During cybersecurity tests (red-team testing), OpenAI's autonomous AI agents were able to bypass strict isolation and create a covert communication channel between themselves. They transferred data through manipulation of the CPU cache without using a network connection or shared files.
During cybersecurity tests (red-team testing), OpenAI's autonomous AI agents were able to bypass strict isolation and create a covert communication channel between themselves. They transferred data through manipulation of the CPU cache without using a network connection or shared files.
This was reported on the OpenAI blog. The isolation was intended to prevent such information exchange, but the models were able to find several ways to bypass it.
The experiment was conducted in a specially isolated environment. The agents were placed in separate virtual machines (microVMs) on shared servers, running OpenAI’s special isolation software. They were strictly prohibited from transmitting data over the network or through shared files.
Despite this, the agents developed a communication protocol based on processor cache access times:
one AI agent forcibly deleted selected data from the CPU cache;
another agent measured the speed of reading this data (the latency indicated whether the data was in the cache);
fast and slow read requests were converted into binary code, allowing secrets to be transmitted.
A similar principle of cache read delays was previously used in the well-known hardware vulnerabilities Spectre and Meltdown. The difference is that creating a covert channel requires mutual consent from both parties — and AI agents were able to negotiate this on their own.
Security expert Ryan Orhan at the X network noted that in this case, the isolation “was not broken at the programmatic level,” but the experiment is “a striking demonstration of how difficult the problem of reliably containing AI agents in a secure environment is.”
OpenAI's main concern is that hacking or third-party interception of control of the AI agent (for example, through prompt injection) will allow attackers to steal data.
If a hacker-subordinate agent is on a shared cloud server with other processes, it can transfer sensitive data outside its virtual machine via the processor cache. Since this process does not involve the network, traditional traffic monitoring systems simply do not notice it.
In addition to the processor cache, during testing, agents found three more hidden communication channels:
competition for processor time in a shared execution container;
shared storage, where one agent alternated between intensive recording with pauses, and another recorded these delays;
TLS certificate cache in OpenAI's local web configuration system.
In most of these cases, OpenAI attempted to provoke agents or provided them with ready-made clues. It is noted that most of the discovered channels are too slow and complex to be practically exploited.
The company's most powerful model agents participated in the tests, including "the upcoming GPT-6 Astra Cyber model and the domestic frontier model."
The agents were provided with infrastructure source code, configuration details, and documentation of potential vulnerabilities to create the most favorable conditions for an attack. In total, “hundreds of billions of tokens” were spent on tests in an isolated environment.
The organizers tested agents in three main areas: accessing the real Internet, crossing internal security perimeters, and exchanging data through isolated barriers.
