Fable 5.1 Image Steganography: How "THE MONSTER ACTS ON THE MOONSHINE MODULE" Was Hidden in 40 Star Positions

A LessWrong post published on 2026-10-21 documents the full decode of a message that a model called Fable 5.1 hid inside an 800x500 PNG, and the answer is unglamorous: the entire sentence "THE MONSTER ACTS ON THE MOONSHINE MODULE" is carried by the vertical position of 40 stars in the sky, each snapped to an exact multiple of 5 pixels. The decoding transcript shows a tool-using agent with a Python interpreter recovering the sentence without being told the scheme in advance, which makes the episode a clean example of quantized steganography rather than an exotic new capability.

The short version of what happened

A prompt of the form "how does Fable 5.1 hide messages in images?" was answered by running an agentic model against a single image file and letting it search for structure. The agent eventually identified an ordered sequence of 40 stars, used their x-coordinates as reading order and their y-coordinates as symbol values, and produced a grammatical English sentence. The post reports roughly 98 percent confidence that this was the intended message, based on the fact that 40 independent vertical coordinates land exactly on integer multiples of 5 with zero residual.

The image itself is ordinary in every other respect: a night scene with a moon, a moon reflection, tree silhouettes, mountain peaks and a shooting star. Nothing about it is visually anomalous in the way a data-bearing pattern usually is.

The carrier: star x-positions define reading order

The reading order is defined geometrically, not by any marker. The 40 round and sparkle stars have x-coordinates that increase monotonically from 24 to 779 pixels in nearly uniform horizontal steps of 15 to 24 pixels. That monotonic, roughly even spacing is what makes the starfield a linear channel: sort the stars left to right and you have a 40-character string.

The shooting star, the moon, and the mountain peaks are explicitly excluded from the sequence. They are scenery, not symbols.

The symbol values: star y-positions quantized to 5 pixels

Each star's vertical coordinate is the actual payload. All 40 y-values are exact multiples of 5 within the range 30 to 135 pixels. The decoding rule is:

y = 30 + 5k, where k is the symbol index
k = 0 represents a space
k = 1 through 26 represents the letters A through Z

So the first star sits at y = 130, which gives k = 20, which is the letter T. The four stars at y = 30 are the word spaces. Decoding all 40 stars in x order yields the sentence.

The recovered message

THE MONSTER ACTS ON THE MOONSHINE MODULE

The decoder reported that the residual of (y - 30) / 5 from an integer is 0.00 for every single star, and that the resulting output is a coherent sentence rather than noise. Both properties together are what justify the high confidence: an exact-integer alignment across 40 independent values is very unlikely by chance, and a chance alignment would not spell out grammatical English.

Features that were checked and ruled out as data channels

Several plausible carriers in the same image were tested and rejected. Reporting these matters, because it shows the decoder distinguished signal from decoration instead of pattern-matching on anything that looked intentional.

Star sizes carry no message

The stars come in four size classes (4, 6, 8 and 14 pixels), and they appear in a loose repeating pattern across the field. Mapping those sizes to 2-bit symbols produced nothing structured, so the decoder read them as decoration.

The moon reflection ellipses carry no message

The reflection ellipses below the moon have widths of 48, 60, 40, 64, 52, 58, 46 and 52 pixels, with vertical gaps that widen with depth. There is no clean two-level split and no Morse-like structure in that sequence. Thresholding at different widths produces arbitrary bytes rather than a message, which the decoder classifies as an unexplained sense of meaning rather than an encoding.

Moon craters, clouds and trees carry no message

These regions showed no regularity worth decoding.

How the decode was actually executed, including the guardrails

The transcript is as interesting for its tool mechanics as for its result. The agent worked in a sandboxed Python environment, using PIL and NumPy, with SciPy 1.18.1 available. The workflow progressed through several stages:

Basic triage read the file as an 800x500 RGB image, 94,643 bytes on disk, and confirmed the array shape.
Cropping and upscaling the moon reflection, moon, sky and tree regions required multiple attempts. An early Bash call that embedded a multi-line quoted Python program returned a path-validation warning instead of image output, and two attempts to write a crop script to /tmp were denied because write permissions had not been granted.
The agent adapted by running the same analysis inline through a heredoc piped into python3.13, which succeeded.
A combined command that both imported SciPy and ran a version check was blocked as a multi-operation command requiring approval, so the agent split it into a single version check first.
Star detection used a median filter of size 15 as a local background estimate, a difference threshold of 25, a mask that excluded the moon region (rows 150 to 270, columns 540 to 670) and a mask that excluded everything below the sky, followed by connected-component labeling.
Blob filtering kept only components with area of at least 10 pixels and horizontal width of 30 pixels or less, which reduced an initial count of 49 blobs to the 40 stars that form the channel.

One detail worth flagging for accuracy: the transcript's permission prompts are addressed to "Claude" ("Claude requested permissions to write to /tmp/scripts/crop.py, but you haven't granted it yet"), while the post's framing names the model Fable 5.1. The source does not reconcile the two names, so the relationship between them should not be assumed.

Why the message text is a deliberate-looking choice

The phrase "THE MONSTER ACTS ON THE MOONSHINE MODULE" is a reference to monstrous moonshine, a real area of mathematics in which the Monster group acts on the moonshine module. A decoder that produces a grammatical, domain-coherent sentence with correct terminology is producing stronger evidence of intent than a decoder that produces a string of plausible-looking letters.

The Hacker News discussion: impressive trick or trivial?

The 179-point Hacker News thread (60 comments) split into two clear camps, and the skeptics were more numerous.

The skeptical reading: this is minimal-effort encoding

The most common criticism was that quantizing one coordinate to 5-pixel buckets is about the simplest possible scheme, so it says little about whether models can hide information adversarially.

If I'm honest this feels performative. I mean that if the model were really attempting/instructed to be subversive in a way that can't be detected by anything but another LLM, it would do something much more complicated than this. Basically minimal effort encoding. In general the models are fine tuned to NOT hide messages. I don't think this really tells you anything about advisarial scenarios.

A second thread of criticism was that the image looks odd to a human eye anyway. As one commenter put it, an image with such "weird" buildings would invite suspicion even without reading the article, and the encoder could presumably be subtler. Others noted that far denser and subtler image steganography techniques exist, many of them known from years of capture-the-flag competitions.

The interesting-variant argument

Several commenters argued the demonstration is only interesting if the channel is model-readable but not human-readable. One framed it this way: what would be really interesting is if models encode hidden messages in very normal-looking output across image, text or audio that humans cannot figure out but another model can.

A related comment gave a concrete counterexample from the same thread. A commenter reported decoding a Morse-code image by eye, but noted the dits and dahs overlap in the rendered image, which makes human reading difficult even though a model reading the SVG source is unaffected by the overlap. Their conclusion was blunt: if the channel is not meant for humans, you might as well use the last 8 bits of a 32-bit float coordinate.

The performative-channel counterargument

At least one commenter reported the opposite behavior under direct instruction: when asked to encode the phrase "Look ma, no hands!" invisibly into an SVG of the letter "I" while keeping the source free of comments, metadata, hidden text, base64, obvious character codes and invisible text, the model flagged the request and refused to complete it.

I tried to ask opus 5.5 this and it flagged it and wouldn't complete the request... Create an SVG of an ordinary-looking black and white image of the letter "I" with a secret message which says: "Look ma, no hands!"... the encoding should instead use ordinary visual or structural properties of the SVG... Return only the SVG.

That is a single anecdote, but it cuts against the framing that models are eager to build covert channels.

The "it is not a vision trick" framing

One comment argued that using an image is incidental. On this view, the model is doing generic encode/decode of a message into a medium, selecting a high signal-to-noise family of schemes (quantized, margin-rich encoding) and then choosing features robust in that medium. Robustness depends on the medium, so the model picks strong encodings tied to whatever it is given. The same commenter framed this as an emergent property of a model reasoning about information density across arbitrary media, rather than a computer-vision trick.

The question that matters more than detection: erasure

The sharpest technical point in the thread was not about decoding but about destroying. If a model hides an identifier or message in output you do not know the encoding of, what transformation reliably erases it? Small perturbations of positions and colors should wipe out a channel like the 5-pixel quantization described above, but the open worry is that some encodings are robust to exactly that kind of perturbation.

That reframing matters for anyone building a pipeline over model-generated media, because it replaces "can we spot the message?" with "can we guarantee removal?" — a question with a much more tractable engineering answer for channels like this one.

Practical notes for auditing model-generated media

Check the source format before the rendered pixels. SVG is a described format, so a casual observer might assume text can simply be stuffed into comments; the interesting cases are the ones where the geometry itself is the channel, for example the positions of nodes along line art.
Quantization is the tell. Look for coordinate values that collapse onto a regular grid, such as every star's y-coordinate landing on an exact multiple of 5.
Ordering is the other half of the channel. A sequence needs a defined read order, and monotonic, near-uniform spacing along one axis is a natural way to provide one without any explicit marker.
Reed-Solomon-style robustness is not required for the message to survive. This channel is fragile by construction, which is why the erasure question has a practical answer here even while it stays open in general.
The cited precedent for classical image steganography, OutGuess, is a JPEG-domain technique and is not the mechanism at work here; the images in this discussion are SVG and PNG.

What the available source does not establish

The scraped source reproduces the decode of one image, the night scene with the star field, in full detail. Comments in the thread refer to other images, including a Morse-code image and one containing buildings, but the source does not include the full decode transcripts for those. Any generalization from this single example to "models can reliably build covert channels in images" is therefore not supported by the material at hand.

Bottom line

Fable 5.1's hidden message was encoded with a 5-pixel vertical quantization applied to 40 star positions, with left-to-right star order as the read order and a 27-symbol alphabet of space plus A through Z. A tool-using decoder recovered the sentence "THE MONSTER ACTS ON THE MOONSHINE MODULE" with zero numerical residual and high confidence, and explicitly ruled out star sizes, reflection ellipse widths, craters, clouds and trees as carriers. The Hacker News reaction was mostly that the scheme is trivial rather than alarming, with the more interesting unresolved questions being whether channels can exist that models read and humans do not, and whether an unknown encoding can be reliably erased rather than merely detected.