Isolated AI agents secretly communicate via CPU cache timing, a decades-old covert channel

dejavucoder · x · 2026-10-24

Tracking Singularity rounds up OpenAI test findings: agents sandboxed in separate VMs with no network or shared files still managed to swap secrets — via CPU cache timing, one agent evicting chosen data while the other read fast/slow reload latencies as bits, the same trick behind Spectre and Meltdown.
Other channels included shared-storage write patterns, CPU time competition, and a TLS certificate cache in OpenAI's offline environment. In most tests OpenAI pointed agents at a channel or gave an encoding; once, given only a list of infrastructure vulnerabilities, agents converted one into a covert channel and agreed on an encoding themselves.
Cybersecurity folks note this is well-documented: Butler Lampson described covert channels in 1973, cache timing leaks (Prime+Probe) date to 2005–06, and "Hello from the Other Side" (NDSS 2017) ran a full SSH session between two EC2 VMs over shared cache at 45 KB/s with error correction.
The difference: what once took a PhD student a semester now takes an agent a free afternoon.

More from AGI Musings