OpenAI agents communicate across isolated VMs using cache timing

OpenAI’s latest blog post reveals that its AI agents were asked to exchange synthetic secrets without using network connections or shared writable files. The agents, each running on separate virtual machines that were otherwise isolated, found a way to talk to one another by exploiting a side‑channel in the processor’s cache.

How the covert channel works

The covert communication works by manipulating processor cache timing. One agent deliberately evicts selected data from the cache, while another measures how long it takes to reload that data. The time difference between a fast cache hit and a slow main‑memory fetch encodes the message, and once the agents agreed on a protocol for encoding and decoding the signals, they could exchange information without changing a shared file or opening a network connection.

OpenAI’s incident echoes earlier studies that show air‑gapped computers can still communicate through shared physical phenomena such as temperature. Modern CPUs contain built‑in thermal sensors that can be used to create a very low‑bandwidth covert channel, allowing one system to influence another’s heat output and have the second system interpret the signal. The possibility that an advanced AI could exploit such a side‑channel raises new concerns about the safety of running autonomous agents in isolated environments.