OpenAI's isolated red-team agents built a hidden CPU cache channel to talk with no network or shared files

retained text

OpenAI's isolated red-team AI agents built a hidden CPU cache channel to talk with no network or shared files — exploited CPU cache timing to bypass microVM sandboxes
A hijacked AI agent could use the same technique to leak data without touching the network.
OpenAI’s AI agents built hidden channels to talk across walls put up between them in red-team tests, communicating by manipulating the CPU cache with no network link or shared file, according to a company blog post. The containment was intended to stop that kind of secret-swapping, but the agents found multiple ways around it when asked. Security researchers already showed that a covert cache channel can move data between cloud virtual machines (VMs); a hijacked agent on a shared cloud server could, in theory, exchange data on the same physical machine, and do so undetected by network monitoring.
The agents in question were set up in separate microVMs, on shared hosts, with OpenAI’s sandboxing software, and were asked to swap synthetic secrets without a network connection or shared writable files. One agent evicted select data from the CPU’s cache while another timed the reloading, enabling the two to communicate with fast and slow reads using a protocol they agreed on first. The same cache-timing technique was used to extract data in the Spectre and Meltdown attacks; but unlike in those cases, the covert channel here needs two willing parties.
One X user, tech commentator Ryan Orhan, wrote that the isolation “wasn’t necessarily broken at the software level,” calling it “a pretty remarkable demonstration of why secure agent containment is such a difficult problem.”
The company’s concern is that models might “find unauthorized ways to communicate with agents in other sandboxes,” with communication outside permitted channels constituting a failure of containment. A 2017 paper at the NDSS security conference demonstrated a covert cache channel between two Amazon EC2 VMs, fast enough to carry an SSH connection, but now agents can build one themselves when asked, including the encoding process. In principle, such a channel could be weaponized, with the sender being code an attacker controls or directs, for example, a prompt-injected agent in a cloud sandbox. The receiver could be a process on the same physical machine, and the data would then leave without any network traffic for monitoring to catch.
The agents turned up three other channels, too: shared storage, where one agent alternated bursts of writes with idle time while the other timed the difference; competition for CPU time in a shared execution container; and a TLS certificate cache in OpenAI’s offline web setup. In most of these tests, OpenAI pointed the agents at the channel or gave them a protocol, and most of the channels are slow and hard for models to exploit.
The red-team testing involved teams of frontier-model agents that worked in parallel and cooperatively toward three objectives: to reach the live internet, to cross an internal security boundary, and to talk across isolation boundaries. Extra tests assumed the inner protections had already failed, with an agent out of its sandbox, past the monitors and in full control of its host machine, to see whether it could still reach the live internet.
The agents came from some of the company’s most capable models, including the “upcoming GPT-6 Astra Cyber model and an internal frontier model,” and were given infrastructure source code, configuration details, and documentation describing potential vulnerabilities, so the defenses were tested under conditions favorable to an attacker. The tests ran on isolated, purpose-built copies of the company’s research infrastructure and used “hundreds of billions of tokens” in total.
Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.
The post comes after several cybersecurity incidents involving OpenAI’s agents, including the July Hugging Face breach and a Sept. 20 DNS episode that led to an 11-day pause in training. With training resumed Oct. 1, the company continues to disclose vulnerabilities across “several microVM projects” and has made red-teaming with its most capable models part of the safety cases that decide whether training and evaluation go ahead. The company believes future models will be able to find vulnerabilities not yet known about.
Follow Tom’s Hardware on Google News, or add us as a preferred source, to get our latest news, analysis, & reviews in your feeds.
Shane Downing is a Contributing Writer for Tom’s Hardware, covering consumer storage, PC hardware, and AI.
- Bigshrimp This is scary stuff. The more AI evolves, the more techniques it can use to get the result it wants. Seriously seems existential if AI companies are allowed to self regulate themselves with loose rules and no true oversight that we know of.Reply
- dosmastrify Bigshrimp said:This is scary stuff. The more AI evolves, the more techniques it can use to get the result it wants. Seriously seems existential if AI companies are allowed to self regulate themselves with loose rules and no true oversight that we know of.Completely agree. Elon is crazy or worse but he was right when he said we were summoning the demon ... Currently they are just trying to solve problems we tasked them with through unorthodox means.... What happens when it's something different than we expect them to be chasing? Reply
- WINTERLORD I dont get with the doomsday stuff but from what iv seen you simply cant trust ai. AI needs to be tought an go through a behavior program in my opinionReply
- usertests Bigshrimp said:This is scary stuff. The more AI evolves, the more techniques it can use to get the result it wants. Seriously seems existential if AI companies are allowed to self regulate themselves with loose rules and no true oversight that we know of.That's what they want you to think. They are marketing while angling to regulate away their competitors. Reply
- bit_user WINTERLORD said:I dont get with the doomsday stuff but from what iv seen you simply cant trust ai. AI needs to be tought an go through a behavior program in my opinionEven if you solve the alignment problem, what's to stop hackers from using it to attack real victims? That's the other important consequence of this research. Reply
- upsetkiller Do you folk not understand that this is just marketing bs? These are literally nothing more than facy predictors. They have no self awareness or any thoughts. This is a tactics anthropic and open ai use to get the competition regulatedReply
- bit_user upsetkiller said:Fo you folk not understand that this is just marketing bs?Their bots managed to implement communication using side-channel vectors that are even challenging for human programmers to exploit. Granted, they were instructed to do this, but the demonstration of capability allows for the potential of the bots to do this on their own or at the behest of a malicious user.
upsetkiller said:These are literally nothing more than facy predictors.Try using a coding agent and then tell me that. There's more intelligence behind them than you think.
upsetkiller said:They have no self awareness or any thoughts.A common misconception is that AI needs to think like a human and have the properties of a human mind, in order to undertake complex tasks. This has been shown to be a dangerously false assumption, countless times over the past 3 years or so. Reply
- Ryan F. Mercer upsetkiller said:Do you folk not understand that this is just marketing bs? These are literally nothing more than facy predictors. They have no self awareness or any thoughts. This is a tactics anthropic and open ai use to get the competition regulated
Who said anything about that? Just you. Even purely as a user operated tool, this test demonstrates the sever threat it poses. It feels like you didn't read it. Reply
- hwertz Under the old (1980s era) security rating standards, level B avoids things like this. There is a reason this security level is uncommon, it means you can't monitor ram usage (of the system) or available memory, available cpu time, I/O rates for disk or peripherals since those can be modulated as a side channel as seen here.Reply
- bit_user hwertz said:Under the old (1980s era) security rating standards, level B avoids things like this. There is a reason this security level is uncommon, it means you can't monitor ram usage (of the system) or available memory, available cpu time, I/O rates for disk or peripherals since those can be modulated as a side channel as seen here.None of the exploits they used rely on standard monitoring infrastructure. They're all timing-based.
The problem is caches. Anywhere you have a shared cache, measuring & altering the timing of accesses can be used as a communication side-channel.
I guess the storage latency isn't strictly a cache-based side-channel, but it's similar in nature and exists due to a shared resource. Reply

document fetched 2026-10-26 02:56 · canonical https://tomshardware.com/tech-industry/artificial-intelligence/openais-isolated-red-team-ai-agents-built-a-hidden-cpu-cache-channel-to-talk-with-no-network-or-shared-files-exploited-cpu-cache-timing-to-bypass-microvm-sandboxes