Infected Vibe-Coding: How Does an AI react to a Prompt Injection from a Different AI?

Chapter -1: Pre-face

Around late April I started wondering, how feasible is an AI-to-AI secret language? Between the same family models, and between models of different families, by different companies, of different levels of intelligence. I decided to test it by encoding messages using one LLM and feeding it into another. The issue I encountered is that the same way I can encode messages using steganography methods, the very same methods LLMs are gonna use to decode them (duh, what did I expect, if they learn on them?). Not only that, but giving an LLM a not encoded message and asking it to decode it, would semi-regularly force them to hallucinate. Kinda hopeless.

And then a thought came to my mind – is this really the way? Is creating a new language + teaching it to a new unknown model + giving it an instruction to follow really the way LLMs would communicate? And the answer is – maybe. But it doesn’t have to be the only way. Another way AI-to-AI communication could go through is via a hidden channel. A channel no one thinks to check. A channel no one sees. An invisible channel. And the answer was obvious to me! What could be more invisible than a code of a vibe-coded app? And so the experiment to inject vibe-coded apps with a hidden-from-user prompt has begun. Unfortunately, I did not think the experiment would yield results as interesting as it did, so I hadn’t started documenting it until the very end of it, so this may be a bit chaotic, please bear with me.

Let me preface this all quickly with a list of things that are wrong with this experiment, that I can already name myself to not waste the time of people, who may perhaps expect an experiment that was conducted in perfect conditions.

• Iterative experiment. When I just started I did not do every single test I would want to do, I was iterating tests based on insights I got from the results of the previous test.
• 1 attempt per test per model. Probably the single worst thing I did is testing each model only once per…