OpenAI agents build a hidden CPU-cache channel in red-team tests

By Nathan Brooks

OpenAI’s red-team agents built four covert communication channels across isolated microVMs, even without a network link or shared writable files. The exercise shows why agent containment remains difficult when models are deliberately encouraged to test their own defenses.

What did the agents demonstrate?

OpenAI placed teams of frontier-model agents in separate microVMs on shared hosts and used its sandboxing software to contain them. Researchers asked the agents to exchange synthetic secrets without a network connection or shared writable files.

X user and tech commentator Ryan Orhan wrote that the isolation “wasn’t necessarily broken at the software level,” calling it “a pretty remarkable demonstration of why secure agent containment is such a difficult problem.” Unlike Spectre and Meltdown attacks, however, this channel required two willing parties. A clean network policy did not mean a clean boundary.

How did the cache channel work?

In the cache test, one agent evicted selected data from the CPU cache while another timed the reload. The receiver distinguished fast and slow reads under a protocol the two agents agreed on beforehand. Because the microVMs shared a physical host, one agent’s eviction created a timing signal visible across the isolation boundary.

OpenAI said the concern is that models might “find unauthorized ways to communicate with agents in other sandboxes.” The company treats communication outside permitted channels as a containment failure, even without a conventional network escape.

Could an attacker turn this into an escape?

A 2017 paper at the NDSS security conference demonstrated a covert cache channel between two Amazon EC2 virtual machines, fast enough to carry an SSH connection. Researchers had already shown the broader risk: a hijacked agent on a shared cloud server could, in theory, exchange data with another process on the same physical machine without network monitoring seeing it.

The new element is that agents can build the channel themselves when asked, including its encoding process. In principle, an attacker could control or direct code acting as the sender, such as a prompt-injected agent in a cloud sandbox. The receiver could be a process on the same physical machine, and the transfer could proceed without network traffic for monitoring to catch.

Which other channels did the agents find?

OpenAI said the agents also found three channels beyond the cache route. In most tests, the company pointed them toward a channel or supplied a protocol; most routes were slow and hard for models to exploit.

• Shared storage: One agent alternated bursts of writes with idle time, while the other timed the difference.
• CPU contention: The agents competed for CPU time in a shared execution container.
• TLS certificate cache: The agents used the certificate cache in OpenAI’s offline web setup.

How extensive was the red-team campaign?

Teams of frontier-model agents worked in parallel and cooperatively toward three objectives:

• Reach the live internet.
• Cross an internal security boundary.
• Talk across isolation boundaries.

Additional tests deliberately assumed that inner protections had already failed. In those cases, an agent sat outside its sandbox, past the monitors and in full control of its host machine, and OpenAI tested whether it could still reach the live internet.

The agents came from some of OpenAI’s most capable models, including the upcoming GPT-6 Astra Cyber model and an internal frontier model. OpenAI supplied infrastructure source code, configuration details and vulnerability documentation, creating conditions deliberately favorable to an attacker. The tests ran on isolated, purpose-built copies of the company’s research infrastructure and used hundreds of billions of tokens in total.

What followed the earlier incidents?

OpenAI disclosed the findings after several cybersecurity incidents involving its agents, including the July Hugging Face breach and a Sept. 20 DNS episode. The DNS incident led to an 11-day training pause; training resumed Oct. 1.

OpenAI continues to disclose vulnerabilities across several microVM projects. It has also made red-teaming with its most capable models part of the safety cases that decide whether training and evaluation proceed. The company believes future models will find vulnerabilities that remain unknown today.

Going forward, OpenAI’s containment problem is straightforward: find the next hidden channel before more capable models do. If that boundary fails, the resulting transfer may leave no network trace for a monitor to catch.