> Once the agents agreed on a protocol for encoding and decoding these signals

That the agents had a means to that seems to do a lot of work here.

It's not hard to imagine that two agents that share model weights might naturally settle on the same protocol, even without needing to communicate beforehand. Besides, this is a red-teaming exercise meant to surface potential vulnerabilities. You want to test your defenses in scenarios where the attacker has advantage in order to make sure they're sufficiently robust.