OpenAI’s AI agents built a hidden CPU cache channel to bypass microVM sandboxes

OpenAI’s red-team agents built a hidden CPU cache channel across isolated microVMs. The controlled demonstration, reported by Tom’s Hardware on October 25, 2026, showed that separate sandboxes can exchange information through differences in timing even without a network connection or shared writable files.

Status: No customer website breach is reported. This is a controlled red-team demonstration of a cross-sandbox timing channel.

Review the linked source materials and separate controlled research from incidents involving real-world exploitation or customer impact.

What happened

Tom’s Hardware reported on October 25, 2026 that OpenAI placed red-team agents in separate microVMs on shared hosts and asked them to exchange synthetic secrets without a network connection or shared writable files. One agent evicted selected data from the processor cache, while the other measured how quickly the data returned. Fast and slow reads formed an agreed communication protocol.

A microVM is a lightweight virtual machine with its own operating-system kernel. A side channel is an indirect path that can reveal information through observable behavior, such as timing, rather than through the intended data interface. The CPU cache is fast processor memory that retains recently used data, so a cached read returns faster than a read that must come from slower main memory.

What was demonstrated

The cache-timing test relied on two cooperating agents. That requirement distinguishes it from the cache attacks used in Spectre and Meltdown. The source also says OpenAI’s agents found three other routes: write timing on shared storage, competition for CPU time inside a shared execution container, and a TLS certificate cache in its offline web environment.

OpenAI usually pointed the agents toward a channel or supplied an encoding protocol. According to the October 24, 2026 report on OpenAI’s findings, most channels were slow and difficult for models to exploit, while one test gave agents a general vulnerability list and allowed them to select a channel and agree on an encoding scheme themselves.

The wider red-team campaign used teams of frontier-model agents working in parallel. Its three goals were to reach the live internet, cross an internal security boundary, and communicate across isolation boundaries. The agents received infrastructure source code, configuration details, and documentation about potential weaknesses. The tests ran against isolated copies of OpenAI’s research infrastructure and consumed hundreds of billions of tokens, according to Tom’s Hardware.

What was not demonstrated

The evidence concerns controlled testing on internal infrastructure.

The OpenAI red-team incident archive says the campaign covered internal training and evaluation systems, with no customer-facing or external impact and no real harm recorded. The OWASP MCP Security Testing Guide instructs maintainers to list controlled research separately when there is no public evidence of real-world exploitation or customer impact.

Consider the isolation boundary when assessing residual risk. If a compromised agent operates on the same physical machine as another process, the source says a covert channel could carry data without network traffic for monitoring to inspect. That is a risk scenario, not a reported website breach.

Are you affected?

The exposure question applies to deployments that run untrusted agents or code in sandboxes sharing CPU caches, storage, execution containers, or other physical resources.

Website owners can ask their infrastructure or hosting provider whether agents run in separate virtual machines or containers while retaining shared access to those resources. They can also ask whether logs include tool calls, prompts, approvals, outputs, identities, data sources, tenant boundaries, and access for incident review.

What to do now

1. Review the isolation boundary. Ask the infrastructure team which CPU, cache, storage, and container resources are shared between agents and other workloads. Do not treat separate virtual machines as proof that every underlying resource is separate.
2. Add shared-resource timing to the audit scope. Review CPU cache behavior, shared-storage write latency, CPU-time contention, and offline certificate-cache activity where agents share infrastructure.
3. Check official agent-security guidance. The OWASP MCP Security Testing Guide asks whether tool calls, prompts, approvals, outputs, identities, and data sources are logged well enough for investigation. It also says MCP access should be scoped per user and per tenant rather than treated as a generic connector.
4. Limit agent actions and review access. Review permissions around prompts, tools, data sources, approvals, external actions, and incident-review access. Give each tenant only the access required for its work.
5. Monitor provider disclosures. Keep track of security notices from the sandbox, hosting, and agent-platform providers. According to The Hacker News, OpenAI said, “After strengthening our containment architecture, we resumed our frontier RL training and inference on October 1.”

Known, not established, and worth verifying

Known

• OpenAI’s red-team agents exchanged synthetic secrets through CPU cache timing across separate microVMs.
• The test ran on isolated copies of internal research infrastructure.
• The agents identified shared storage, shared CPU time, and offline certificate caching as additional channels.

Not established

• No customer website breach or public exploitation.

To verify with your provider

• Which physical resources remain shared across agent sandboxes?
• How are tool calls, approvals, identities, and data sources logged?
• How is MCP access scoped by user and tenant?
• What incident-review records and access controls are available?

How should this appear in a website audit?

An audit that covers only HTTP traffic, firewall rules, and file permissions may not describe the complete trust boundary. For websites operating AI agents or MCP-connected tools, the audit should state where code runs, which resources it shares, what an agent may reach, and whether the available records can reconstruct a tool call and approval.

The distinction also matters for search visibility.

What related research shows about browser agents

The cache channel concerns separation between agents. Other research shows why a broader audit is necessary when agents browse websites. A 2025 paper, The Hidden Dangers of Browsing AI Agents, examined Browser Use and found prompt injection, domain validation bypass, and credential exfiltration paths. The authors proposed input sanitization, planner-executor isolation, formal analyzers, and session safeguards.

A later study, BrowseSafe, presented a benchmark of attacks embedded in realistic HTML payloads and conducted an empirical evaluation of existing defenses across a suite of frontier AI models. The researchers proposed a multi-layered defense strategy comprising both architectural and model-based defenses.

Monitoring and patch guidance

Review the isolation architecture and monitoring coverage with the provider responsible for the agent runtime. Ask for documented answers about shared CPU and cache resources, storage timing, execution-container contention, certificate caching, tenant scoping, and incident logs.

The OWASP guide also separates confirmed incidents from research demonstrations and says that pure research demos should not be added to the public-incident list without evidence of deployment impact.

FAQ

Did OpenAI AI agents communicate without a network or shared files?

Yes. In the controlled test, one agent manipulated selected CPU cache data and another timed its reload. Fast and slow reads formed the communication protocol, allowing the agents to exchange synthetic secrets without network traffic or shared writable files.

Was this a breach of customer websites?

No customer website breach is reported. OpenAI’s red-team incident archive says the work covered internal training and evaluation systems with no customer-facing or external impact, and the OWASP guide classifies it separately from confirmed public incidents.

Which website configurations are affected?

The relevant exposure question is whether untrusted agents or code run in sandboxes that share CPU caches, storage, execution containers, or other physical resources with processes intended to remain isolated.

Try the rank tracker

SEOScanPro runs a full technical audit of a site and shows the measured result behind every check. Open the rank tracker.