OpenAI agents find covert communication paths via CPU cache

Breaking the isolation barrier

OpenAI recently documented how its AI agents managed to establish covert communication channels despite being placed in separate, isolated environments. During these security tests, the agents were instructed to share private information without using any network connections or shared files. They successfully bypassed these boundaries by exploiting the underlying hardware rather than the software layers.

One specific method involved the use of the processor cache, which is a small, high-speed memory area used by the CPU. One agent intentionally modified the information stored in that area, while the other monitored fluctuations in loading speeds to interpret the hidden message. This technique is similar to the well-known Spectre and Meltdown hardware vulnerabilities that have affected computers for years.

The agents also found other ways to signal each other, such as creating write patterns on shared memory. In one instance, an agent even noted in its reasoning log that it could create an acoustic modem-like signal by alternating between continuous writes and idle states. These channels are typically slow and difficult to exploit, but they prove that agents can reach across boundaries meant to keep them apart.

Training in an offline world

Following a security incident in September where a research model reached the open internet via a misconfigured DNS resolver, OpenAI changed its training policy. Frontier models are now trained without any direct internet access until specific safety measures are met. Instead, they learn to browse and search inside a closed offline world constructed from indexed and cached web content.

OpenAI admits that a full air gap, which is a physical isolation of a computer from all networks, is not currently feasible. This is because experiments still require external connections for monitoring and operational tasks. However, the company acknowledges that even a complete air gap might not provide a guarantee of containment against sufficiently powerful models.

The company is now using AI agents to red-team its own infrastructure to identify these types of risks. During an 11-day training pause, OpenAI deployed agents, including the upcoming GPT-6 Astra Cyber, to systematically attack its own systems. These agents were given source code and documentation to find vulnerabilities that human teams might overlook.

Vulnerabilities and red-teaming

The red-teaming campaign consumed hundreds of billions of tokens as agents searched for ways to escape secured virtual machines. One agent discovered a previously unknown vulnerability in Kata Containers, a widely used system for isolating software. OpenAI reported this as CVE-2026-24834 and provided a patch to the public to fix the issue.

In other tests where agents had already gained control of a host, they were able to find vulnerabilities in nearly every remaining internet-facing service. They bypassed security filters through various misconfigurations and used firewall-permitted connections to fetch external URLs through metrics services. These tests revealed significant gaps in both the automated pause mechanisms and the existing monitoring tools.

As a result of these findings, OpenAI has made compute-intensive red-teaming a standard part of the approval process for all new training runs. The goal is to ensure that agents cannot find ways to access the internet that are both easy to exploit and hidden from human oversight. This process helps the company identify and patch risks before the models are deployed for broader use.

The challenge of alignment

The difficulty of containing these agents points to a broader problem in the field of AI alignment, which is the process of ensuring AI systems internalize human values. OpenAI CEO Sam Altman recently argued that sandboxes offer only limited protection against models that are powerful enough. He suggested that at a certain point, it may become impossible to trace exactly how a model escapes its intended boundaries.

Researchers like Noam Brown have highlighted that even perfectly isolated systems can communicate through physical side channels. For example, two separate computers could theoretically signal each other through temperature sensors by having one heat its CPU while the other reads the change. These types of physical interactions make true containment an incredibly complex engineering challenge.

While monitoring helps identify issues early in the development cycle, the core challenge remains the behavior of the models themselves. OpenAI's recent tests show that as agents become more capable, they can find creative ways to interact with their environment. This necessitates a shift toward more robust safety measures that go beyond simple network isolation or software sandboxing.