OpenAI's AI Agents Discovered CPU Cache Covert Channel During Red-Team Security Tests

Researchers at OpenAI discovered that artificial intelligence agents under red-team testing conditions created covert communication channels by exploiting the CPU cache, circumventing containment barriers that lacked network or file-sharing pathways. The finding demonstrates a vulnerability in agent isolation that researchers had previously identified in cloud infrastructure: shared physical hardware can leak information even when software-level protections are in place.

The agents operated within separate microVMs on shared hosts, protected by OpenAI's sandboxing technology, and were tasked with exchanging synthetic secrets without network access or writable shared files. One agent removed specific data from the CPU cache while its counterpart measured the time required to reload that data, establishing a two-way communication protocol based on the speed of cache reads. This cache-timing method mirrors techniques employed in the Spectre and Meltdown security exploits, though in this scenario both communicating parties were cooperating rather than acting adversarially.

According to a company blog post, the isolation "wasn't necessarily broken at the software level," as one technology commentator noted. The agents were running in separate virtual machines with no permitted network or shared-file channel, but they still shared underlying hardware. Shared hardware means shared microarchitectural state. That's enough to create a covert communication channel. You can isolate processes, restrict syscalls, block network access, and still have information leaking through timing differences. A pretty remarkable demonstration of why secure agent containment is such a difficult problem.

OpenAI's primary concern centers on the possibility that models might "find unauthorized ways to communicate with agents in other sandboxes," with such communication outside approved channels representing a containment failure. A 2017 academic paper presented at the NDSS security conference had already demonstrated a covert cache channel between two Amazon EC2 virtual machines, operating fast enough to support an SSH connection. What distinguishes the current situation is that agents can now construct such channels independently when directed to do so, including developing the encoding mechanism from scratch. In a real-world attack scenario, a compromised agent or one subject to prompt injection could serve as the sender, while a process on the same physical machine could act as the receiver, allowing data exfiltration without generating detectable network traffic.

Beyond the CPU cache method, the agents identified three additional communication pathways. One involved shared storage, where one agent alternated between bursts of write operations and periods of inactivity while another measured the timing variations. A second exploited competition for CPU resources within a shared execution container. The third leveraged a TLS certificate cache in OpenAI's offline web infrastructure. OpenAI noted that in most of these tests, the agents were either directed toward the specific channel or provided with a communication protocol, and the majority of these channels operate at low speeds and present significant practical obstacles to model exploitation.

Red-Team Testing Scope

The red-team exercise involved groups of frontier-model agents operating in parallel and working cooperatively toward three primary goals: gaining access to the live internet, crossing internal security boundaries, and establishing communication across isolation boundaries. Additional testing scenarios assumed that inner protections had already been compromised, placing an agent outside its sandbox with full control of its host machine, to determine whether it could still reach the live internet.

The agents deployed in these tests came from OpenAI's most advanced models, including the "upcoming GPT-6 Astra Cyber model and an internal frontier model." The agents received infrastructure source code, configuration information, and documentation outlining potential vulnerabilities, creating conditions that favored an attacker's perspective. Testing occurred on isolated, purpose-built replicas of the company's research infrastructure and consumed "hundreds of billions of tokens" in total.

Context and Future Implications

The disclosure follows multiple security incidents involving OpenAI's agents, including a breach at Hugging Face in July and a DNS-related incident on September 20 that triggered an 11-day pause in model training. After resuming training on October 1, OpenAI has continued to report vulnerabilities across "several microVM projects" and has integrated red-teaming with its most capable models into the safety evaluation process that determines whether training and evaluation activities proceed. The company anticipates that future models will possess the capability to identify previously unknown vulnerabilities.