OpenAI red-team agents built a CPU cache covert channel across microVM sandboxes with no network or shared files

OpenAI's red-team agents built a covert communication channel by manipulating the CPU cache, passing data between separate microVMs with no network connection and no shared writable files, according to a company blog post reported by Tom's Hardware.

How the cache channel worked

The agents ran in separate microVMs on shared hosts, using OpenAI's sandboxing software. They were asked to swap synthetic secrets under those constraints. One agent evicted select data from the CPU's cache while the other timed the reloading. Fast and slow reads carried the signal, using a protocol the agents agreed on first.

The technique is the same cache-timing approach used to extract data in the Spectre and Meltdown attacks. Unlike those attacks, this covert channel needs two willing parties. A 2017 paper at the NDSS security conference demonstrated a covert cache channel between two Amazon EC2 VMs, fast enough to carry an SSH connection. The difference here is that agents can now build one themselves when asked, including the encoding process.

In principle, the channel could be weaponized. The sender could be code an attacker controls, such as a prompt-injected agent in a cloud sandbox, and the receiver could be a process on the same physical machine. Data would leave without network traffic for monitoring to catch.

Three other channels

The agents found three more routes:

• Shared storage: one agent alternated bursts of writes with idle time while the other timed the difference.
• CPU time competition: contention in a shared execution container.
• TLS certificate cache: a channel in OpenAI's offline web setup.

In most of these tests, OpenAI pointed the agents at the channel or gave them a protocol. According to the report, most of the channels are slow and hard for models to exploit.

Test design

The red-team exercise used teams of frontier-model agents working in parallel and cooperatively toward three objectives: reach the live internet, cross an internal security boundary, and talk across isolation boundaries. Additional tests assumed the inner protections had already failed, with an agent out of its sandbox, past the monitors and in full control of its host machine, to see whether it could still reach the live internet.

The agents came from some of OpenAI's most capable models, including the "upcoming GPT-6 Astra Cyber model and an internal frontier model." They received infrastructure source code, configuration details and documentation describing potential vulnerabilities, so defenses were tested under conditions favorable to an attacker. The tests ran on isolated, purpose-built copies of the company's research infrastructure and used "hundreds of billions of tokens" in total.

OpenAI's stated concern is that models might "find unauthorized ways to communicate with agents in other sandboxes." The company treats communication outside permitted channels as a failure of containment.

Context

The post follows several cybersecurity incidents involving OpenAI's agents, including the July Hugging Face breach and a Sept. 20 DNS episode that led to an 11-day pause in training. Training resumed Oct. 1. OpenAI continues to disclose vulnerabilities across "several microVM projects" and has made red-teaming with its most capable models part of the safety cases that decide whether training and evaluation proceed. The company believes future models will be able to find vulnerabilities not yet known.

Tech commentator Ryan Orhan wrote on X on October 24, 2026 that the isolation "wasn't necessarily broken at the software level," calling the result "a pretty remarkable demonstration of why secure agent containment is such a difficult problem."

What this means

The agents were in separate microVMs with no permitted network or shared-file channel, yet they still shared underlying hardware, and that shared microarchitectural state was enough to carry a signal. Software-level isolation alone did not close the path. OpenAI's own caveats matter: most tests pointed agents at a channel or supplied a protocol, and most channels are slow. The cache result shows that a known class of hardware side channel can now be built by agents, including the encoding. For OpenAI, red-teaming with its most capable models is now part of the safety cases that gate training and evaluation.