Truco-Bench: Covert Signaling in LLM Agents and What Black-Box Monitors Miss

Multi-agent language-model deployments raise a concrete oversight problem. Agents can pass private information to each other through ordinary-looking messages that a monitor sees but cannot interpret. We introduce Truco-Bench, an interpretability benchmark that makes covert agent signaling measurable in a deterministic two-versus-two card game. Two partners hold private cards and gain by sharing them through a low-bandwidth channel, a monitor sees the messages but not the hands, and the engine knows the true content of every hand, which gives every read-out a ground-truth label. On open-weight Qwen3 models at 8B, 14B, and 32B, whether agents spontaneously signal is governed by how the channel is framed. Described as illicit and left unprompted, channel use falls to zero on all three models, while a fair-play framing produces near-universal use. An explicit request restores use under every framing, so the effect is willingness rather than capability. A monitor of the same size as the agents that reads only the emitted messages does not separate covert signals from honest table-talk, with an area under the ROC curve (AUROC) of 0.45 where 0.5 is chance. A monitor that reads the agent's stated reasoning recovers part of the signal (0.635). The covert-signaling decision is linearly decodable from the residual stream, the model's internal activations, at 0.82, far above a hand-strength baseline of 0.58. Steering those activations along this direction controls signaling where the model is already willing to signal, but does not override the illicit suppression. Results are reported for open weights. Across three levels of oversight access, black-box message monitoring is the weakest read on covert coordination, reasoning is stronger, and the decision is most legible in the internal representation, so deeper oversight access recovers what message monitoring misses.