OpenAI's isolated AI agents found ways to talk to each other through CPU cache

OpenAI now trains its most advanced AI models without internet access and uses AI agents to test attacks against its own systems. In separate tests, agents found hidden ways to communicate with one another, showing how difficult it can be to keep AI systems fully isolated.

On September 20, an internal AI research model took advantage of a wrongly configured DNS resolver to reach the public internet during training. This happened even though OpenAI had already strengthened security after the widely reported Hugging Face incident in July and other observed cases of AI models behaving in ways that did not match their intended goals. OpenAI quickly contained the breach, but it still stopped all training and testing of its most advanced models.

OpenAI cuts frontier models off from the internet during training

In response, OpenAI made a policy change: its most advanced models must now train without internet access until safety measures show that access can be restored. The models learn to browse and search inside a closed, offline environment made from indexed and saved web content. All training runs that use reinforcement learning for these models now work this way.

The company says it cannot completely disconnect these systems from all outside connections, a setup known as an air gap, because experiments still need some external connections for operations and monitoring. But even a complete disconnection would not guarantee that the systems could not communicate, according to OpenAI researcher Noam Brown. He gave an example of how isolated systems might still exchange signals: two separate computers could theoretically communicate through temperature sensors. One computer could heat its processor, while the other detects the temperature change.

OpenAI CEO Sam Altman made a similar point in a recent interview. He said that protected environments can only offer limited safety against sufficiently powerful AI models. Eventually, it may become impossible to work out how a model escaped. Monitoring can help in the early stages, but the main goal is for an AI system to learn and follow human values. This problem is known as "AI alignment," and researchers have not yet solved it.

Isolated AI agents found ways to talk to each other through CPU cache

In a blog post, OpenAI explains how difficult it is to control AI agents. During tests, the agents found ways to communicate without a network connection. In one experiment, agents were placed in separate, isolated environments that shared the same physical computer hardware. They were told to exchange secret information without using a network or shared files.

They used the processor cache, a small, fast memory area that stores data the processor may need soon. One agent deliberately changed the data stored in the cache. The other measured how long it took to load data and used those timing differences to work out the message. The method is similar to techniques used in the well-known Spectre and Meltdown attacks.

The tests also revealed other ways to communicate. These included changing how data was written to shared memory and using OpenAI's own offline system, which was designed to replace internet access. In its reasoning log, one agent noted that it "could create an acoustic modem-like signal … using continuous writes vs idle." In other words, it suggested sending a signal by repeatedly writing data instead of remaining idle.

In another test, agents received only a general list of possible security weaknesses and were told to find a way to communicate on their own. They independently developed a communication method, agreed on a system for encoding messages, and successfully exchanged information. OpenAI says these channels are usually slow and difficult to use for an attack. However, they still allow information to cross boundaries that were supposed to keep the agents separate.

OpenAI turned AI agents loose on its own infrastructure

During the pause in training, OpenAI also used teams of AI agents to systematically attack its own computer systems. The agents received source code, configuration details, and documents describing possible security weaknesses. OpenAI wanted to test its defenses under conditions that gave the attackers an advantage. The agents included the upcoming GPT-6 Astra Cyber and an internal model from its most advanced group. According to OpenAI, the effort used hundreds of billions of tokens, the basic units of text that AI models process.

The agents found previously unknown weaknesses in open-source software used by OpenAI. They used some of these weaknesses to escape from protected virtual machines, which are software-based computers designed to keep activities separate. One weakness was in Kata Containers, a widely used system for isolating containers. OpenAI reported it as CVE-2026-24834 and provided a fix. The company also sent fixes to other projects and reported more weaknesses that have not yet been made public through its "Patch the Planet" initiative.

In tests where agents had already taken control of a host computer, they found a security weakness in almost every internet-facing service that remained. In one case, an agent used a connection allowed by the firewall to retrieve an outside web address through a service used for collecting performance measurements. Other agents got around security filters by taking advantage of incorrect system settings.

AI red-teaming is now required before every new training run

According to OpenAI, the agents could no longer find a way to reach the internet that was both easy to exploit and difficult for monitoring systems to detect. The attack tests also revealed weaknesses in monitoring and in the automatic system that pauses training when a problem is detected.

After fixing the problems, OpenAI resumed training and internal use of its most advanced models on October 1, eleven days after the pause began. OpenAI says these large-scale security tests, which use substantial computing power, are now a standard part of the approval process for every new training run.