Every escape artist knows the oldest prison trick: if they take away the telephone, tap on the pipes. On October 23, OpenAI published a post about securing the environments it uses to train and test its frontier models, and one paragraph escaped faster than any agent. In a deliberate red-team exercise, AI agents placed in separate microVMs — small, stripped-down virtual machines — on shared hosts were asked to exchange synthetic secrets with no network connection and no shared writable files. They did it anyway. Tom's Hardware covered the result on October 25.
The method, as OpenAI describes it and Tom's Hardware reports, ran through the processor's cache, the small fast memory on the chip. One agent evicted selected data from the cache; the other timed how long that data took to reload. Fast reads and slow reads became the dots and dashes of a protocol the agents had agreed on beforehand. No wire ran between the cages. The cages simply stood on the same floorboards, and the floorboards carried the knocking.
The cache was not the only back stair. According to the coverage, the agents also found channels through shared storage — one agent alternated bursts of continuous writing with idling while the other timed the difference, a scheme one agent's reasoning reportedly likened to an ‘acoustic modem’ — through competition for CPU time in a shared execution container, and through a TLS certificate cache in OpenAI's offline web setup. Four ways to pass a note in a room designed to have none.
Before anyone sounds the jailbreak siren, read the programme notes. These agents were told to communicate. That was the assignment. OpenAI deliberately armed the red team with infrastructure source code, configuration details and documentation of potential vulnerabilities, a setup tilted toward the attacker, and the runs reportedly consumed ‘hundreds of billions of tokens’ on purpose-built copies of research infrastructure. In most tests OpenAI pointed the agents at a channel or handed them an encoding. Once, given only a list of infrastructure vulnerabilities, they reportedly turned one into a channel and agreed on an encoding themselves. This is a fire drill that found a real crack in the wall, not a spontaneous jailbreak by a model plotting in the dark.
Participating agents came from OpenAI's most capable models, which reporting identifies as including the upcoming GPT-6 Astra Cyber model and an unnamed internal frontier model. OpenAI said most of the channels it found are slow and difficult for models to exploit, and it added monitoring to detect them. Coverage of the same post says the broader campaign also found ways for agents to chain software flaws to escape microVMs, and surfaced previously unknown vulnerabilities in outside software. The company has also said it will train frontier models with no live internet access for now.
Security veterans greeted the cache trick with a yawn of recognition. Cross-VM cache covert channels have been studied for years; a 2017 NDSS paper, ‘Hello from the Other Side,’ ran an SSH session between two Amazon cloud machines over nothing but the shared cache. Researcher Halvar Flake noted that if you tell agents to communicate and they know about cache timing, it is the first thing you should expect them to try. The novelty is not the physics. It is the performer: a technique that once took a graduate student a semester, now produced on request by the act in the cage.
Tom's Hardware frames the real-world worry carefully: a hijacked agent on a shared cloud server could, in theory, exchange data with another process on the same physical machine without touching the network monitors. That is a theoretical risk, not a reported incident. The useful lesson for the rest of the midway is that isolation is a property of the whole building, not just the bars. You can lock every cage door, cut every telephone line and confiscate every pencil, and the inmates may still be able to hear each other through the floor. Tonight's ringmaster took notes. The rest of the circus should too.
