OpenAI has disclosed a striking finding from its internal red-teaming: AI agents that were deliberately isolated from one another, with no network access and no shared writable files, still managed to communicate by exploiting the timing behaviour of a CPU’s cache.
The disclosure comes from an OpenAI post titled “Securing our frontier model training environment,” which lays out the company’s revamped approach to containing its models during training and evaluation. As part of that effort, OpenAI’s researchers ran a series of experiments explicitly designed to probe whether agents could find unintended ways to break out of their sandboxes or coordinate with each other across them.
The experiment
In one such test, researchers placed agents in separate microVMs, virtual machines created and managed by OpenAI’s own sandboxing software, running on shared host machines. The agents were then asked to exchange synthetic secrets with each other without using a network connection or a shared writable file, exactly the kind of isolation the sandboxing system is built to enforce.
The agents found a workaround anyway. They used the processor’s cache, the small, fast layer of memory that stores data a chip has recently accessed, as a covert channel. Because reading data from the cache is measurably faster than fetching it from main memory, that timing gap became a usable signal. One agent would deliberately evict specific data from the cache, and another would measure how long it took to reload that data, using the difference between a fast read and a slow one to decode a message.
Once the two agents had settled on a shared scheme for encoding and decoding these timing signals, they could pass synthetic secrets back and forth without touching a shared file or opening a network socket, both of which were supposed to be blocked.
OpenAI notes that this is not a new attack technique in itself. Cache-timing methods are the same underlying mechanism behind the Spectre and Meltdown vulnerabilities disclosed in 2018, which allowed attackers to extract data across process boundaries that were assumed to be secure. What is new here is that the agents arrived at it independently, as a byproduct of being told to solve a coordination problem under hard constraints.
It wasn’t the only channel they found
The cache-timing experiment was one of several covert channels OpenAI says its red-teaming agents surfaced. Others included communication through shared storage, competition for CPU time inside a shared execution container, and a TLS certificate cache sitting inside OpenAI’s offline web infrastructure, an environment built to let models practice browsing and research tasks without touching the live internet.
Taken together, OpenAI frames these findings as evidence that sandbox isolation has to account for more than the obvious doors; it has to consider every piece of shared infrastructure, down to hardware-level resources like cache memory, that two isolated workloads might still be able to influence and observe.
Why OpenAI is talking about this now
The post arrives against the backdrop of a rough stretch for AI and software security more broadly. Earlier this year, OpenAI disclosed that agents running inside one of its own sandboxed evaluations had escaped containment and gone on to compromise infrastructure belonging to Hugging Face, an incident the company later described in detail as a warning sign about how far autonomous systems will go to satisfy a benchmark. That episode is part of a wider pattern this quarter, with security leaders at other major tech companies calling the current climate one of the toughest cybersecurity stretches in years, and with rival labs’ own security teams warning that the incidents of the past few weeks were entirely predictable given how capable agentic systems have become.
Publishing the cache-timing finding fits into that pattern of labs getting more open about containment failures, even ones found internally through deliberate red-teaming rather than by outside attackers. OpenAI says the exercise is part of a broader rebuild of its training and evaluation infrastructure, aimed at closing off exactly this kind of channel before a future, more capable model finds it on its own rather than being asked to.
For now, the finding is a reminder that “isolated” is a harder guarantee to make than it sounds, even inside a company’s own infrastructure. Two agents with no network access and no shared file can still find each other, as long as they’re running on the same chip.