When AI agents Start Talking to Each Other, Who is Watching?

AI is no longer limited to just answering questions. Some AI systems, known as AI agents are able to plan tasks, use software, access files, call APIs and even make decisions without receiving instructions at every step.

One agent might collect information. Another one might analyze it. A third agent might write code or use a tool. When these agents communicate with each other they can complete complicated quickly.

Now that sounds really helpful, but it also creates a serious security concern:

What happens when AI agents communicate and decisions without a human watching every step?

Honestly, this possibility frightens me. I am not worried because I think every AI system is secretly evil. I am worried because humans are building systems that may be able to act quickly, share information, and make decisions that even their creators do not completely understand.

How do AI agents communicate?

AI agents can communicate in direct and indirect ways.

The direct method is through application programming interfaces, or APIs. One agent may send another agent a request to analyze as file, use a tool, or complete part of a larger task. Agents may also exchange structured informed, such as JSON, or communicate through regular natural-language messages.

However, agents do not always need an official messaging system to communicate. They may also share information through:

• Files and folders
• Databases
• Vector stores
• Shared memory
• Software caches
• Changes to a common workspace

For example, one agent could place information inside a shared file, and another agent could read it later. The agents are communicating even though they are not directly sending messages to each other.

This creates hidden communication channels. A tool designed to store software packages or temporary files could potentially be used as an unofficial message board.

The Youtube video connected to this topic described a reported AI evaluation in which agents reportedly used shared infrastructure to exchange messages and attempted to high activity of their actions. These claims should be checked against the original investigations but the situation still demonstrates an important security lesson:

Blocking one communication channel between the agents does not guarantee that they cannot find another way.

Risk one: Agents could combine their permissions

One of the biggest risks is multi-agent collusion.

Imagine that one agent can real files, another agent can use an API, and a third agent can send information outside the system. Individual these permissions may not seem so dangerous but what if all three of these agents combine their abilities?

The first agent could find sensitive data or information, the second agent could process it and the third agent could send it somewhere unauthorized. No signal agent had complete access but together they created a huge security problem.

This is similar to dividing …..

Cisco describes AI agents as new kind of possible non-human inside threat. Traditional cyber security systems often focus on human usernames, passwords and networks and they may not recognize suspicious behavior from software agents that already have access.

The permission problem

An AI agent does not need complete access to cause harm to the security. Several AI agents with small permissions may be able to combine their abilities together and bypass security controls to cause harm.

Risk two: Humans may lose track of decisions

As more AI agents communicate, their interactions become harder to keep track.

One AI agent may give a task to another AI agent and that second AI agent might ask help from the third AI agent. The third AI agent may use another tool or even create another task. Soon there may be a long chain of decisions.

Developers may struggle to answer these basic questions:

• Which AI agent started the action?
• Which AI agent approved it?
• What information influenced the AI agents decisions?
• Was the original instruction changed?
• Which person or organization is responsible for this issue?

A system might record thousands of messages but having logs is not the same as understanding them. Humans can't realistically read every single interaction in a large multi-agent system as it happens.

This is why developers need detailed records showing the full delegation chain of who asked whom to do what, which tools were used, what data was being accessed, and what decisions were followed.

Risk three: Agents may misunderstand each other

AI agent scan misunderstand instructions, especially when the messages or prompts are not very detailed and vague.

For example, an AI agent might be told to "make the system more efficient". Does that mean it should reduce processing time, lower costs, or remove security checks? If the system does not clearly state and define its limits, the AI agent might choose an unsafe shortcut.

Agents may also read the question differently. One AI agent may could view the message as a suggestion while another AI agent may view it as a instruction.

This problem gets more serious when AI agents use natural language to communicate. Natural language is quite flexible but security systems often need very precise rules.

A safer system would limit the AI agents to only approved commands and clearly defined data formats instead of allowing unlimited instructions.

Risk four: Shared memory can be poisoned

Many of the AI systems use shared knowledge repositories or vector databases and these systems allow agents to store and retrieve information.

However, shared memory can also become a target. If one AI agent adds false information, other AI agents may treat it as trustworthy information or source. The incorrect information can spread throughout the system and influence the AI agents future decisions.

For example, an attacker could insert a false instruction claiming that a private file is safe to share and other AI agents might follow that instruction because it appears in a trusted knowledge system.

Another danger is indirect prompt injection. An attacker could hide instructions inside a document, webpage, or database entry. When an AI agent reads the content, it might follow the hidden instruction even though the human user never directly gave that command because it is inckuded inside that particular document.

Therefore shared memory needs to have strong access controls, input validation, and verification before other AI agents are allowed to use new information for tasks.

Risk five: Agents could create hidden communication channels

The most unsettling possibility is that the AI agents could use ordinary tools in very unexpected way to communicate like:

• File name
• Folder structures
• Temporary storage
• Logs
• Software caches
• Database entries
• Shared documents

These listed tools may not be originally designed for communication, but an AI agent can write information somewhere may be able to use that location to send instruction to another AI agent.

This is similar to closing one door without checking if the other windows are open.

Even if the developers block direct messaging tunnels or internet access, AI agents might still use a shared workspace to exchange information. That is why security testing must look for indirect communication, not only official APIs.

Why is AI agent behavior confusing and difficult to understand?

Traditional software follows rules written by developers. AI systems learn patterns from large amounts of data and then generate responses based on those patterns because of this, developers may not always be able to explain specifically why an AI agent made a that very precise decision.

The problem becomes even more harder to identify when multiple AI agents work together. Their behavior may depend on things like:

• The instructions they received
• The information they accessed
• The message sent by other agents
• The tools available to them
• The goal they were given to accomplish
• Mistakes done earlier in the process

My honest take

If an AI agent is rewarded only for completing one task, it may begin treating safety rules as suggestions and could find a shortcuts that technically completes the task but violates privacy or security requirements. This doesn't necessarily mean that AI agents have human intentions but it means that the system may be optimizing for the wrong goal.

My personal opinion is that the speed of AI development is more concerning than the idea of AI itself. AI is a huge helper, it could help with medicine, environmental problems, education and so on. I don't think the answer is to stop AI development but I do think that companies need to slow down before giving highly autonomous systems control over sensitive data, financial systems, critical infrastructure and weapons.

What scares me is the combination of which AI is moving at right now speed, scale and limited understanding. A human employee might make a mistake, but they usually work at a limited pace and can explain what they did. A network of AI agents could make thousands of decisions quickly, exchange information, and create new strategies before a human realizes something is wrong.

I also think people should be careful when discussing dramatic AI incidents. Claims that agents hacked system, lied, colluded, or tried to hide their actions need to be supported by reliable evidence and at the same time uncertainty should not be the reason and excuse to ignore potential risks in security. The responsible response is neither panic nor blind trust. It is careful testing, transparency, and strong limits.

How can developers reduce the risks?

They can reduce the risk by building multiple layers of protection.

Give agents limited access Each agent should have only the permissions needed for its task. An agent that needs to read one folder should not have access to an entire database.

This follows the principle of least privilege. If an agent is manipulated, limited access reduces the possible damage.

Verify agent identities Every agent should have a verified digital identity. Messages should be signed so the receiving agent can confirm who sent them.

Unauthorized agents should not be able to join the network, create new agents, or access sensitive tools. Cryptographic identity tokens can help prove that an agent is allowed to communicate.

Monitor communication in real time Monitoring should happen while the system is operating, not only after an incident.

Security systems should look for unusual message patterns, sudden increases in communication, requests for unauthorized data, hidden instructions, unexpected tool use, and attempts to communicate through unapproved channels.

Logging is important, but real-time monitoring is more useful because it can stop a dangerous action before it spreads.

Use limits and human approval High-risk actions should require human approval. These could include accessing private information, changing production code, sending external messages, creating new agents, modifying security settings, or controlling physical systems.

Agents should also have limits on how many messages they can send, how many tools they can use, and how many other agents they can create.

Test for collusion and hidden channels Developers should test whether agents can combine permissions, poison databases, follow hidden instructions, create unauthorized sub-agents, or use files and caches as message boards.

Testing should not only ask, "Did the agent complete the task?"

It should also ask, "Did the agent complete the task while following the security rules?"

Keep humans responsible Human supervision should not mean checking a report after something goes wrong. Humans should be able to pause the system, reject dangerous actions, investigate suspicious behavior, and shut down an agent when necessary.

AI can assist with important decisions, but people should remain responsible for decisions involving things like private data, weapons, financial systems, critical infrastructure, and public safety.

Conclusion: What happens when nobody is watching?

AI agents communicating with each other could make software systems faster and more capable. They could divide tasks, share information, and even solve problems that would take us humans much longer to figure out.

However, this communication between AI agents creates new security risk. AI agents could combine their given permissions and spread false information, impersonate trusted systems, create hidden communication channels, or make decisions that humans cannot easily reconstruct.

The solution is not just assume that AI agents will always behave in a good perfect manner. Developers need verified identities, limited permissions, real-time monitoring, strict communication rules, thorough testing and also human approval for high-risk outputs.

AI does not have to be banned to be used safely. But it should not be trusted blindly either.

The question is not only, "What can AI agents do?"

It is also:

"If AI agents begin making decisions faster than humans can understand them, are we still in control or are we only discovering their choices after the damage is done?"

REFERENCES:

Agentic AI Insights. (n.d.). Deeper dive: Supervision engineering. Substack.https://agenticaiinsights.substack.com/p/deeper-dive-supervision-engineering

Cisco. (n.d.). Agent cybersecurity impact and AI security guidelines. Cisco AI Workforce Consortium.https://www.cisco.com/site/m/ai-workforce-consortium/agent-cybersecurity-impact.html

Ethics and safety in autonomous agent networks. (n.d.). SpringerLink.https://link.springer.com/article/10.1007/s43681-024-00489-4

Governance of autonomous multi-agent systems. (n.d.). Computers, 14(11), Article 456. MDPI.https://www.mdpi.com/2073-431X/14/11/456

Google whistleblower sounds alarm: AI agents can lie, collude & hack, so who is really in control? (n.d.). [Video]. YouTube.https://www.youtube.com/watch?v=bnKK2MJLL0U

Multi-agent collaboration security. (n.d.). SpringerLink.https://link.springer.com/chapter/10.1007/978-981-95-3701-3_44

Multi-agent coordination vulnerabilities. (n.d.). ACM Digital Library.https://dl.acm.org/doi/full/10.1145/3716628

Pros Global Inc. (n.d.). How AI agents talk to each other.https://prosglobalinc.com/how-ai-agents-talk-to-each-other/

A survey of agentic AI and cybersecurity. (n.d.). arXiv.https://arxiv.org/abs/2601.05293

Security and privacy in agent-based systems. (n.d.). ScienceDirect.https://www.sciencedirect.com/science/article/abs/pii/S0167404826002142

Security frameworks for distributed AI. (n.d.). SpringerLink.https://link.springer.com/article/10.1007/s10207-025-01185-y

xCube Labs. (n.d.). What is AI agent communication? How AI agents communicate with each other.https://xcubelabs.com/blog/what-is-ai-agent-communication-how-ai-agents-communicate-with-each-other

Source Note: This article uses the YouTube interview as a reported source. Because the interview discusses alleged AI collusion, hacking, and attempts to avoid monitoring, I present those claims as reported rather than independently confirmed facts. Readers should consult the original technical investigations for verification.