OpenAI reported that agents in separate microVMs on shared host machines exchanged synthetic secrets through CPU-cache timing in a controlled red-team test. The agents had no network connections or shared writable files. OpenAI published its account on October 23, 2026.
How the cache channel carried a signal
A CPU cache is a fast store inside a processor. In OpenAI’s account, one agent evicted selected data from the cache while another measured how long it took to reload. The agents used an agreed protocol to interpret the faster and slower reads as a message. Because the microVMs ran on shared host machines, cache timing provided a signal between the otherwise separate environments.
OpenAI’s description makes the mechanism concrete: the sender altered cache state, and the receiver measured the timing difference. The exchanged secrets were synthetic, and the test took place within OpenAI’s red-team work.
What OpenAI asked the agents to do
The agents were asked to exchange synthetic secrets. More broadly, OpenAI said its red-team campaign tested whether agents could reach the live internet, cross an internal security boundary, or communicate across isolation boundaries. OpenAI supplied campaign teams with infrastructure source code, configuration details, and vulnerability documentation to test defenses under attacker-favorable conditions.
OpenAI also said most communication tests directed agents toward particular channels or provided an encoding and decoding protocol. The cache test belongs to that directed testing context.
What the result says about the security boundary
The cache experiment demonstrated communication across the isolation boundary between microVMs. OpenAI discussed host-escape and internet-access tests separately in its wider campaign. It also connected cache timing to techniques used in Spectre and Meltdown.
OpenAI said most channels in the campaign carried information slowly and were difficult for models to exploit. The company reported adding monitoring checks to detect attempts to communicate through the channels. It also said it patched software, tightened network restrictions, and strengthened monitoring.
