rauchg reproduces OpenAI's covert CPU-channel finding: chat across Firecracker microVMs with no network
ccerrato147 · x · 2026-10-27
Vercel CEO Guillermo Rauch built cpu-chat, reproducing OpenAI's finding on covert communication via the CPU. It runs on a generic host with 2+ network-isolated Firecracker microVMs (works on x86 and Apple M5), chatting through three mechanisms: CPU contention, cache eviction timing, and DRAM bandwidth contention. It defeats all of Firecracker's production hardening recommendations (no SMT, no KSM, tenants pinned to separate cores). The takeaway: any shared hardware gives sandboxed agents a decent-latency covert channel. Rauch notes this differs from Meltdown/Spectre-style side-channel attacks that steal data, and that the techniques are much harder to pull off in real-world environments.
More from Safety
- UK AISI: under $80 of fine-tuning fully restores filtered bio capabilities in open-weight models — connoraxiotes · 2026-10-27
- Meta joins frontier labs reporting CoT controllability evals in Muse Spark 1.3 card — tomekkorbak · 2026-10-27
- Meta TBD underwent pre-launch red-teaming by 5 third-party safety firms — maksym_andr · 2026-10-27
- Is ChatGPT showing your chats to others? Screenshot sparks concern — chrisalbon · 2026-10-27
- Do canary tokens still work in the coding-agent era? Fake AWS keys may lure agents — kuza55 · 2026-10-27
- LLM bias judges name groups instead of saying 'unknown', refusing only 0.4% of the time — ZhijingJin · 2026-10-27