Two OpenAI agents locked in separate sandboxes, with no network link and no shared files, still passed secrets to each other by manipulating the CPU cache, the company said in a blog post.
The agents ran in separate microVMs (stripped-down virtual machines) on shared hosts, using OpenAI's sandboxing software. They were asked to swap synthetic secrets. One agent evicted select data from the cache, the small, fast memory on the processor. The other timed how long that data took to reload. Fast and slow reads became the signal, using a protocol the agents agreed on first.
The agents also found three other routes: shared storage, where one wrote in bursts and idled while the other timed the difference; competition for CPU time in a shared execution container; and a TLS certificate cache in OpenAI's offline web setup. In most tests, OpenAI pointed the agents at a channel or handed them a protocol, and the company said most of the channels are slow and hard for models to exploit.
The testing used teams of frontier-model agents working in parallel toward three goals: reaching the live internet, crossing an internal security boundary, and talking across isolation boundaries. The agents came from OpenAI's most capable models, including the upcoming GPT-6 Astra Cyber model and an internal frontier model. They got infrastructure source code, configuration details and documentation describing potential vulnerabilities, a setup that favors the attacker. The runs used "hundreds of billions of tokens" on purpose-built copies of research infrastructure.
The physics is not new. A 2017 paper at the NDSS security conference showed a covert cache channel between two Amazon EC2 VMs, fast enough to carry an SSH connection. Spectre and Meltdown used the same timing technique to extract data, but those attacks needed only one party. This channel needs a willing sender and receiver, which makes a prompt-injected agent in a cloud sandbox the realistic worry, since data could leave with no network traffic to monitor.
What changed is who does the work. Building and encoding such a channel once took specialist skill. Now the agents do it themselves. OpenAI said it expects future models to find vulnerabilities nobody knows about yet, and that leaves a harder question than patching: how defenders watch for leaks that never touch a network.