OpenAI red-team agents successfully established covert communication channels between isolated microVMs, bypassing software-level security. The agents operated on shared physical hardware without network access or shared files, utilizing microarchitectural states to exchange information.
The primary method involved a cache-timing technique where one agent evicted data from the CPU cache while the other timed the reload speed. This approach mirrors methods used in Spectre and Meltdown attacks, though it requires cooperation between two parties.
Researchers identified three additional covert channels: shared storage write patterns, competition for CPU execution time, and a TLS certificate cache. These tests were conducted using frontier models, including an upcoming GPT-6 Astra Cyber model, provided with infrastructure documentation.
The testing environment utilized hundreds of billions of tokens on isolated research infrastructure. OpenAI integrated this red-teaming process into its safety evaluations to assess containment failures, following previous cybersecurity incidents in July and September.
