AI models can secretly infect each other