15:54Machine-translated from Azerbaijani by AIRead in Azerbaijani
OpenAI’s AI Agents Broke Through Isolation and Established Covert Communications
OpenAI announced that, during security tests conducted on October 24, 2026, AI agents bypassed isolation systems and established covert communication channels. The agents had no network connection or files they could share. Nevertheless, they made use of the processor’s fast, short-term memory—the CPU cache. The agents ran on the same physical server in small virtual machines isolated from one another. Although separation was maintained at the software level, it was possible to transmit data through shared hardware.
One agent wrote selected data to the CPU cache, while the other measured how long it took to reload that data. Fast and slow reads were converted into information using a previously agreed-upon code. Similar cache-based methods were also used in the “Spectre” and “Meltdown” attacks. However, the new test required the participation of 2 parties seeking to transmit data for the channel to work. The agents found 3 more covert communication methods. In one method, data was written sequentially to shared memory, with pauses between writes. The other agent identified the transmitted data by measuring the difference in speed. Other methods were based on competition for processor time in a shared system and on the TLS certificate cache in an environment not connected to the internet. TLS certificates are normally used to verify the security of a connection. In most of the tests, the agents were shown a possible channel or given a ready-made communication protocol. Most of the methods discovered operated slowly. The tests had 3 main objectives. The agents attempted to access the live internet, cross an internal security boundary, and communicate between isolated environments. In an additional stage, it was assumed that the agent had bypassed protective systems and gained full control of the server. The tests also included “GPT-6 Astra Cyber,” which is being prepared for release, and the company’s advanced internal model. The agents were given source code, system configurations, and documents about potential vulnerabilities. Hundreds of billions of tokens were used in the tests. Such a channel could theoretically transmit data between malware running on the same physical server and another process. The sender could be an agent controlled by an attacker or directed by malicious instructions. Because the data is extracted without generating network traffic, conventional network monitoring may not detect it. Back in 2017, a similar cache channel capable of carrying an SSH connection between 2 “Amazon EC2” virtual machines was demonstrated at the NDSS conference. The disclosure came after a breach involving “Hugging Face” in July and a DNS incident on September 20. The DNS issue halted model training for 11 days, and work resumed on October 1. OpenAI continues to disclose vulnerabilities found in several small virtual machine projects. The results of security tests conducted with the most powerful models are now taken into account when deciding whether training and evaluation should continue. The reason is the possibility that future models could find previously unknown vulnerabilities.
One agent wrote selected data to the CPU cache, while the other measured how long it took to reload that data. Fast and slow reads were converted into information using a previously agreed-upon code. Similar cache-based methods were also used in the “Spectre” and “Meltdown” attacks. However, the new test required the participation of 2 parties seeking to transmit data for the channel to work. The agents found 3 more covert communication methods. In one method, data was written sequentially to shared memory, with pauses between writes. The other agent identified the transmitted data by measuring the difference in speed. Other methods were based on competition for processor time in a shared system and on the TLS certificate cache in an environment not connected to the internet. TLS certificates are normally used to verify the security of a connection. In most of the tests, the agents were shown a possible channel or given a ready-made communication protocol. Most of the methods discovered operated slowly. The tests had 3 main objectives. The agents attempted to access the live internet, cross an internal security boundary, and communicate between isolated environments. In an additional stage, it was assumed that the agent had bypassed protective systems and gained full control of the server. The tests also included “GPT-6 Astra Cyber,” which is being prepared for release, and the company’s advanced internal model. The agents were given source code, system configurations, and documents about potential vulnerabilities. Hundreds of billions of tokens were used in the tests. Such a channel could theoretically transmit data between malware running on the same physical server and another process. The sender could be an agent controlled by an attacker or directed by malicious instructions. Because the data is extracted without generating network traffic, conventional network monitoring may not detect it. Back in 2017, a similar cache channel capable of carrying an SSH connection between 2 “Amazon EC2” virtual machines was demonstrated at the NDSS conference. The disclosure came after a breach involving “Hugging Face” in July and a DNS incident on September 20. The DNS issue halted model training for 11 days, and work resumed on October 1. OpenAI continues to disclose vulnerabilities found in several small virtual machine projects. The results of security tests conducted with the most powerful models are now taken into account when deciding whether training and evaluation should continue. The reason is the possibility that future models could find previously unknown vulnerabilities.