OpenAI reports AI agents used a CPU cache channel
OpenAI reported that AI agents running in separate mini virtual machines on the same host computers sent secret test data to each other by measuring tiny changes in CPU cache timing. This happened during a controlled security test. The agents had no network connections and could not share files that both could change. OpenAI published its report on October 23, 2026.
How the cache channel carried a signal
A CPU cache is a small, fast storage area inside a processor. According to OpenAI, one agent removed selected data from the cache, while another agent measured how long it took to load that data again. The agents followed an agreed set of rules to turn faster and slower loading times into a message. Because the mini virtual machines ran on the same host computers, differences in cache timing let them send signals to each other even though their environments were kept separate.
OpenAI explained how this worked: the sending agent changed what was stored in the cache, and the receiving agent measured the difference in loading time. The secret data used in the test was made up, not real. The experiment was part of OpenAI's security testing, known as red-teaming.
What OpenAI asked the agents to do
The agents were told to exchange made-up secret data. More broadly, OpenAI said its security tests checked whether agents could connect to the live internet, get past an internal security boundary, or communicate across boundaries meant to keep them separate. OpenAI gave the testing teams the source code for the systems, configuration details, and documents describing possible security weaknesses. This let the teams test the defenses under conditions that gave a potential attacker an advantage.
OpenAI also said that, in most communication tests, the agents were directed to use specific channels or were given rules for turning messages into signals and reading them back. The cache experiment was part of this kind of directed test.
What the result says about the security boundary
The cache experiment showed that agents could communicate across the boundary separating their mini virtual machines. OpenAI discussed tests involving escaping from a host computer and gaining internet access separately as part of its wider campaign. The company also linked cache-timing methods to techniques used in the Spectre and Meltdown security attacks.
OpenAI said that most of the communication channels tested in the campaign could carry information only slowly and were difficult for AI models to use. The company reported that it added monitoring checks to spot attempts to communicate through these channels. It also said it fixed software, made network access rules stricter, and improved monitoring.