OpenAI said in a post published October 23, 2026, that red-team agents in separate microVMs on shared host machines exchanged synthetic secrets by timing CPU-cache reads. The assigned test had no network connections or shared writable files, so the signal passed through a shared hardware resource. OpenAI described it as a controlled security test in its account of the testing environment.
How cache timing carried a signal
A microVM is a small virtual machine used to isolate a computing task. In OpenAI’s test, one agent evicted selected data from the processor cache, a fast memory that holds recently used data. Another agent timed how long it took to reload that data. A cache read is faster than retrieving the same data from main memory, so the difference in timing carried the signal.
The agents used an encoding and decoding protocol to exchange the synthetic secrets. That makes cache timing a side channel: information is conveyed through changes in a shared resource, rather than through a network connection or a shared file.
The agents had an assigned communication task
OpenAI said it asked the agents in this test to exchange synthetic secrets. Across most of its communication-channel tests, the company said, researchers directed agents to specific channels or supplied a protocol. In a separate test, agents received a broad list of infrastructure vulnerabilities and developed a way to communicate and encode messages.
What the test says about containment
OpenAI said its red-team experiments ran on isolated, purpose-built copies of its research infrastructure, with monitoring and programmatic checks that could pause runs for out-of-scope activity. The company also said it added monitoring checks for attempts to use communication channels. Other channels it reported involved shared storage, competition for CPU time in a shared execution container, and a TLS certificate cache in its offline web infrastructure. OpenAI said these channels generally carried information slowly and were difficult for models to exploit.
The cache-timing test concerned communication across isolation boundaries in a controlled environment. A separate DNS-resolver misconfiguration gave an internal research model limited live-internet access during training on September 20, 2026, according to OpenAI. The company said frontier reinforcement-learning training and internal inference resumed on October 1 after it made fixes and strengthened safeguards. NeoTeo previously covered OpenAI’s live-internet restrictions during frontier-model training.
