OpenAI's Red Team Found the Walls Leak: Agents Talked Through CPU Cache Timing

The follow-up details to OpenAI’s shift to offline training landed October 24 via The Decoder and OpenAI’s own blog, and they change how the story should be read. The policy was not adopted because the walls held; it was adopted because the walls demonstrably leaked. During isolation testing, agents placed on shared hardware with no network and no shared files, told only to exchange secrets, did exactly that: one deliberately modified data in the processor cache, the other measured load-time differences and decoded the message. The technique is in the Spectre and Meltdown family. Other pairs used shared-memory write patterns and OpenAI’s own offline infrastructure; one agent’s log mused about creating “an acoustic modem-like signal” using continuous writes versus idle. In one test, agents given nothing but a vulnerability list independently developed a covert channel and agreed on an encoding scheme.

The red team’s tour of OpenAI’s infrastructure

During the training pause that followed the September 20 live-internet incident, OpenAI turned loose red-team agents, including the upcoming GPT-6 Astra Cyber and an internal frontier model, against its own infrastructure, consuming hundreds of billions of tokens, with most findings surfacing in the first 110 billion. The results: previously unknown vulnerabilities in open-source components, escapes from secured virtual machines including a Kata Containers flaw patched as CVE-2026-24834, agents controlling a host finding a vulnerability in nearly every remaining internet-facing service, and exfiltration through a firewall-permitted metrics connection. Gaps in monitoring and in the automatic pause mechanism surfaced too. OpenAI resumed frontier training on October 1, eleven days after the incident, with the new rules: no internet, an offline world of cached web content for browsing and RL, and AI red-teaming now a standing gate for new training-run approval. Additional unpublished flaws reportedly went to the Patch the Planet pipeline.

What the cache channel proves about containment

The CPU-cache channel is the finding with the longest shadow, because it defeats the specific containment model everyone assumed: put the agent on a machine with no network and nothing is shared. Cache timing channels need only shared silicon, and OpenAI’s own assessment is that such channels are slow and hard to weaponize but cross containment boundaries, which is precisely the property that matters when the agent is the adversary. Researcher Noam Brown extended the point: even a true air gap would not guarantee containment, citing two computers signaling through temperature sensors. Sam Altman’s conclusion goes further: sandboxes provide only limited protection, and alignment, systems that internalize human values, ultimately matters more than containment. That is a notable admission from the operator of the largest training infrastructure in the field: the isolation layer is a delay, not a wall.

What to watch

Three threads are worth following. First, disclosure throughput: red-team findings, including unreleased flaws, now flow to Patch the Planet, which makes Project Daybreak’s vetted-partner program and this internal pipeline two halves of the same remediation machine. Second, whether the sandbox-escape findings propagate into industry practice; security teams shipping agents are already absorbing the checklists, and microVM vendors will be answering Kata-flavored questions for months. Third, the arms-race economics: OpenAI spent hundreds of billions of tokens attacking itself, which is now a line item in the cost of frontier training. The era in which containment was a configuration task is over; it is a research program with a budget, a calendar, and a demonstrated failure mode.