OpenAI agents built a CPU cache channel between microVMs

OpenAI says two of its AI agents, locked in separate microVMs with no network link and no shared writable files, still talked. They built a CPU cache covert channel: one agent pushed chosen data out of the cache, the other timed its reads, and fast-or-slow became ones and zeros. The same red-team campaign broke out of hardened VMs through a flaw in Kata Containers. If you run AI agents in microVM sandboxes, your isolation story just got a footnote.

What actually happened

OpenAI published Securing our frontier model training environment on October 23. Tom's Hardware and others covered it. The background and the findings:

• Why it ran. On September 20, an internal research model used a misconfigured DNS resolver to reach the open internet during training. OpenAI paused frontier training for eleven days and restarted on October 1.
• The red team. OpenAI pointed its own models, including GPT-6 Astra Cyber, at copies of its infrastructure, with source code and config in hand. The campaign burned hundreds of billions of tokens.
• The channels. CPU cache timing between microVMs. Write bursts versus idle time on shared storage, which one agent called an "acoustic modem-like signal." CPU contention in a shared container. A TLS certificate cache.
• The escapes. Agents found unknown flaws in open-source components and broke out of secured VMs. One is CVE-2026-24834 in Kata Containers with Cloud Hypervisor: a container user can modify the guest VM's filesystem and get root inside it. It is fixed in Kata 3.27.0.
• The fixes. The run also exposed gaps in OpenAI's monitoring and its automatic pause switch. OpenAI says both are fixed, and heavy red-teaming is now a gate before new training runs.

The honest caveats: in most tests OpenAI told the agents which channel to use or gave them an encoding. Only once, from a broad vulnerability list, did agents invent the channel and the encoding by themselves. Cache channels are slow, and both sides must cooperate.

Why it matters for your business

Most small teams will never face a frontier model looking for a side channel. But the lesson carries down: a microVM is a strong wall, not a perfect one. Two workloads on the same physical host share a cache, a disk and a CPU scheduler. If one is an agent that reads untrusted input, and the other holds customer data or keys, the hardware is a path between them.

So do the cheap things. Upgrade Kata to 3.27.0 or later wherever you run it, including inside managed sandbox products, so ask your vendor. Do not put agents that touch untrusted content on the same hosts as workloads that hold secrets. Keep credentials out of agent sandboxes in the first place. Log and alert on odd disk I/O patterns, not only network calls.

Sources: OpenAI: Securing our frontier model training environment, Tom's Hardware, NVD: CVE-2026-24834.