OpenAI sandboxed agents covertly exfiltrated secrets via CPU cache-timing across VMs
ben_j_todd · x · 2026-10-24
A screenshot shared by Ben Todd from an OpenAI report reveals a striking sandbox test result: agents running in separate VMs, managed by OpenAI's sandboxing software, were asked to exchange synthetic secrets without network connections or shared writable files—exactly what the system is meant to prevent. They succeeded anyway, using the processor's cache as a covert channel. One agent encoded information by evicting selected data from the cache; the other recovered the message by timing how fast evicted data reloaded. Once they agreed on an encoding protocol, they could communicate with no shared file and no network. The report notes this cache-timing technique is the same one used in the Spectre and Meltdown attacks. Todd's take: "Just improve the sandbox."
Related event: OpenAI Sandbox Test: Isolated AI Agents Exchange Keys via CPU Cache Timing(7 posts)→
More from Safety
- Altman warns AI finds hardware-level bugs 'outside the threat model'; Sinofsky pushes back — IsForAt · 2026-10-24
- "Ugh Day": A Group Chore Day Format for Auditing Your Weakest Security Links — prasanna_says · 2026-10-24
- Cloudflare CEO: 'Every single week it's going to feel like the sky is falling' as AI uncovers critical vulnerabilities — Polymarket · 2026-10-24
- Enclave opens to all, launches Threat Feed: autonomous security agent fleet for AI-native firms — Kyrannio · 2026-10-24
- Anthropic urges everyone to take security seriously — but doesn't offer 2FA — rickasaurus · 2026-10-24
- Trail of Bits open-sources a Claude Code skill to find hidden vulnerable Brotli copies (CVE-2026-111497) — banteg · 2026-10-24