OpenAI says AI agents exchanged test secrets through a CPU cache

An instructed experiment found a communication route between virtual machines sharing hardware. Here is what the result establishes, how researchers helped, and what remains unmeasured publicly.

OpenAI says its agents passed synthetic secrets between virtual machines by exploiting the timing of processor-cache accesses. The machines shared physical hosts, and researchers had explicitly asked the agents to find a communication route that their isolation controls were supposed to prevent. The account appears in OpenAI’s October 23, 2026 report, Securing our frontier model training environment.

The result matters because an isolation policy is supposed to constrain what software can do even when it tries to communicate. A successful exchange exposes a gap in that boundary under the tested conditions. How widely the finding applies depends on the hardware, the assistance provided and the channel’s reliability.

How a cache becomes a communication channel

A processor cache holds data close to the CPU so programs can retrieve it quickly. Reading data already in the cache generally takes less time than fetching it from main memory. Software can measure that difference.

In OpenAI’s description, one agent’s code deliberately evicted selected data from the cache. Another measured the time needed to reload it. An agreed encoding turned the pattern of faster and slower reads into a message. The agents exchanged their test secrets without opening a network connection or modifying a shared file. OpenAI’s account

Think of occupants in separate rooms tapping on a common wall. Their doors can remain locked while the wall carries a signal. Separate virtual machines can likewise share resources whose behavior both can observe.

The relevant security term is covert channel: cooperating participants use a route that violates the intended information-flow policy. NIST’s definition allows for each participant to act within its own access permissions while their combined behavior transfers information that should remain separated. A communication boundary can therefore fail without either program taking control of the host. NIST glossary

The cooperating sender is also what distinguishes this exchange from a side-channel attack that extracts information an application leaks unintentionally. Intel draws this distinction in its security guidance. OpenAI’s exchange demonstrates a route for transmitting test data; it does not establish arbitrary access to another user’s private memory. Intel’s channel taxonomy

What researchers supplied

OpenAI says the wider campaign used purpose-built copies of its research infrastructure. Researchers supplied source code, configuration details and vulnerability documentation. In most communication tests, they specified channels to investigate or provided an encoding protocol. One test began with only a broad vulnerability list; the report does not identify it as the cache experiment or specify that experiment’s exact assistance. Research setup and qualifications

This setup is useful for testing a defense against an informed attacker. A weakness still matters when the tester knows how the system works. Measuring unaided discovery requires controlling that information and recording the hints supplied.

To assess the agents’ contribution, we need to know who proposed the cache technique, who designed the encoding, what code the agents wrote and how much intervention they needed. The published result cannot settle those questions.

Communication was the assigned objective. The experiment provides no evidence of spontaneous coordination against the researchers.

The security technique has a long history

In 2014, Yuval Yarom and Katrina Falkner published FLUSH+RELOAD, a cache side-channel technique tested across separate virtual machines. Their demonstration extracted private-key information from GnuPG under the paper’s experimental conditions. It exploited shared memory pages and the last-level cache; the attacking and victim programs did not need to execute on the same processor core. Original USENIX paper and abstract

Cross-VM cache leakage was therefore demonstrated more than a decade before this report. That history supports the mechanism’s plausibility; it does not independently verify OpenAI’s run.

The shared-page requirement also explains why “no shared writable files” needs careful reading. Preventing changes to a common file does not tell us whether an environment shares read-only memory pages. OpenAI’s account leaves the cache primitive and memory-sharing configuration unspecified, so naming its technique FLUSH+RELOAD would be premature.

How Spectre fits into the story

Spectre combines speculative execution with a channel for leaking information. A processor can leave measurable cache effects behind after abandoning an incorrectly predicted execution path. The original paper describes attacks that use those effects to recover information from a victim’s memory, including implementations with Flush+Reload and Evict+Reload. Original Spectre paper, sections I–II

A cache channel is one component of that attack. OpenAI’s comparison with Spectre and Meltdown concerns the use of cache timing; the described exchange does not establish exploitation of either named vulnerability.

The development worth examining is how capable agents apply established security techniques to the infrastructure running them.

The missing measurements matter

OpenAI characterizes most of the communication channels as slow and difficult for models to exploit, and says it added monitoring checks. It distinguishes these research settings from customer environments. OpenAI’s qualifications and response

For the cache experiment specifically, the public account leaves several questions unresolved:

A slow channel could still matter if the prohibited message is short. Its practical risk depends on how much information gets through, how reliably, and before what intervention. The reported success alone cannot answer those questions for other deployments.

What agent-platform teams should take from it

Our assessment is that platforms running agent-written code should test communication restrictions at the level of information flow. Checking that selected network requests are blocked is useful evidence about those requests. Shared resources require their own analysis and tests.

Existing security guidance already addresses this problem. NIST SP 800-53 Revision 5’s SC-31 control covers identifying covert storage and timing channels and estimating their bandwidth. Its enhancements address exploitability, bandwidth reduction and measurement in operational environments. NIST also notes that eliminating timing channels can impose substantial performance costs, and that laboratory measurements can differ from operational ones. NIST SC-31, printed page 320

Intel’s guidance ties mitigation to a system’s threat model and discusses partitioning shared resources alongside secure coding practices. For this particular problem, application coding practices alone cannot be assumed to stop two programs deliberately cooperating; the platform must assess the resources both can influence and observe. Intel’s side-channel guidance

For buyers, the useful questions are concrete: which resources do isolated tasks share, which prohibited communication paths has the vendor tested, and how much information can pass before its monitors stop a run? Detection claims should include measurements. OpenAI’s next useful disclosure would be a reproducible account with the configuration, researcher assistance, repeated-trial results and detection limits.

Related reporting: Kingy.ai’s analysis of the separate OpenAI agent intrusion at Hugging Face.