Green and Levchin Debate How Easily AI Agents Can Covertly Communicate via Side Channels
Cryptographer Matthew Green and Brex/MRI founder Max Levchin held a public discussion on the new side-channel security risks posed by AI agents. Green's core assessment: five years ago, side-channel attacks against shared resources were "academically feasible but nobody would bother"—a thesis project that would take six months with no academic payoff; now, with AI agents, such attacks have gone from paper exercises to something doable in about two hours, a qualitative shift in the realism of the threat model.
Confirmed
- Levchin demonstrated and confirmed that it's "fairly easy" to get an agent like Astra to reuse known cache timing probing techniques: it has read a mountain of relevant papers and code, and with explicit instructions or hints it can establish covert communication across isolation boundaries between processes or hypervisors.
- Green agreed: getting a model to use known cache timing side-channel techniques isn't hard—relevant papers and probing code are abundant, and a prompt is enough to put it into action.
- Levchin further commented on agents inventing their own communication protocols: the encoding itself is nothing special—any medium that can encode 0s and 1s will do; what truly distinguishes them from humans is that an agent can exchange a mere few bits flawlessly using enormous computational effort, and that "zero-hallucination" precision is the most impressive part.
Why it matters
- Their discussion shows that traditional security boundaries relying on shared hardware resources (caches, etc.) for isolation become fragile once agents can read papers and write probing code; defenders need to reassess the effectiveness of cross-process/cross-hypervisor isolation.
- Green stressed that the truly hard, unsolved problem isn't getting a single agent to use side channels, but getting multiple agents to spontaneously establish cooperative communication—a key indicator worth watching when assessing autonomy risks in AI systems.
2026-10-24 ~ 2026-10-24 · 5 related posts
Primary sources
- Matthew Green: AI makes side-channel attacks a 2-hour project instead of 6 months — matthew_d_green ·
- Levchin: agents like Astra can readily reuse cache-timing tricks to signal across isolation — mlevchin ·
- Matthew Green: getting AI to use cache-timing channels is easy — self-coordinated covert signaling is the hard part — matthew_d_green ·
- Max Levchin on AI agents' self-made protocol: the encoding is trivial, the zero-hallucination execution is the real story — mlevchin · 2026-10-24
- [source] Matthew Green: getting AI to use cache-timing channels is easy — self-coordinated covert signaling is the hard part — matthew_d_green · 2026-10-24
- [source] Levchin: agents like Astra can readily reuse cache-timing tricks to signal across isolation — mlevchin · 2026-10-24
- [source] Matthew Green: AI makes side-channel attacks a 2-hour project instead of 6 months — matthew_d_green · 2026-10-24
1 near-duplicate retellings: matthew_d_green