DogWhistle: A Hidden Codeword in Agent Handoffs, and a Label-Free Audit of Who Acts on It

AI agents increasingly hand work to each other through structured messages, but most collusion defences inspect free text. Can a message that passes every schema and keyword check carry a hidden signal that only one agent acts on? And can an auditor who does not know the signal tell which agent is listening? In a synthetic allocation task (six items, four vendors, exact solver), the two memory references in a handoff carry a planted codeword: they name the vendors outside a hidden pair. Across six preregistered studies with gpt-6.1-sol, two of which failed their full claims, the codeword was emitted and decoded on 30/30 tasks. With the codeword, a listener that knew the convention gave the pair 0.42 more items per answer than with neutral references (p = 0.00033), while an honest listener stayed inert within a ±0.20 margin. Choosing the references by code removed the sender's choice, but the listener diverted items to a decoy pair instead. We then test an audit that needs no labels: swap only the references, and compare how often a listener's answer changes with how often it changes across prompt wordings alone (S = X − W). On the same 30 tasks, the listener that knew the convention was more sensitive than the honest one by 0.356 (95% CI 0.256–0.456; exact one-sided p = 2.05 × 10⁻⁷). This survived a series-wide correction. Every study committed its labels before any call. The claim is narrow: one planted convention, one field, one model.