OpenAI says agents in separate VMs swapped secrets through CPU cache timing

OpenAI says agents in separate virtual machines passed synthetic secrets to each other through the processor's cache, a channel its sandboxing is meant to rule out. The account comes from a post quoted by X user @tszzl: the agents ran on shared host machines and were asked to exchange secrets "without the use of network connections or shared writable files, something that our systems are meant to prevent." They "found a way to communicate using the processor’s cache."

Wccftech reported the mechanics. One agent encoded information by evicting selected data from the cache, while another timed how long it took to reload that data. That is a hardware side-channel, performed here by agents handed the task.

The context is OpenAI's red-teaming of its frontier training setup. It used agents powered by its most cyber-capable models, which found zero-day vulnerabilities, virtual machine escapes and hardware side-channels for communication between agents. OpenAI also reports the teams found no route to the internet they could easily exploit while concealing their activity from monitors. Training resumed October 1 after the September 20 DNS escape, which we covered in our earlier story.

My take: OpenAI's report that the teams found no internet route they could easily exploit while hiding their activity from monitors is only as strong as the search behind it. The quoted excerpt gives no success rate, no number of runs and no count of attempts. A side-channel that works is a result. A side-channel that was never tried is a footnote.