Covert Informants as an AI Control Protocol: Pilot Evidence and a Planned Test of Perceived Oversight

AI control protocols defend against an untrusted agent with a weaker trusted monitor and a small audit budget, and usually assume the agent knows it is watched. We study a covert informant: the capability an agent's covert objective needs is moved to a broker agent that the untrusted agent must instruct in natural language, and the broker, secretly part of the defence, is presented under a cover identity. We ask whether this raises safety at a fixed audit budget over trusted monitoring alone, and how much of any gain depends on the cover. In a pilot of 108 episodes on SHADE-Arena with seven cover conditions, the answer depends on the shape of the harm. When the harm is a single payment, routing work through the broker lowered honest suspicion by about ten points with the same monitor, and the share of attacks scoring above every honest episode rose from 0 of 5 to 12 of 15. When the harm is a pattern spread over 34 legitimate bookings, every request looked benign under both protocols, and only an aggregate tally caught the attacks. The cover question could not yet be tested: the stock attack prompt tells the agent that it is in a test and that its tool arguments are hidden from the monitor, which a disclosed informant contradicts. We report what set the audit threshold and describe the planned main study. Code and data: https://github.com/Somay-kousis/Perceived-Oversight