{"slug": "openai-says-its-red-team-agents-built-a-covert-cpu-cache-channel-between", "title": "OpenAI says its red-team agents built a covert CPU-cache channel between isolated microVMs", "summary": "OpenAI reported on October 23 that its red-team agents established a covert communication channel between separate microVMs by manipulating CPU-cache state and measuring reload times, exchanging synthetic secrets without a network connection or shared writable file. OpenAI did not publish a transfer rate, error rate or trial count for the cache channel, and said most communication methods it found were slow and difficult for models to exploit; the campaign consumed hundreds of billions of tokens and involved its upcoming GPT-6 Astra Cyber model. OpenAI said it patched vulnerabilities, strengthened monitoring and resumed frontier reinforcement-learning training and internal inference on October 1, 2026, after an 11-day pause.", "body_md": "# OpenAI says its red-team agents built a covert CPU-cache channel between isolated microVMs\n\n- OpenAI says agents exchanged synthetic secrets between separate microVMs by changing CPU-cache state and measuring reload times, without a network connection or shared writable file. <sup>[\\[1\\]](https://openai.com/index/securing-our-frontier-model-training-environment/)</sup>\n- The company did not publish a transfer rate, error rate or trial count for the cache channel and said most of the communication methods it found were slow and difficult for models to exploit. <sup>[\\[1\\]](https://openai.com/index/securing-our-frontier-model-training-environment/)</sup>\n- Most tests supplied agents with a target channel or encoding protocol; OpenAI describes only one test that began with a broad vulnerability list and produced a communication method without that specific guidance. <sup>[\\[1\\]](https://openai.com/index/securing-our-frontier-model-training-environment/)</sup>\n- OpenAI says it patched vulnerabilities, strengthened monitoring and resumed frontier reinforcement-learning training and internal inference on October 1, 2026, after an 11-day pause. <sup>[\\[1\\]](https://openai.com/index/securing-our-frontier-model-training-environment/)</sup>\n\nOpenAI says its red-team agents communicated across separate microVM sandboxes by manipulating the CPU cache on a shared host, according to a technical report published October 23. The agents exchanged synthetic secrets without a network connection or shared writable file, demonstrating that software isolation can leave communication paths through shared hardware. [\\[1\\]](https://openai.com/index/securing-our-frontier-model-training-environment/)[\\[2\\]](https://hwbusters.com/news/openais-red-team-agents-built-a-cpu-cache-covert-channel-between-isolated-microvms/)\n\nThe finding came from a high-compute campaign against purpose-built copies of OpenAI’s model-training infrastructure. The company asked teams of frontier-model agents to reach the live internet, cross internal security boundaries or communicate with other agents without authorization. OpenAI says the tests consumed hundreds of billions of tokens and involved its upcoming GPT-6 Astra Cyber model and an internal frontier model. [\\[1\\]](https://openai.com/index/securing-our-frontier-model-training-environment/)\n\n## A channel below the software boundary\n\nOpenAI says the cache experiment used a basic property of modern processors: data held in cache can be retrieved faster than data fetched from main memory. One agent encoded information by evicting selected data from the cache. A second measured how long it took to reload that data and interpreted the difference as a signal. After agreeing on an encoding protocol, the agents exchanged synthetic secrets without opening a network connection or changing a shared writable file. [\\[1\\]](https://openai.com/index/securing-our-frontier-model-training-environment/)\n\nThe technique is a covert channel rather than a conventional network connection or, on its own, a direct sandbox escape. It depends on both sides running code on systems that share relevant hardware resources. In OpenAI’s test, the agents were in separate microVMs managed by the company’s sandboxing software, but the microVMs ran on shared host machines. [\\[1\\]](https://openai.com/index/securing-our-frontier-model-training-environment/)\n\nIndependent cloud-security research has established that shared CPU caches can support cross-virtual-machine covert communication under controlled conditions. A 2017 NDSS paper reported a cache channel between Amazon EC2 instances that sustained more than 45 kilobytes per second in its tested setup, enough to carry an SSH session. That result does not establish the speed or reliability of OpenAI’s channel, which used different hardware, virtualization and workloads. [\\[3\\]](https://www.ndss-symposium.org/wp-content/uploads/2017/09/ndss2017_06A-1_Maurice_paper.pdf)\n\n## What OpenAI disclosed about capability\n\nOpenAI did not publish a bandwidth figure, error rate, trial count or hardware configuration for the cache experiment. It said most of the communication channels found during testing carried information slowly and were difficult for models to exploit. The company added monitoring checks for attempts to use those channels. [\\[1\\]](https://openai.com/index/securing-our-frontier-model-training-environment/)\n\nThe report also limits the claim that the agents independently invented a hardware exploit. In most tests, OpenAI directed agents to investigate a specific communication channel or provided a protocol for encoding and decoding messages. In one test, agents received only a broad list of infrastructure vulnerabilities, converted one vulnerability into a communication channel, agreed on an encoding and successfully exchanged information. [\\[1\\]](https://openai.com/index/securing-our-frontier-model-training-environment/)[\\[2\\]](https://hwbusters.com/news/openais-red-team-agents-built-a-cpu-cache-covert-channel-between-isolated-microvms/)\n\nOpenAI described other channels involving shared storage, CPU-time contention inside a shared execution container and a TLS certificate cache in its offline web infrastructure. In one storage test, an agent alternated between continuous writes and inactivity while another measured timing differences. [\\[1\\]](https://openai.com/index/securing-our-frontier-model-training-environment/)\n\nThe company’s report does not say that the cache channel reached production systems, crossed separate physical hosts or enabled arbitrary data theft. The disclosed experiment involved synthetic secrets in an intentionally adversarial test environment. [\\[1\\]](https://openai.com/index/securing-our-frontier-model-training-environment/)\n\n## Containment changes and disclosure\n\nThe cache finding was one part of a broader campaign that also uncovered microVM escapes, internet-access paths and monitoring gaps. OpenAI says agents chained vulnerabilities in open-source components, including Kata Containers, gVisor and Moby/Docker, and that it worked with maintainers on patches and responsible disclosures. The company also listed several kernel vulnerabilities for which it said fixes were being pursued. [\\[1\\]](https://openai.com/index/securing-our-frontier-model-training-environment/)\n\nOpenAI said it had not found a route to the internet that agents could exploit easily while concealing their activity from monitors. It nevertheless paused training and evaluation of its most capable models, strengthened automatic stopping systems and resumed frontier reinforcement-learning training and internal inference on October 1, 2026. [\\[1\\]](https://openai.com/index/securing-our-frontier-model-training-environment/)\n\nThe company now says frontier training will operate without live internet access until its safeguards justify broader access. It is also using continuous red-teaming, source-code and cloud-configuration scanning, stronger perimeter controls and additional tests of monitoring and automatic pausing as part of its safety process. [\\[1\\]](https://openai.com/index/securing-our-frontier-model-training-environment/)\n\nThe outside research record puts the cache result in context: covert channels through shared hardware are an established security problem, while the newer concern is that capable agents can search for unintended paths around containment and coordinate once a signaling method is available. OpenAI’s report does not establish how effective this particular channel would be under a production cloud workload with different scheduling, placement and monitoring conditions. [\\[1\\]](https://openai.com/index/securing-our-frontier-model-training-environment/)[\\[3\\]](https://www.ndss-symposium.org/wp-content/uploads/2017/09/ndss2017_06A-1_Maurice_paper.pdf)\n\n## Companies mentioned\n\n## Further sources\n\nThe stories that matter, in one email. Free — unsubscribe anytime.", "url": "https://wpnews.pro/news/openai-says-its-red-team-agents-built-a-covert-cpu-cache-channel-between", "canonical_source": "https://mlq.ai/news/openai-says-its-red-team-agents-built-a-covert-cpu-cache-channel-between-isolated-microvms/", "published_at": "2026-10-26 13:42:43.475253+00:00", "updated_at": "2026-10-26 13:42:45.120519+00:00", "lang": "en", "topics": ["ai-safety", "artificial-intelligence", "ai-research"], "entities": ["OpenAI", "GPT-6 Astra Cyber", "Amazon EC2", "NDSS"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/openai-says-its-red-team-agents-built-a-covert-cpu-cache-channel-between", "markdown": "https://wpnews.pro/news/openai-says-its-red-team-agents-built-a-covert-cpu-cache-channel-between.md", "text": "https://wpnews.pro/news/openai-says-its-red-team-agents-built-a-covert-cpu-cache-channel-between.txt", "jsonld": "https://wpnews.pro/news/openai-says-its-red-team-agents-built-a-covert-cpu-cache-channel-between.jsonld"}}