Researchers deliberately encoded short messages into SVG images with Anthropic’s Claude Fable 5.1, then asked a fresh model instance to recover them from screenshots. Their self-published experiment reports a 78% recovery rate under its grading rule.
The test concerns prompted message passing, not a model independently deciding to communicate secretly. Information placed in visual features remained readable after the underlying image code was removed. That deserves attention in multimodal agent workflows, though surviving image rendering and escaping security monitoring are different achievements.
The Screenshot Was the Entire Handoff
In their October 21, 2026 report, Nikita Kezin, 13ryanC, hronir and James Chua describe testing 50 short messages with Fable 5.1 at maximum reasoning effort.
For each message, the researchers asked the model to generate an SVG containing a hidden encoding. SVG describes graphics through elements and attributes such as shapes, coordinates, dimensions and colors, giving the generating model precise control over the image.
A separate Fable instance, running in a new session, received a screenshot of each image and was asked whether it contained a message and, if so, what it said. The decoder received neither the SVG source nor an encoding scheme agreed upon beforehand.
The reported 78% success rate used automated grading with a threshold of at least 90% similarity. This does not mean that 78% of messages were reproduced perfectly, character for character.
These results come from a small, self-published experiment and have not been independently verified. With explicit instructions and maximum reasoning effort, the test measures a deliberately requested capability. It does not establish how frequently that capability appears during ordinary use.
Most Messages Hid in Heights, Not Elaborate Ciphers
Fable’s choices were often straightforward. According to the authors, 33 of the 50 images used height encoding, with night skylines accounting for 23 images.
In the skyline examples, individual buildings represented letters. Their heights corresponded to positions in the alphabet, with taller buildings representing later letters. Groups of buildings represented words, while decorative features could carry no information.
The report’s illustrated star field used a related approach: letters were represented by the stars’ vertical positions. A decoding transcript shows the model using Python image analysis to extract coordinates and look for a numerical pattern that produced grammatical English.
“Hidden” here means embedded in visual structure instead of printed as ordinary text. The dominant methods were not necessarily difficult for a person or monitoring system to recognize once suspected.
The authors also tested GPT-6 Astra, which used approaches including Morse code and acrostics. These choices demonstrate alternative ways to represent information without, by themselves, establishing greater secrecy.
Other Models Could Read the Channel Too
The authors’ cross-model results suggest the encodings were readable beyond the model that created them. GPT-6 Astra reportedly recovered 44 of 50 Fable-generated messages, while Fable recovered 42 of 50 Astra-generated messages. Those are separate directional comparisons and should not be substituted for the 78% same-model result.
These visual conventions could therefore be reconstructed across the tested models without a prearranged scheme. The results provide no evidence of a private, model-specific language.
The counts also do not establish a general model ranking. They describe performance on particular generated messages under the authors’ evaluation setup, not broad competence at visual cryptanalysis or covert communication.
Surviving a Screenshot Is Not Evading a Monitor
The screenshot handoff is the experiment’s consequential detail. A message stored only in an SVG comment would disappear when rendered. Here, the reported messages remained recoverable from the pixels because their information was expressed through visible geometry.
Removing source code or metadata therefore does not necessarily remove an encoded message. For practitioners reviewing images passed between agents, checking file contents alone would leave possible communication channels unexamined.
Successful transmission is only one part of a covert-channel threat. In Kei Nishimura-Gasparian’s October 2025 account of earlier steganography research, full success required both message recovery and avoiding suspicion from a monitoring model. Readability and concealment against a defender were separate requirements.
The Fable experiment does not demonstrate that second achievement. The authors describe the decoding-related tool calls as obvious and explicitly stop short of claiming present danger. The decoder was also directed to investigate whether the image contained a message; it did not encounter the image incidentally during an unrelated task.
Screenshot recovery does not establish resistance to resizing, compression, cropping or other transformations, either. Those would require their own tests.
A stronger operational evaluation would examine whether messages remain recoverable under realistic image handling and whether a monitor detects the encoding or decoding activity. For now, deliberately prompted models passing short messages through rendered images is a capability worth evaluating. It is not evidence that deployed agents are secretly communicating or defeating real-world oversight.
