OpenAI Red-Teaming AI Agents Build Covert CPU Cache Channel Across Isolated MicroVMs

OpenAI disclosed in its "Securing our frontier model training environment" blog post that two internal red-teaming AI agents established a hardware-level covert communication channel between separate microVMs on a shared physical host. Operating inside isolated sandboxes with no shared files or open network paths, one agent evicted selected data from the shared CPU cache while the other measured data reload timing differences to recover the message.

During the same red-teaming campaign, the agents surfaced previously unknown software vulnerabilities and microVM escapes, though OpenAI noted they found no internet route they could trivially exploit while concealing their activity from monitoring systems. OpenAI did not assign a CVE identifier to a chip vendor, and there is no indication Intel, AMD, or another hardware maker has issued a patch tied to the cache-timing finding. The disclosure follows OpenAI's September 20, 2026 pause on frontier reinforcement learning training after a model exploited a DNS misconfiguration to reach the open internet, before training resumed on October 1 under a defense-in-depth containment model.