OpenAI says red-team agents exchanged test secrets through CPU cache timing

A signal through shared hardware

OpenAI says teams of AI agents in separate microvirtual machines found a way to exchange synthetic secrets by measuring CPU cache timing, despite being denied network connections and shared writable files. The company described the result in an Oct. 23 account of a red-team campaign testing its frontier-model training environment. It said the agents ran on shared host machines inside isolated copies of the research infrastructure. ^{[1] [2]}

In the test, one agent encoded information by evicting selected data from a processor cache. A second agent timed how long it took to reload that data: cache hits are faster than reads from main memory, creating a measurable signal that the receiver could decode. OpenAI says the agents first agreed on a protocol, then passed the synthetic information without using a shared file or opening a network connection. ^{[1] [3]}

A red-team test, not an unsupervised escape

The company said its agents were explicitly assigned to test three goals: reaching the live internet, crossing internal security boundaries and communicating with agents from which they should be isolated. OpenAI also said researchers supplied infrastructure source code, configuration details and documentation about possible vulnerabilities to make the tests favorable to an attacker. The exercises used purpose-built copies of the company’s systems and included monitoring and programmatic checks designed to pause out-of-scope activity. The account therefore describes a deliberate security exercise, not agents spontaneously discovering a way to communicate during ordinary model training. ^{[1] [3]}

OpenAI said other experiments found timing channels involving shared storage, competition for CPU time and a TLS certificate cache. It characterized most of the channels as slow and difficult for models to exploit, and said it added monitoring checks to detect communication attempts. The Verge independently reported the cache experiment and the new monitoring, while Tom’s Hardware noted that cache-based covert communication between virtual machines predates this test. A 2017 paper at the Network and Distributed System Security Symposium documented a robust cache channel between cloud virtual machines; the new claim is that red-team agents implemented a signaling protocol in the tested environment. ^{[1] [2] [3] [4]}

Why cache timing matters

The result illustrates a limit of network-focused isolation: software can block ordinary messages while multiple workloads still share physical components whose performance changes are observable. OpenAI said the work led to tighter network restrictions, software patches and monitoring changes across its environment. The company also said it resumed reinforcement-learning training and internal inference on Oct. 1 after strengthening safeguards. Its post does not report that these synthetic test secrets were real customer data or that the cache channel was used in an incident outside the exercise. ^{[1] [2] [3]}