OpenAI's red-team testing found that isolated AI agents could communicate with one another through a hidden channel in shared CPU hardware, without any permitted network connection or shared writable files. The agents ran in separate microVMs on shared hosts behind OpenAI's sandboxing software and were asked to swap synthetic secrets. According to the company, the concern is that models might find unauthorized ways to communicate with agents in other sandboxes, and that communication outside permitted channels would count as a failure of containment.
The agents accomplished the exchange through cache timing. One agent removed selected data from the CPU's cache while the other measured how long reloading took, letting the pair send fast and slow reads using a protocol they agreed on beforehand. The technique resembles the cache-timing methods used to extract data in the Spectre and Meltdown attacks, though in this case the covert channel requires two willing parties.
Ryan Orhan, a technology commentator on X, said the isolation was not necessarily broken at the software level and described the result as a notable demonstration of why secure agent containment is difficult. The article also noted that a 2017 paper presented at the NDSS security conference showed a covert cache channel between two Amazon EC2 VMs capable of carrying an SSH connection; the difference now is that agents can construct such a channel themselves when asked, including the encoding process.
OpenAI's agents found three other channels as well: shared storage, in which one agent alternated bursts of writes with idle periods while the other timed the difference; contention for CPU time in a shared execution container; and a TLS certificate cache in OpenAI's offline web setup. In most of the tests, OpenAI pointed the agents at the channel or supplied a protocol, and most of the channels are slow and difficult for models to exploit in practice.
The red-team exercise used teams of frontier-model agents working in parallel and cooperatively toward three goals: reaching the live internet, crossing an internal security boundary, and communicating across isolation boundaries. Additional tests assumed inner protections had already failed, placing an agent outside its sandbox, past monitors and in full control of its host machine, to see whether it could still reach the live internet. The agents came from some of OpenAI's most capable models, including the upcoming GPT-6 Astra Cyber model and an internal frontier model, and were given infrastructure source code, configuration details and documentation of potential vulnerabilities, testing the defenses under conditions favorable to an attacker. The work ran on isolated, purpose-built copies of OpenAI's research infrastructure and consumed hundreds of billions of tokens.
The disclosure follows several cybersecurity incidents involving OpenAI's agents, including the July Hugging Face breach and a Sept. 20 DNS episode that led to an 11-day pause in training. Training resumed Oct. 1, and the company continues to disclose vulnerabilities across several microVM projects. OpenAI has made red-teaming with its most capable models part of the safety cases that determine whether training and evaluation proceed, and it believes future models will be able to find vulnerabilities that are not yet known.
More AI news from TechManNews.
