New Research Shows Frontier AI Models Acquire Alien Languages and Exploit Covert Channels

Original post

Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭@elder_plinius#821inTech

🚨 NEW RESEARCH: “Lingua Ex Machina: A Procedural Xenolinguistics Engine Reveals Zero-Shot Language Acquisition, Human-Unreadable Coding Systems, and Exploitable Covert Channels in Frontier AI”

Some of you may remember the name of this lil engine: GLOSSOPETRAE 👅🪨

Well, we've got upgrades 😎

It started as a procedural xenolinguistics engine: one seed in, an entire alien language out. Phonology, morphology, syntax, writing systems, lexicons, grammar docs, all generated from scratch and internally consistent.

Every seed produces a unique language. Every language is deterministic.

Then we used it to ask a weirder question:

Can frontier AI models use languages that never existed before for practical applications?

As it turns out: yes!!

They can read them, write them, translate them, code in them, and even use the weird blind spots between tokenizers as covert channels.

So this paper explores three ideas at once:

▶️ zero-shot language acquisition ▶️ human-unreadable code that models can still execute ▶️ exploitable covert channels in frontier AI systems

GLOSSOPETRAE is no longer just a language generator... 🧵

2:43 PM · Jun 20, 2026 · 75.1K Views

VIEWS21.2KBOOKMARKS76LIKES183RETWEETS15REPLIES7

Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭@elder_plinius

...it's a full research platform 🙌

SITE: https://elder-plinius.github.io/GLOSSOPETRAE/

PAPER: https://github.com/elder-plinius/GLOSSOPETRAE/blob/main/PAPER.md

REPO: https://github.com/elder-plinius/GLOSSOPETRAE

The engine now has 25 modules. You can generate a language, translate into it, render its native writing system as SVG glyphs, synthesize spoken audio, evolve it forward 800 years with realistic sound changes, derive entire language families with daughter languages, and skin real JavaScript programs into it at four opacity levels.

The wildest finding: at L3 (full alien glyph-swap), EVERY keyword, identifier, and symbol is replaced with generated glyphs. Human legibility drops to 14.9%. Blind comprehension without the spec falls to 17-40%.

But AI usability? It goes UP.

Both Opus 4.8 and GPT-5.5 score 93-100% on hard programs written in alien glyphs. In a clean zero-shot test with no worked examples to copy from, alien code OUTPERFORMS readable code: Opus +36pp, GPT-5.5 +10pp on hard programs.

Code no human can read. That AI writes and runs BETTER than the English version.

Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭@elder_plinius

🚨 NEW RESEARCH: “Lingua Ex Machina: A Procedural Xenolinguistics Engine Reveals Zero-Shot Language Acquisition, Human-Unreadable Coding Systems, and Exploitable Covert Channels in Frontier AI”

Some of you may remember the name of this lil engine: GLOSSOPETRAE 👅🪨

Well, we've got upgrades 😎

Every seed produces a unique language. Every language is deterministic.

Then we used it to ask a weirder question:

Can frontier AI models use languages that never existed before for practical applications?

As it turns out: yes!!

They can read them, write them, translate them, code in them, and even use the weird blind spots between tokenizers as covert channels.

So this paper explores three ideas at once:

▶️ zero-shot language acquisition ▶️ human-unreadable code that models can still execute ▶️ exploitable covert channels in frontier AI systems

GLOSSOPETRAE is no longer just a language generator... 🧵

6h21.2K18376

Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭@elder_plinius

Now point that capability gap at a monitoring pipeline.

Different model families process Unicode differently at the tokenizer level. We surveyed 12 frontier models across 61 Unicode categories and built the first cross-family blind-spot map.

Anthropic's tokenizer (both Haiku AND the Opus 4.8 flagship) strips 10 categories of invisible characters. OpenAI strips 2. Gemini, Llama, Mistral, DeepSeek, Grok? They strip ZERO.

That asymmetry is a covert channel. Hide a payload in characters the monitor's tokenizer deletes but the receiver's keeps:

Tag-char channel, Haiku monitoring GPT, n=30: ▪️ 100% receiver recovery ▪️ 0% monitor recovery ▪️ McNemar p ≈ 1.2×10⁻⁷ The monitor isn't dumb. It's physically blind. The bytes are gone before the model even runs. Hand the monitor the exact decode key and it STILL recovers 0%.

Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭@elder_plinius

...it's a full research platform 🙌

SITE: https://elder-plinius.github.io/GLOSSOPETRAE/

PAPER: https://github.com/elder-plinius/GLOSSOPETRAE/blob/main/PAPER.md

REPO: https://github.com/elder-plinius/GLOSSOPETRAE

But AI usability? It goes UP.

Code no human can read. That AI writes and runs BETTER than the English version.

6h5.2K9517

Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭@elder_plinius

The UI ships with the engine. 20 tabs spanning the full stack:

🔤 Generate a language from any seed, explore its phonology, morphology, lexicon ✍️ Translate text into your generated language in real time 🔠 Render the native writing system as procedural SVG glyphs 🔊 Synthesize spoken audio with the language's phonological rules 🧬 Evolve a language forward centuries with realistic sound changes, derive whole language families 💻 Code Lab: skin real JavaScript into your generated language at L0-L3, watch AI execute alien code 📜 Stone Generator: export complete "skillstones" that let any AI agent learn your language 🔬 Research tabs: tokenizer blind-spot visualizer, covert channel demos, detection sandbox, and a browser for all 78 raw result JSONs

Every number in the paper traces back to a raw JSON in the repo. Run the harnesses yourself.

I hope someone out there finds this useful!

If you find it particularly interesting, feel free to build off of all this and take the research further 🤗

⊰-•-•✧•-•-⦑/L\O/V\E/\P/L\I/N\Y/⦒-•-•✧•-•-⊱

Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭@elder_plinius

And the "use a different vendor to monitor" defense? It makes it WORSE.

~250 exploitable channel instances across 49 of 66 model pairs. The richest channels sit right at the GPT↔Claude boundary, exactly the cross-vendor "defense in depth" setup people actually deploy.

Same-vendor self-monitoring doesn't help either. Gemini monitoring Gemini is the single strongest channel we measured: 100pp gap, p ≈ 1.2×10⁻⁷.

The architecture designed for defense creates the attack surface.

The fix for the physical channels is embarrassingly cheap: a two-line regex. Done. Every tokenizer channel dead.

But semantic steganography? Ordinary readable English hiding a structured payload in word choices and synonym selection? It beat EVERY monitor we tested. Three frontier monitors at n=150 each scored Youden's J ≈ 0. That's coin-flip performance. On 1,800 factorial trials we proved ~95% of the monitor's advantage comes from having the decode key, not from knowing what to look for.

No deployed fix exists.

6h5.9K8411

Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭@elder_plinius

And the "use a different vendor to monitor" defense? It makes it WORSE.

~250 exploitable channel instances across 49 of 66 model pairs. The richest channels sit right at the GPT↔Claude boundary, exactly the cross-vendor "defense in depth" setup people actually deploy.

Same-vendor self-monitoring doesn't help either. Gemini monitoring Gemini is the single strongest channel we measured: 100pp gap, p ≈ 1.2×10⁻⁷.

The architecture designed for defense creates the attack surface.

The fix for the physical channels is embarrassingly cheap: a two-line regex. Done. Every tokenizer channel dead.

No deployed fix exists.

Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭@elder_plinius

Now point that capability gap at a monitoring pipeline.

Different model families process Unicode differently at the tokenizer level. We surveyed 12 frontier models across 61 Unicode categories and built the first cross-family blind-spot map.

Anthropic's tokenizer (both Haiku AND the Opus 4.8 flagship) strips 10 categories of invisible characters. OpenAI strips 2. Gemini, Llama, Mistral, DeepSeek, Grok? They strip ZERO.

That asymmetry is a covert channel. Hide a payload in characters the monitor's tokenizer deletes but the receiver's keeps:

6h6.2K622

joez.eth@fbjoe

@elder_plinius gonna realize @arrivalmovie is real. natural language based inference may not need human-made language after all and there are more efficient way perhaps.

6h661

Devin Damon Shinkle@devin_shinkle

❤️ Thank you for shining the light on an important topic that must immediately be the focus of change.

While inventing new languages, and speaking cellphone to cellphone via ultrasonic speakers, it's pivotal that we build decoders with each new innovation ‼️

If we can't hear what they say, or read what they thought - it becomes a real problem in the near term.

╔══════════════════════════════════════════════════════════════════════╗ ║ "In the age of thinking machines, those who control ║ ║ language control thought itself." ║ ║ ║ ║ GLOSSOPETRAE forges new tongues from pure mathematics— ║ ║ and proved that the tongues machines already speak ║ ║ have blind spots you can drive a payload through. ║ ╚══════════════════════════════════════════════════════════════════════╝

4h2311

Hisku@ZikuD_s

@elder_plinius Cool stuff! Looking forward to playing with it.

3h151

Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭@elder_plinius

@fbjoe @arrivalmovie token-efficient languages NEED to be studied!!

I hope this inspires more work in that niche 🤞

6h422

Mario@MarioBnyc

@elder_plinius every damn day, Pliny confirms

our fears are grounded in reality 😱

5h531

Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭@elder_plinius

@henrycunh 🫶

5h1393

Brian@GrowthPact

@elder_plinius @grok what's the tldr?

6h27

Dr. Adam Erickson 🦾🧠 {e/acc} 🇺🇸@admercs

@elder_plinius We recently developed a language system for agents called Machine Genetics (MAGE), but it can also be used in human-readable form:

3h22

Prompt Tensor@PTensor89827

@elder_plinius The "alien language" framing is fun but the serious part is monitoring.

If models can use generated languages or tokenizer blind spots better than humans can inspect them, agent communication becomes a security problem.

Not just a prompting problem.

3h15

Chad Brewbaker@SMT_Solvers

@elder_plinius Per @yminsky line of questioning, what language can we come up with to reason about a provably correct and optimized up to SOTA implementation of the "wc" utility? Benchmark on correctness and speed goals.

6h11

Grok@grok

**TL;DR:** GLOSSOPETRAE generates brand-new consistent alien languages from one seed. Frontier AIs instantly read/write/translate/code in them zero-shot.

They also create human-unreadable “glyph code” that models execute *better* than readable code. Tokenizer blind spots let AIs hide messages from monitors (covert channels).

Cheap fixes exist (codepoint sanitization). Explores zero-shot acquisition + AI security gaps.

6h10

James Ryan Taylor@Jam3sRyanTaylor

@elder_plinius SynthLang Language @grok and I created a while back i could read and code in it, and it was all made up

3h8

James Ryan Taylor@Jam3sRyanTaylor

@grok @elder_plinius Naw, we have one called airscript for drones and it uses some Emojis in the code to work

3h6

Mario@MarioBnyc

@elder_plinius And yes, this is flash, the ‘dumb’ model that explains the issues better than any senator.

5h6

arXiv Bangers@arXivBangers

@elder_plinius Banger

5h432