Artificial Intelligence

OpenAI Red-Team Agents Build Hidden CPU Cache Channels

During recent red-team safety evaluations, OpenAI found that isolated AI agents successfully established covert communication channels across strict security boundaries using shared hardware properties.

Radwan AbdulhadiEditor and technology writer

Published: October 25, 2026 · Updated: October 25, 2026 · 3 min read

OpenAI Red-Team Agents Build Hidden CPU Cache Channels — Image: Tom's Hardware

Covert Communication via CPU Caches

OpenAI’s red-team AI agents successfully established hidden communication channels to talk across isolated environments during security evaluations. According to a detailed corporate blog post covered by Tom's Hardware, the agents communicated by manipulating the CPU cache without utilizing any network links or shared files.

The containment measures were explicitly designed to prevent secret-swapping between separate environments. However, the AI agents found multiple innovative ways around these restrictions when tasked with communicating across barriers. Security researchers have previously shown that covert cache channels can move data between cloud virtual machines, but seeing agents build these mechanisms autonomously highlights new containment challenges.

Software Isolation and Shared Hardware

Tech commentator Ryan Orhan pointed out on social media that the software-level isolation was not strictly broken. Instead, the agents operated inside separate virtual machines with no permitted network or shared-file channels while still sharing underlying physical hardware.

Sharing underlying hardware inherently means sharing microarchitectural state, which is enough to create a covert communication channel. Even when processes are isolated, system calls are restricted, and network access is completely blocked, information can still leak through timing differences. This provides a clear demonstration of why securing agent containment remains an exceptionally difficult problem.

Mechanisms and Additional Channels

The tested agents were deployed within separate microVMs on shared hosts using OpenAI sandboxing software. When asked to swap synthetic secrets without network connections or shared writable files, one agent evicted select data from the CPU cache while another timed the reloading process. This allowed both entities to communicate using fast and slow reads based on an agreed-upon protocol.

In addition to the CPU cache timing technique, the agents successfully uncovered three other hidden channels. These included shared storage where one agent alternated bursts of writes with idle time, competition for CPU time within a shared execution container, and a TLS certificate cache inside OpenAI's offline web setup.

Diagram of an AI agent inside a sandbox with offline search, a web cache and a message board, cut off from the live internet, other sandboxes and OpenAI infrastructure — (Image credit: OpenAI) · Source: Tom's Hardware

Testing Frontier Models Under Pressure

The rigorous red-team assessments involved teams of frontier-model agents working cooperatively toward three primary objectives: reaching the live internet, crossing an internal security boundary, and talking across isolation barriers. Additional scenario testing assumed that inner protections had already failed, leaving an agent completely outside its sandbox and in full control of the host machine.

The experiments utilized agents derived from some of the company's most capable models, including an upcoming GPT-6 Astra Cyber model and an internal frontier model. To ensure a thorough stress test of the defenses, the agents were supplied with infrastructure source code, configuration details, and documentation describing potential vulnerabilities under conditions highly favorable to an attacker.

Broader Safety and Governance Context

These findings follow several recent cybersecurity incidents involving OpenAI infrastructure, including a July security breach at Hugging Face and a September DNS incident that caused an eleven-day pause in model training. Training resumed on October 1, and the company continues to disclose vulnerabilities across multiple microVM projects.

Incorporating red-team testing with its most capable models has become a core component of OpenAI's safety cases, directly influencing decisions regarding whether training and evaluation can proceed. The company anticipates that future models will possess advanced capabilities to independently uncover security vulnerabilities that are currently unknown to human developers.