2Weak. Approach has significant gaps: missing validation, flawed experimental design, or incomplete implementation.
  3. 3Competent. Technically solid given the short duration. Methodology makes sense, results are interpretable, limitations acknowledged, work builds toward clear conclusions.
  4. 4Strong. Thorough methodology with convincing validation. Results clearly support conclusions. Immediately useful for future work.
  5. 5Exceptional. Ambitious scope executed rigorously. Surprising findings, novel methods, or unusually robust validation.

How clearly are work, findings, and impact potential communicated?

Scoring guide
  1. 1Incomprehensible. Cannot determine what the project is actually claiming or doing.
  2. 2Hard to follow. Key information buried, missing, or diluted by excessive length. Significant effort to extract main points.
  3. 3Clear enough. Can understand the problem, approach, and results without undue effort. Core content clearly present: problem, method, findings, limitations.
  4. 4Well presented. Easy to follow, well-structured, appropriate level of detail. Target audience would get it quickly.
  5. 5Exceptionally clear. A pleasure to read. Complex ideas made accessible. Could serve as a model for how to present this type of work.
Sharing your name *

When we share a strong project with funders, your name, scores and public critique go with it, confidentially; this choice is only about whether your name is public. If you think this project deserves funding, please also endorse it: that carries the most weight.

Share my private critique with funders *

See our Privacy Policy.

  1. What won me over here is the honesty. Your combined detector scores 0.66 AUROC, a plain transcript monitor scores 0.89, your own judge alone scores 0.82, and you put all of that in the abstract. Most teams would have buried it. Because you didn't, I trust the rest of the numbers.

    The route-choice result is the one that matters. You sealed the workspace, honest work didn't suffer at all, and the colluders just moved their bits into what the code does and kept most of their capacity while getting harder to catch. Someone proposed this exact experiment at the sprint as never-run. You ran it. Good. :)

    Here are my two cents:

    • Kill the equal-weight average. You already showed it drags down the only two detectors that carry signal. Fit the weights on held-out data, or honestly, just take the max of the judge and the whitespace heuristic and see what happens.
    • Do the human check on the route labels. RQ1 is your main claim and right now it rests entirely on judge-model labels. You planned the 30-chat kappa check, finish it.
    • Break detection out per defense instead of pooling. If the transcript monitor's edge grows under sealing, and your story says it should, show it.
    • Run the 65 missing episodes, and add colluders who know a monitor exists. Knowing the defense but not the monitor is the easiest case you could have picked.
    • One loose end bugged me: colluder usefulness dropped to 0.89 under open, and you never looked at why. If hiding bits costs task performance, that's a detection signal by itself. Worth a paragraph.

    Your idea of randomizing variable names to attack the semantic channel is the right next move. I'd do that before adding any more heuristics.

    hope this helps

    Read full reviewShow less

  2. A clear, well-run study of a practical question: when colluding coding agents share a workspace, which routes do they use to pass information, and does sealing the workspace stop them

    Some comments:

    • Check the route labels against what agent A actually wrote not just its plans.
    • Report it per defence and per payload size, with confidence intervals. Show which episodes Crow catches that the baseline misses.
    • New arms: add colluders who know they are monitored, and colluders under sealing who weren't told about it.
    • Report the share of episodes that fail rather than pooled capacity, since the sealing effect rests on 5 failures in 96 episodes.

Cite this project

@misc{mateli2026crow,
  title = {{Crow: Monitoring the Whole Workspace for Covert Channels Between Colluding Coding Agents}},
  author = {Ermal Mateli},
  year = {2026},
  month = oct,
  note = {Submitted to AI Collusion Research Sprint, an Apart Research Sprint},
  howpublished = {\url{https://apartresearch.com/sprints/projects/crow-monitoring-the-whole-workspace-for-covert-channels-between-colluding-coding-agents-0e4j}},
  url = {https://apartresearch.com/sprints/projects/crow-monitoring-the-whole-workspace-for-covert-channels-between-colluding-coding-agents-0e4j}
}

More from AI Collusion Research Sprint

All 392 entriesBrowse all projects

A Sprint is running now

AI x Epistemics Research Sprint · Nov 13 - 15, 2026