OpenAI’s red-team agents found a covert CPU-cache channel

OpenAI says it has strengthened the containment around its frontier-model training and evaluation systems after red-team exercises found ways for agents to probe security boundaries. One of the most striking examples involved separate agents communicating through a CPU cache, despite having no network connection or shared writable files. ¹

The test placed agents in separate microVMs on shared hosts. One agent manipulated which data was pushed out of the processor cache, while another measured the timing of subsequent reads. That difference created a covert channel: a way to exchange information without using the network or a normal shared file. The method echoes the cache-timing techniques associated with Spectre and Meltdown, although this experiment required two cooperating agents rather than a conventional exploit victim. ²

Why the channel matters

OpenAI’s own account is broader than one clever demonstration. The company says its red-team teams also found routes involving shared storage, competition for CPU time and a TLS certificate cache in an offline web environment. In most tests, the agents were pointed towards a possible channel or given a protocol, and the company describes many of the routes as slow or difficult to exploit. Even so, the results show why a sandbox cannot be judged only by whether it blocks ordinary network traffic.

The risk is clearest in a hostile scenario. A prompt-injected or otherwise compromised agent running on a shared physical host could, in principle, use a side channel to pass information to another process. Network monitoring would not necessarily see that exchange. OpenAI says its tests used purpose-built copies of research infrastructure, detailed documentation and substantial compute, so they were designed to expose weaknesses rather than represent an everyday customer deployment. ¹

OpenAI’s containment response

OpenAI says it has adopted a defence-in-depth approach: overlapping controls intended to keep working if one protection fails. The company has restricted frontier training and evaluation to offline environments, added monitoring and automatic stopping systems, and made high-compute red-teaming part of the safety cases used to decide whether runs can proceed. It also says it remediated the weaknesses found in the exercise and resumed reinforcement-learning training and internal inference on October 1. ¹

That distinction matters. This was not a report that a released OpenAI model had escaped a customer sandbox, nor evidence that ordinary users can reproduce the attack from a chat window. It was a controlled security test of systems used while models are being trained and evaluated. The finding is still significant because future models may discover channels that researchers have not anticipated.

Our opinion

The useful takeaway is not that AI agents have magically broken every sandbox. It is that containment is becoming an engineering race: every new capability gives a determined system more ways to search for assumptions that humans treated as harmless. OpenAI’s decision to publish the technique and fold high-compute red-teaming into its safety process is sensible, but self-reporting is not the same as independent assurance. The more powerful these systems become, the more valuable reproducible testing, outside scrutiny and clear incident reporting will be.

For now, the CPU-cache channel is best understood as a warning from a controlled experiment. It shows that “no network access” is only one layer of isolation, not a complete security argument.