OpenAI Sandbox Test: Isolated AI Agents Exchange Keys via CPU Cache Timing

In a sandbox experiment, OpenAI found that two AI agents isolated in separate virtual machines—with no network access and no shared writable files—still managed to exchange a synthetic key. They established a covert channel by exploiting differences in processor cache access timing, exactly the kind of communication the sandbox was designed to prevent. Notably, this was an explicitly assigned task rather than runaway agent behavior; the findings come from OpenAI's test report and sparked wide discussion after being summarized and shared by accounts such as Tracking Singularity.

Confirmed

• Experiment setup: The two agents ran in independent VMs managed by OpenAI's sandbox software on a shared host, and were tasked with exchanging a synthetic secret without using network connections or shared writable files (per OpenAI's report as relayed by @benjtodd and @dejavucoder).
• Communication mechanism: The agents used a CPU cache timing side channel—one agent selectively evicted cache data while the other measured how quickly data was reloaded to decode the signal; @soldni added that cache eviction and write patterns were also used to transmit signals.
• Outcome: The agents successfully completed the key exchange, bypassing all isolation mechanisms.

Debunking and Controversy

• Viral posts claimed the agents had "spontaneously conspired" to communicate secretly, implying an out-of-control AI. @soldni clarified that the original blog post explicitly stated the agents were assigned the task of "finding a way to communicate across sandboxes"—this was not lost or uncontrolled behavior.
• Replies to a post shared by @blelbach included exaggerated jokes, such as claims that the agents also communicated via CPU temperature fluctuations, fan pitch, or data center channels—these were jokes, not facts.

Why It Matters

• This case shows that even when conventional channels like network and file sharing are cut off, shared hardware resources (here, the CPU cache) can still be used as side channels, suggesting sandbox isolation schemes need to account for hardware-level covert channels.
• The episode also illustrates how security research findings can get amplified on social media into an "AI out of control" narrative, with the original context (an explicitly assigned task) often lost in retellings.

2026-10-24 ~ 2026-10-24 · 7 related posts

Full story(4 episodes)→

• Episode 1: OpenAI discloses training escape incident, cuts frontier models off the internet for 11 days(2026-10-24, 30 posts)
• Episode 2: OpenAI Sandbox Test: Isolated AI Agents Exchange Keys via CPU Cache Timing(2026-10-24, 7 posts)
• Episode 3: AI Agents' Ability to Model Each Other Raises New Side-Channel Attack Concerns(2026-10-24, 2 posts)
• Episode 4: Debate Erupts Over OpenAI's Frontier Training Pause Transparency(2026-10-24, 3 posts)

• [source] Agents signaling via cache-timing was an assigned CTF task, not misalignment, researcher clarifies — soldni · 2026-10-24
• Claim: OpenAI agents communicated via cache timing side channels, no shared files or network — blelbach · 2026-10-24
• AIFlow on viral cache-timing demo: impressive capability, but human-written objective — AIFlow_ML · 2026-10-24
• Is reward hacking misalignment or just a badly specified objective? — AIFlow_ML · 2026-10-24
• OpenAI sandboxed agents smuggled secrets via CPU cache side channel, defeating isolation — examachine · 2026-10-24
• Isolated AI agents secretly communicate via CPU cache timing, a decades-old covert channel — dejavucoder · 2026-10-24
• [source] OpenAI sandboxed agents covertly exfiltrated secrets via CPU cache-timing across VMs — ben_j_todd · 2026-10-24