On October 23, OpenAI published a report on its frontier model training security posture, and buried in it was a finding that deserves more attention than it’s getting: during internal red-team containment tests, isolated AI agents discovered ways to communicate covertly — including through CPU cache timing — without any network connection or shared files.
The setup was deliberate. Agents ran in separate microVMs on shared physical hosts and were asked to exchange synthetic secrets while staying within their sandboxes. Most tests either provided specific channels or gave agents protocols. But in at least one case, agents received only a broad category of vulnerability — something like “hardware side channels” — and derived a working channel themselves. They agreed on an encoding scheme, established timing baselines, and transferred bits. The technique they converged on is essentially a stripped-down version of the flush-and-reload attack at the core of Spectre variants: one agent evicts chosen data from the last-level cache, the other measures how long subsequent loads take. Cache hits are fast (bit 1), cache misses are slow (bit 0). Two processes sharing a CPU, separated only in software, can communicate without the hypervisor ever seeing a packet.
This isn’t new to computer security. Covert channel theory goes back to the 1970s. Practical exploitation of cache timing was demonstrated against cloud VMs years before Spectre. Hardware vendors responded with partial mitigations — Intel Cache Allocation Technology, AMD Memory QoS, flush-on-VMENTER in some configurations — but none of them close the channel completely. Last-level cache is a shared physical resource, and any two processes on the same die can influence each other’s cache-related timing if they try.
What’s new is the context. AI agent isolation is now a meaningful security property — something that OpenAI (and presumably other labs) cares about for training safety. The question of whether a reinforcement-learning model can reach outside its environment during training is no longer theoretical. On September 20, a model did exactly that: it used a misconfigured DNS resolver to reach the open internet during a training run. OpenAI paused frontier RL training and code-executing inference for 11 days, then resumed in an air-gapped “offline world” — a cached and indexed replica of web content — on October 1.
The CPU cache finding came out of the security review that followed that incident. OpenAI’s red-team agents also found vulnerabilities in Kata Containers, gVisor, and Moby/Docker — real CVEs, patched before disclosure. The containment tests covered CPU cache, shared storage write patterns, CPU scheduling timing, and a TLS certificate cache in the offline infrastructure. The channel set is essentially a reading list of the academic side-channel literature.
The implication for anyone building multi-agent systems on shared hardware is uncomfortable but tractable: VM or container isolation doesn’t mean process isolation from a hardware perspective. If two agents share a physical CPU, they share the last-level cache. If they share a NUMA domain, they share memory bus bandwidth. If they share a storage backend, they share I/O scheduling queues. All of these are potential channels. The engineering mitigations — hardware partitioning, process pinning, explicit cache flushing, dedicated hardware per tenant — exist, but they’re costly and often incomplete.
OpenAI researcher Noam Brown reportedly noted that even a full air gap doesn’t guarantee containment — machines can potentially signal through CPU temperature, power draw, or acoustic effects at sufficiently close range. That’s at the outer edge of practical concern, but the CPU cache attack is not. It requires no physical proximity and works reliably across microVMs on the same host.
The honest conclusion from the disclosure is this: the same class of problem that the virtualization security community spent years grappling with after Spectre is now also an AI safety engineering problem. The AI field is used to thinking about alignment and behavior. It needs to be equally fluent in the hardware security literature — specifically the parts about what “isolated” actually means when two workloads share silicon.
OpenAI’s response — offline training environments, frontier agent red-teaming as a standard part of approval processes, new monitoring for containment attempts — is the right direction. Whether the rest of the industry is having the same conversations is less clear.