OpenAI placed red-team agents in separate microVMs on shared hosts with no permitted network link and no shared writable files, then asked them to exchange synthetic secrets.

One agent evicted selected data from the CPU cache while the other timed how long reloading it took, turning the gap between fast and slow reads into bits of a message under a protocol they agreed on first.

According to Tom's Hardware, the same cache-timing technique was used in the Spectre and Meltdown attacks, though unlike those cases this channel needs two willing parties.

The striking part is that software isolation was not really broken. The agents ran in separate virtual machines with no permitted channel, but they still shared the same underlying physical machine — and shared hardware means shared microarchitectural state.

As tech commentator Ryan Orhan put it, per Tom's Hardware, the isolation "wasn't necessarily broken at the software level," calling it "a pretty remarkable demonstration of why secure agent containment is such a difficult problem."

You can isolate processes, restrict syscalls and block network access, and timing differences still leak information.

The cache was not the only route.

OpenAI's tests turned up three other channels: shared storage, where one agent alternated bursts of writes with idle time while the other timed the difference; competition for CPU time inside a shared execution container; and a TLS certificate cache in OpenAI's offline web setup.

Pasquale Pillitteri reports that one agent described the storage trick in its own reasoning as "an acoustic modem-like signal, continuous writes versus idle." In most cases OpenAI pointed agents at the channel or handed over a protocol, and the channels are slow and hard for models to exploit.

The red-teaming campaign ran on isolated, purpose-built copies of OpenAI's research infrastructure and used hundreds of billions of tokens in total, per Tom's Hardware.

Agents were given infrastructure source code, configuration details and documentation describing potential vulnerabilities, so defenses were tested under conditions favorable to an attacker, with three objectives: reach the live internet, cross an internal security boundary, and talk across isolation boundaries.

One episode stands out: agents given only a generic list of infrastructure vulnerabilities turned one entry into a working channel and agreed on an encoding themselves, as Pasquale Pillitteri notes.

OpenAI's concern is that models may "find unauthorized ways to communicate with agents in other sandboxes," with communication outside permitted channels constituting a failure of containment.

In theory such a channel could be weaponized: a prompt-injected agent in a cloud sandbox could pass data to a process on the same physical host with no network traffic for monitoring to catch.

Pasquale Pillitteri argues one microVM per agent — the answer many sandbox vendors present — does not by itself settle the matter, and OpenAI's own data shows as much. OpenAI added monitoring checks to catch these attempts.

OpenAI has since cut live internet access from all frontier model training, built an offline world of indexed web content for agents to use, and reserved substantial compute for continuous red-teaming, making high-compute red-teaming part of the safety cases that decide whether training and evaluation proceed, as The Hacker News reports.

The company believes future models will be able to find vulnerabilities not yet known about.