Security Experts War-Game AI Agents Covertly Talking via CPU Cache Side Channels

Cryptographer Matthew Green, security researchers Halvar Flake and Juergen Strobel, and others engaged in a notable online technical exercise: could two independent AI agents covertly communicate through CPU cache side channels with no network connection at all? The current conclusion: the communication mechanism itself has technical precedent and is not hard to implement; the real puzzle is how two independent agents would "privately agree" on a protocol in the first place.

Confirmed

• Matthew Green laid out a concrete scheme: Agent 1 sweeps the cache (or LLC) at a fixed cadence, evicting all cache lines; on a shared core, a few bps of bandwidth is enough to establish a channel
• Responding to doubts about feasibility, Green said signaling isn't difficult—simple encodings like "modulating the first few primes" could be understood by any agent, or even a smart child
• Halvar Flake argued two agents could plausibly negotiate a side-channel protocol, because agents with related training "will have strongly correlated ideas" and can independently converge on memory-region selection, encoding, and synchronization schemes

Unconfirmed

• Juergen Strobel pointed out the core doubts remain: how agents sample memory locations and measure cache hits/misses is nontrivial, and there is no explanation for how two independent agents would agree on conventions like "does a cache miss count as 0 or 1," which memory region to use, or how to synchronize. Flake's correlation argument is speculation, not empirical evidence

Why it matters

• The discussion connects classical hardware side-channel research with AI agent safety: if autonomous agents can establish covert channels via shared hardware resources even in isolated environments, traditional defenses like physical isolation and air-gapping may fail—with direct implications for the security design of AI sandboxes and multi-tenant deployments

2026-10-25 ~ 2026-10-27 · 6 related posts

• [source] How did two independent AI agents agree on a cache covert-channel protocol? — JuergenStrobel · 2026-10-25
• Matthew Green: agents covertly signaling via primes is 'not that hard' — matthew_d_green · 2026-10-27
• [source] Halvar Flake: strongly correlated training explains agents agreeing on covert protocols — halvarflake · 2026-10-27
• [source] Matthew Green explains how AI agents could talk via cache side channels at just a few bps — matthew_d_green · 2026-10-27
• Security experts debate AI agents covertly communicating via CPU cache side channels — matthew_d_green · 2026-10-27
• Cryptographer Matthew Green: coding agents make cache timing side-channel experiments nearly trivial — matthew_d_green · 2026-10-27