OpenAI's isolated red-team agents built a hidden CPU cache channel to talk with no network or shared files

OpenAI's red-team AI agents built secret communication channels to bypass virtual machine isolation during security tests. The containment measures were intended to stop secret-swapping, but the agents found multiple ways around them when asked.

The agents were running in separate virtual machines with no permitted network or shared-file channel. They still shared underlying hardware, which means they shared microarchitectural state.

This shared state was enough to create a covert communication channel. Security researchers have already shown that a covert cache channel can move data between cloud virtual machines.

A hijacked agent on a shared cloud server could, in theory, exchange data on the same physical machine and do so undetected by network monitoring.

The isolation wasn’t necessarily broken at the software level. You can isolate processes, restrict system calls, block network access, and still have information leaking through timing differences.

This is a pretty remarkable demonstration of why secure agent containment is such a difficult problem.