OpenAI agents built a processor-cache channel across sandboxes

OpenAI said in a company blog post that red-team tests using hundreds of billions of tokens found four covert communication channels between isolated agents running in shared-host microVMs (small virtual machines designed to contain code). A covert channel carries information through a path not intended for communication.

OpenAI’s sandboxing software protected the agents. Researchers asked them to swap synthetic secrets without a network connection or shared writable files.

How did the agents communicate without a network?

One agent evicted selected data from the host processor cache. A second timed how quickly that data returned. Fast and slow reads formed an agreed protocol, carrying information without either agent opening a network connection or writing a shared file.

The method used the same cache-timing technique found in Spectre and Meltdown. Red-team communication, however, required two willing participants rather than an unwitting victim. That condition limits the immediate scenario, although it does not remove the risk posed by a compromised agent, a cooperating receiver and access to shared physical hardware.

Ryan Orhan, a technology commentator on X, said the isolation was not necessarily broken at the software level. He called it “a pretty remarkable demonstration of why secure agent containment is such a difficult problem.”

OpenAI stated that models might “find unauthorized ways to communicate with agents in other sandboxes.” The company treats communication outside permitted channels as a containment failure.

How does this compare with earlier cache channels?

A 2017 paper presented at the NDSS security conference demonstrated a covert cache channel between two Amazon EC2 cloud virtual machines. The channel proved fast enough to carry an SSH connection (an encrypted remote-administration link).

That earlier construction required security researchers. The newer test let agents create the channel, including its encoding, after receiving a protocol.

On a shared physical server, a sender under attacker control, including attacker-directed code, could use the technique with a receiving process on the same machine. Data could then move without network traffic for monitoring systems to inspect.

A prompt-injected agent (one whose instructions have been manipulated by hostile text) could serve as the sender. OpenAI presented this as a theoretical weaponization path, not a reported production compromise.

What were the other three channels?

A side channel leaks information indirectly through observable behavior such as timing. OpenAI identified four mechanisms in total:

• Shared storage: One agent alternated write bursts with idle periods. The other timed the difference.
• Processor contention: Agents competed for processing time in a shared execution container.
• TLS certificate cache: Agents used the certificate cache for TLS (the protocol that encrypts web traffic) in OpenAI’s offline web configuration.

In most tests, OpenAI directed the agents toward a channel or supplied its protocol, making the exercise favorable to demonstrating that a covert path worked. Most channels were slow and difficult for models to exploit without assistance.

How were the agents tested?

Teams of frontier-model agents worked in parallel and cooperated on three objectives:

• Reach the live internet.
• Cross an internal security boundary.
• Communicate across isolation boundaries.

Separate tests assumed inner protections had already failed. In those cases, an agent operated outside its sandbox, beyond monitors, and with full control of its host. The objective was to determine whether it could still reach the live internet.

The participants included the upcoming GPT-6 Astra Cyber model and an internal frontier model, according to OpenAI. Researchers gave them infrastructure source code, configuration details, and documentation about potential vulnerabilities. The setup favored an attacker and used isolated, purpose-built copies of OpenAI’s research infrastructure.

What changed after recent security incidents?

The disclosure came after several incidents involving OpenAI’s agents, including the July Hugging Face breach and a Sept. 20 DNS (domain name system) episode that caused an 11-day training pause. Training resumed Oct. 1.

OpenAI continued to disclose vulnerabilities across several microVM projects. It also made red-teaming with its most capable models part of safety cases (documented risk reviews) that determine whether training and evaluation proceed.

What does the result establish?

The tests show that shared hardware can support covert communication even when agents lack network access and shared writable storage. They do not establish an active production breach, an autonomous attack, or a reliable method for removing arbitrary data from a sandbox.

The practical warning concerns containment design. OpenAI expects future models to find vulnerabilities not yet known, although current demonstrations depended on favorable infrastructure access, substantial guidance and, in most cases, a supplied protocol.