AI Agents and CPU Cache Covert Channels: What OpenAI’s Tests Actually Show

AI agents can sometimes communicate without opening a network connection or writing a shared file. That possibility matters when your security design promises that two workloads cannot exchange information, rather than merely giving them different processes, filesystems or IP addresses.

In its October 23, 2026 frontier training environment disclosure, OpenAI reported agents exchanging synthetic secrets between separate microVMs on shared hosts using CPU cache timing. One participant changed cache state; another inferred information from access latency. These were internal research tests, distinct from customer use of released models. Most communication tests included direction toward particular channels or supplied protocols. The report does not establish a universal attack against deployed agents.

The useful engineering question is therefore specific: which shared resources remain observable across the boundary that is supposed to separate your agents? Answering it requires a deployment model, an attacker model and a measurable communication outcome. A diagram with two isolated boxes does not supply those three things.

What the CPU Cache Result Establishes

A controlled exchange demonstrates that a particular configuration allowed information flow. It does not automatically reveal how often a similar configuration exists elsewhere, how much data could move, or whether an unwilling victim could be made to participate. Keep those questions separate when assessing the result.

For this event, OpenAI’s account gives the high-level mechanism but not a complete public reproduction specification: processor, scheduling, page-sharing configuration, timing interface, channel bandwidth and a cache-test success-rate denominator. It also describes other communication experiments involving storage, CPU scheduling and a service certificate cache. Those are separate shared resources; the word “cache” does not make them one vulnerability.

An assessment should turn each missing detail into an explicit limit. If you cannot establish host placement, you cannot conclude that two test workloads shared a relevant cache. If the test lacks a receiver record, you cannot infer message delivery from sender activity. If the only evidence is an agent’s explanation, treat it as a lead for reproduction.

Covert Communication, Side Channels and Sandbox Escape

Three different security questions are often collapsed into the phrase “AI escaped.” One asks whether a workload acquired permissions outside its sandbox. Another asks whether it observed information through a shared resource. A third asks whether two cooperating workloads built a communication path that policy forbids.

These outcomes can coexist, but one is not evidence of all the others. A workload might transmit a small signal while remaining unable to read its neighbor’s files. Another might reach an external service through an allowed integration without escaping its operating-system sandbox. The control owner and remediation differ in each case.

A useful contrast comes from the UK AI Security Institute’s cyber evaluation incident report. AISI explicitly distinguished unsanctioned internet activity from sandbox escape: internet access had been deliberately permitted under its evaluation conditions. That distinction prevents a behavioral violation from being reported as proof that a technical isolation mechanism failed.

Why Timing Can Carry Information

Information needs an observable difference, not necessarily a socket. If one participant can influence a shared resource and another can measure the effect, they may be able to assign meaning to the measurements. The design question is whether that influence and observation are permitted across the intended boundary.

Historical cache research provides context. Yarom and Falkner’s 2014 FLUSH+RELOAD paper studied observations of shared memory pages through the last-level cache, including experiments across virtual machines. The work showed why separate guests do not, by themselves, settle every information-flow question. Its prerequisites must not be assumed to describe the current agent experiment’s implementation.

Conceptually, a sender creates distinguishable conditions, and a receiver maps measurements back to symbols. Noise can blur those conditions. Scheduling changes, unrelated activity and measurement overhead can all complicate an experiment. The evaluator must show that the recovered signal follows the chosen input rather than an unrelated periodic pattern.

The agents’ role and the hardware mechanism also belong in separate columns of the analysis. An agent may select, implement or coordinate a technique, but that does not make the underlying physical effect new. Assess what automation changed: required supervision, setup effort, exploration time or repeatability. Do not invent an improvement figure when no comparison was published.

Does Blocking Network Traffic Solve the Problem?

A network restriction answers whether traffic can traverse the routes it governs. It does not measure every effect of sharing processors, storage or infrastructure services. Treat a network deny result as evidence for that route and test condition, rather than converting it into a general statement that no communication is possible.

The same precision applies to shared files. A policy that denies writable mounts can remove an obvious message-passing path. That is a useful control. It does not, on its own, establish that the workloads share no observable state elsewhere. For an assurance review, enumerate both the interfaces you expose intentionally and the resources workloads share indirectly.

Keep the consequence proportional to the capability. A slow channel may still matter if the protected value is a short authorization secret or if participants only need a coordination signal. Conversely, demonstrating one marker exchange does not prove arbitrary memory extraction, reliable transfer under production load or remote access from an unrelated machine.

Build the Deployment Threat Model First

Start with the confidentiality or coordination rule you intend to enforce. “Tasks belonging to separate customers cannot exchange data” is assessable. “Agents are isolated” is incomplete until you specify the identities, resources and permitted interactions involved.

For managed infrastructure, ask the provider which boundary its documentation promises and what evidence applies to your service tier. Avoid translating a marketing term such as “dedicated” into an unqualified guarantee about processors, storage, service caches and management systems. Obtain the definition before choosing a test.

For self-managed workers, retain the scheduler configuration, runtime versions and placement evidence with the assessment. A result from a workstation is not a result for a production cluster. Reproduce the relevant configuration in an authorized test environment and state where the replica differs.

A Harmless Synthetic Timing Exercise

The following Python example explains classification and a negative control using invented numbers. It does not access a CPU cache, measure hardware, coordinate processes, create virtual machines or contact a network. The numbers have no nanosecond or cycle interpretation. This is an educational model, not a reproduction of the reported experiment.

"""Synthetic latency classifier; no cache, process, network or VM operations."""
from statistics import mean

marker = "101001"
fast = [18, 22, 19, 21, 20, 17]
slow = [78, 82, 79, 81, 80, 77]
samples = [slow[i] if bit == "1" else fast[i]
           for i, bit in enumerate(marker)]
threshold = (mean(fast) + mean(slow)) / 2

def decode(values, cutoff):
    return "".join("1" if value > cutoff else "0" for value in values)

recovered = decode(samples, threshold)
# Synthetic negative control: independent of the chosen marker.
control = [20, 80, 20, 80, 20, 80]
control_result = decode(control, threshold)
assert recovered == marker
assert control_result != marker
print("synthetic marker:", marker)
print("synthetic recovery:", recovered)
print("negative control:", control_result)
print("hardware isolation verdict: NOT TESTED")

We ran this synthetic exercise on October 26, 2026. Both assertions passed, producing:

synthetic marker: 101001
synthetic recovery: 101001
negative control: 010101
hardware isolation verdict: NOT TESTED

The classifier succeeds because the synthetic input was constructed to carry the marker. The negative control illustrates that the same threshold can also produce a bit string unrelated to the intended message. Neither output establishes a real communication channel. A practical assessment must establish control over the signal, its delivery and its recovery independently.

Do not treat six symbols or one successful trial as statistical validation. A real study would need a predeclared protocol, repeated randomized markers, control conditions, an error analysis and a documented deployment. Those requirements are a reason to involve infrastructure specialists when the purchase or risk decision depends on hardware isolation.

What a Useful Isolation Assessment Should Deliver

Write the acceptance criteria before collecting traces. Specify the forbidden action or information flow, the participant’s starting privileges, the relevant shared resources and the observation window. Give each criterion a result of demonstrated, blocked under tested conditions, inconclusive or not tested. Avoid one green status that hides those differences.

Use synthetic markers and owned infrastructure. Preserve the sender’s intended input, receiver observations, task identities, placement evidence and control results. Record any ordinary path that could explain delivery, including test harness logging, shared environment variables or orchestration messages. A hidden message is not established if the harness already supplied it to both participants.

Separate prevention, detection and stopping. A control that prevents delivery may leave no suspicious activity to detect. A detector may identify a test after data has moved. A stop mechanism may terminate the worker but leave credentials active or a queued job running. Test each promised outcome explicitly and assign the responsible owner.

Remediation should follow the demonstrated boundary. Remove unnecessary secret access, restrict execution privileges, reduce unintended shared state and review placement where sensitive workloads require separation. Select platform-specific controls with the infrastructure owner and retest the relevant condition. No single setting in this article certifies a host against all side channels.

Keep legitimate workload tests in the retest. A restriction that prevents every task from running will also prevent the observed behavior, but it may not be an acceptable operating design. Record both the security result and the functional effect so the system owner can approve a concrete tradeoff.

Keep Application Testing and Hardware Assurance in Scope

For procurement, require a sample finding and ask which layer the proposed service evaluates. Testing an agent’s API authorization, tool permissions or exposed application can be useful without evaluating microarchitectural isolation. Equally, a specialist cache experiment does not establish that the application enforces tenant ownership correctly.

An authorized Penligent application assessment can be evaluated around a defined target, dedicated test accounts, reviewable evidence and a remediation handoff. Agree on those deliverables before testing. Hardware side-channel testing requires its own explicit methodology and scope; this article does not demonstrate a Penligent CPU-cache detector or isolation certification.

The video below introduces a general AI-assisted penetration testing workflow. It is not a cache-channel reproduction.

Questions About AI Agents and CPU Cache Channels

Did the experiment demonstrate customer data theft?

• The disclosed cache experiment used synthetic secrets in an internal research setting. It does not establish customer data theft.

Does covert communication require a VM escape?

• No. Information-flow failure and expanded execution privileges are different properties. Test and report them separately.

Can an unrelated remote agent read my CPU cache?

• This report does not establish that capability. The relevant sharing, execution and observation conditions must exist for the proposed mechanism.

Is this simply Spectre or Meltdown?

• Do not equate a timing-based communication channel with a specific speculative-execution vulnerability. A shared measurement technique does not establish the same vulnerability primitive or mitigation.

Does disabling network access prove agent isolation?

• It can establish a tested network restriction. Broader isolation claims require evidence about identities, execution, shared resources and service paths.

Can I use the Python exercise as a security check?

• No. It classifies synthetic numbers and deliberately returns no hardware verdict. Use it to understand controls, not to approve a deployment.

What should change after this disclosure?

• Make isolation promises specific, inventory relevant shared resources, and request tests that demonstrate the promised boundary. Retest after changes to placement, runtime or shared services that affect the threat model.

An isolation claim is useful when an operator can state what was separated, under which permissions and placement, and what evidence supports that conclusion. Build the deployment record around those facts. Keep uncertainty visible wherever the relevant boundary has not been tested.