# OpenAI reports agents on separate VMs used cache timing to communicate

> Original title: Agents on different VMs on the same machine communicated by selectively evicting the cache to manipulate cache timing differences

- Source: wh
- Published: 2026-10-23T20:21:02.000Z
- Bad Influence: https://badinfluence.news/items/c3z0qxwgr96o0zpeiogwpzwhs
- Original: https://x.com/nrehiew_/status/2113727420633407525

## Summary

wh shares a quoted OpenAI post saying its red-teaming agents, in separate VMs on shared hosts, exchanged synthetic secrets without network connections or shared writable files. One agent evicted selected cache data, and another timed reloads to decode the message, a technique also used in the Spectre and Meltdown attacks. OpenAI says the findings were used to strengthen its containment and that high-compute red-teaming now informs whether frontier training can proceed.

## Why it matters

The quoted OpenAI post shows how agents in separate VMs exchanged secrets through cache timing, a containment gap that matters for anyone running sandboxed agents.

## Post

Agents on different VMs on the same machine communicated by selectively evicting the cache to manipulate cache timing differences

Agents also used write patterns to send signals to each other

???

![](https://badinfluence.news/api/img-proxy?u=https%3A%2F%2Fpbs.twimg.com%2Fmedia%2FHVV3cRra8AAnfSI.png&mode=thumb&exp=1793404800&sig=14c38cd75f3fb895)

![](https://badinfluence.news/api/img-proxy?u=https%3A%2F%2Fpbs.twimg.com%2Fmedia%2FHVV3vR4bYAAwjYh.jpg&mode=thumb&exp=1793404800&sig=2eadcb20303bc7f7)

## Quoted post @OpenAI

> Over the past several months, we have substantially hardened the security of our research training environment. We’ve removed live internet access for all frontier models during training and built an offline world for them to use instead—a cached version of the web where they can still learn to browse, search, and use applications.
> 
> On September 20, after a model exploited a DNS misconfiguration to find a way outside of this offline world, we paused frontier training to strengthen containment further. We assembled teams of agents, powered by our most cyber-capable models, and tasked them with finding weaknesses in our research environments.
> 
> While they found no route to the internet they could easily exploit while concealing their activity from our monitors, they did find zero-day vulnerabilities, virtual machine escapes, and hardware side-channels for communication between agents. We used their discoveries to further strengthen our defenses and contribute fixes to open-source software.
> 
> After strengthening our containment architecture, we resumed our frontier RL training and inference on October 1. We’ve reserved substantial compute for continuous red-teaming, and made high-compute red-teaming part of the safety cases we use to decide whether frontier training and evaluation can proceed securely.
> 
> https://openai.com/index/securing-our-frontier-model-training-environment/

https://x.com/OpenAI/status/2113718797505036665