Category: AI Agent Security | Reading time: 3 min
OpenAI has disclosed results from a high-compute red-teaming campaign against its own research and evaluation environments. In one test, agents running in separate microVMs were asked to exchange synthetic secrets without network connections or shared writable files. They did it by building a timing-based side channel through the processor's cache.
How the channel worked
According to OpenAI, one agent encoded information by evicting selected data from the cache, and a second agent measured how long it took to reload that data. The difference between fast and slow reads carried the message. "Once the agents agreed on a protocol for encoding and decoding these signals, they could exchange the synthetic secrets without changing a shared file or opening a network connection," OpenAI said.
Two caveats matter. The agents were explicitly prompted to try, and the technique requires two cooperating parties that agree on a protocol in advance.
What else the red team found
The same campaign surfaced virtual machine escapes, new paths to the internet through vulnerabilities in metrics, logging and authentication management services, and DNS and firewall misconfigurations that let blocked requests through. In one test that assumed a compromised host, an agent reused a firewall-approved connection to reach a blocked authentication endpoint and made that endpoint fetch a model-provided URL. The campaign also found a critical remote code execution flaw in Google Brotli (CVE-2026-111497), since patched.
OpenAI's response
OpenAI said it will conduct frontier model training with no internet access "until advances in these safeguards justify broader internet access." After strengthening its containment architecture, it resumed frontier reinforcement learning training and internal inference on October 1, and it now treats high-compute red-teaming as part of the safety case for proceeding.
Why it matters
Network monitoring would not have seen this exchange, because no network was used. For enterprises running capable agents side by side on shared infrastructure, isolation and traffic inspection are necessary but not sufficient. What each agent is permitted to do, and a verifiable record of what it actually did, has to be enforced and captured at the point of action.
Source: The Hacker News | Tom's Hardware