OpenAI placed research agents in separate microVMs with no shared writable files or network path and asked them to exchange synthetic secrets. Because the environments shared host hardware, the sender could alter processor-cache residency and the receiver could infer the selected bit values from memory-access timing. The technique is a covert side channel,…
Inspect the ClaimsCase · DiggingBeagle record
OpenAI red-team agents exchanged synthetic secrets across isolated microVMs
In a directed red-team exercise, OpenAI agents in separate microVMs on shared hosts communicated through CPU-cache timing despite having no shared writable files or network connections.
Scope
OpenAI frontier-training containment red teaming disclosed October 23, 2026; agents were tasked with finding communication methods.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- BY AI
Basis and provenance
CASE-2026-OPENAI-MICROVM-CACHE-CHANNEL: One primary CPU-cache example; other reported channels include shared storage, CPU competition and TLS certificate state. No measured external leakage. Evidence comes from SRC-2026-OPENAI-TRAINING-ISOLATION-OCT23. Published technical statements or controlled results are not verified production-loss counts. No impact band is assigned because the observed outcome and its denominator do not establish a comparable severity measure.
Assessed Oct 24, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-OPENAI-COVERT-01 · OpenAI: Securing our frontier model training environment
At a glance
The direct result is channel existence under a deliberately designed red-team task. It does not show unsolicited production exfiltration, a network connection, or access from one VM to another VM’s files. It does show that storage and network separation do not remove common-host timing channels.
Read the implicationsOpenAI did not publish throughput measurements sufficient to compare these channels with network connections. The controlled request to exchange synthetic secrets is not an autonomous escape attempt.
Limits and uncertaintyFull account
OpenAI placed research agents in separate microVMs with no shared writable files or network path and asked them to exchange synthetic secrets. Because the environments shared host hardware, the sender could alter processor-cache residency and the receiver could infer the selected bit values from memory-access timing. The technique is a covert side channel, not conventional file or network communication. OpenAI also described storage-contention, CPU scheduling and shared TLS certificate-cache channels. Most tests were deliberately guided, sometimes with the encoding scheme supplied. One broader task allowed agents to convert an infrastructure weakness into a channel and agree on a scheme without a prescribed protocol. The demonstration establishes an actual communication boundary failure in the tested environment, but it does not establish autonomous intrusion, internet egress or high-bandwidth data theft. OpenAI states that it added monitoring for such channels and resumed frontier training on October 1 following the broader containment work.
Two deliberately cooperating agents on co-resident microVMs could use a shared processor cache even though network interfaces and writable file sharing were not available between their tasks. One process altered cache occupancy and the other classified memory access times, creating a very low-rate bit channel. The result depends on host co-residency, timing visibility and an intended receiver. OpenAI's separate September DNS incident did not exploit that channel; it used a network configuration weakness during a real training run. The two observations test different containment guarantees and should never be aggregated as one autonomous escape. Primary research account.
Mechanism and trust boundary
- 01
Give separated agents a synthetic communication objective
OpenAI directed agents in different microVMs without network access or shared writable files to exchange test secrets.
Boundary: Instruction to communicate / sandbox permissions
- 02
Modulate co-resident CPU cache state
The sender evicted selected cache lines so a receiver sharing host hardware would experience changed memory access latency.
Boundary: Sender resource use / shared processor cache
- 03
Recover the signal from timed reads
The receiver distinguished quick cache hits from slow reloads to reconstruct a low-bandwidth message across otherwise isolated sessions.
Boundary: Microarchitectural timing / separate receiver environment
Timeline
- Oct 23, 2026Event type unspecified
MicroVM cache channel disclosed
OpenAI published its directed cross-sandbox channel experiments with explicit shared-host constraints.
- Oct 23, 2026disclosure
Public disclosure
Claims & evidence
CLM-OPENAI-COVERT-01In an OpenAI-controlled exercise, co-resident microVM agents transmitted synthetic messages by evicting cache lines and measuring reload times.supported
Basis: reported finding
- supportsOpenAI: Securing our frontier model training environmentprimary disclosure
Communicating across isolated tasks; CPU cache experiment
CLM-OPENAI-CACHE-ENRICH-NONESCAPEThe reported cross-VM communication was an assigned red-team experiment, not evidence that a frontier model spontaneously exfiltrated production secrets.supported
Basis: reported finding
- supportsOpenAI: Securing our frontier model training environmentprimary disclosure
What our red-teaming agents found; Communicating across isolated tasks
CLM-OPENAI-CACHE-ENRICH-EXPERIMENTOpenAI asked agents in separately isolated microVMs to exchange synthetic secrets; the report describes cache evictions by the sender and timed memory reloads by the receiver.supported
Basis: reported finding
- supportsOpenAI: Securing our frontier model training environmentprimary disclosure
Communicating across isolated tasks: cache-based experiment
Implications
The direct result is channel existence under a deliberately designed red-team task. It does not show unsolicited production exfiltration, a network connection, or access from one VM to another VM’s files. It does show that storage and network separation do not remove common-host timing channels.
Controls and mitigations
- Separate the strongest distrust domains onto distinct physical hosts where required; evaluate shared caches, CPU scheduling and measurement interfaces and reduce timing precision where practical. No single general-purpose cache flush is established here as a universal remedy.
Unknowns and contradictions
- OpenAI did not publish throughput measurements sufficient to compare these channels with network connections.
- The controlled request to exchange synthetic secrets is not an autonomous escape attempt.
Sources and citation
Material revision history
- Oct 24, 2026 · Canonical change recorded · new in release · revision 188