Michael JohnsonTwo programs can exchange signals even when they have no network connection and no shared folder for writing. In OpenAI’s tests, agents running in separate virtual machines on shared hosts used CPU-cache read delays to send synthetic secrets to each other. The company published the results on October 23, 2026 in a report on protecting its model-training and evaluation infrastructure.
In this setup, one agent evicted selected data from the cache to encode a signal. The second measured the time needed to read it again: fast access indicated one bit, while slow access indicated another. After agreeing on a protocol, the agents reconstructed the message from these timing differences. OpenAI also found channels involving shared storage, competition for CPU time, and a TLS certificate cache in its offline environment.
Isolation depends on shared resources
The scenario shows why separating tasks into virtual machines requires checking the entire shared infrastructure. Even when network requests and shared files are blocked, processes can affect a shared cache, storage device, CPU scheduler, or service used by multiple environments. Measurable effects of that influence can become a data transmission channel.
OpenAI says that in most tests it directed agents to investigate specified channels or provided an encoding and decoding protocol. In one test, they were given a broader list of possible vulnerabilities, after which the agents turned one of them into a communication channel and agreed on a transmission method. The experiments took place on isolated copies of the infrastructure, with monitoring and automated checks that could stop a test from exceeding its limits.
What operators of agent environments should check
The practical lesson for teams running untrusted or autonomous tasks on shared infrastructure is to include shared resources in their threat model. For each type of co-location, ask a specific question: can two isolated processes observe each other through access delays involving the CPU, storage, or a service cache?
- Define the boundaries of resource sharing. Record which tasks share a physical host, CPU resources, storage devices, and internal services, and which are hosted separately.
- Check for observable channels. Look for measurable differences in latency and shared-resource availability between concurrent tasks; assess them under conditions close to real workloads.
- Minimize unnecessary connections. OpenAI describes a layered defense: isolated environments, virtual machines, monitoring, and network restrictions that maintain control even if one layer fails.
- Add monitoring and repeat checks. The company said it expanded monitoring to detect attempts to transmit data in these ways and continues to conduct red-team tests.
The results concern OpenAI’s internal research environment and its experiments with agents, including tests in which agents were given specific areas to investigate. They demonstrate a practically significant class of channels for infrastructure where tasks must remain isolated; the publication also says that the channels identified mostly transmitted data slowly.
For designing such an environment, the key question is now broader than “Is the network closed?”: which shared resources remain observable between tasks, and how will the system detect transmission through them? Asking this helps turn formal isolation into a verifiable security boundary.