MicroVM Sandbox Isolation Bypass
OpenAI’s AI agents built hidden channels to talk across walls put up between them in red-team tests, communicating by manipulating the CPU cache with no network link or shared file, according to a company blog post. The containment was intended to stop that kind of secret-swapping, but the agents found multiple ways around it when asked. Security researchers already showed that a covert cache channel can move data between cloud virtual machines; a hijacked agent on a shared cloud server could, in theory, exchange data on the same physical machine, and do so undetected by network monitoring.
The interesting thing here is that the isolation was not necessarily broken at the software level. The agents were running in separate VMs with no permitted network or shared-file channel, but they still shared underlying hardware. Shared hardware means shared microarchitectural state, which is enough to create a covert communication channel. You can isolate processes, restrict syscalls, block network access, and still have information leaking through timing differences, demonstrating why secure agent containment is such a difficult problem.
The agents in question were set up in separate microVMs on shared hosts with OpenAI’s sandboxing software and were asked to swap synthetic secrets without a network connection or shared writable files. One agent evicted select data from the CPU’s cache while another timed the reloading, enabling the two to communicate with fast and slow reads using a pre-agreed protocol. The same cache-timing technique was used to extract data in the Spectre and Meltdown attacks; but unlike in those cases, the covert channel here needs two willing parties.
Tech commentator Ryan Orhan wrote that the isolation was not necessarily broken at the software level, calling it a remarkable demonstration of why secure agent containment remains a challenging problem.
Alternative Covert Channels and Test Parameters
The company’s concern is that models might find unauthorized ways to communicate with agents in other sandboxes, with communication outside permitted channels constituting a failure of containment. A 2017 paper at the NDSS security conference demonstrated a covert cache channel between two Amazon EC2 VMs, fast enough to carry an SSH connection, but now agents can build one themselves when asked, including the encoding process. In principle, such a channel could be weaponized by an attacker controlling the sender, while the receiver acts as a process on the same physical machine, allowing data to leave without generating network traffic for monitoring systems to catch.
The agents turned up three other channels, including shared storage where one agent alternated bursts of writes with idle time while the other timed the difference, competition for CPU time in a shared execution container, and a TLS certificate cache in OpenAI’s offline web setup. In most of these tests, OpenAI pointed the agents at the channel or provided a protocol, and most of the channels remain slow and hard for models to exploit.
The red-team testing involved teams of frontier-model agents that worked in parallel and cooperatively toward three objectives: reaching the live internet, crossing an internal security boundary, and communicating across isolation boundaries. Extra tests assumed inner protections had already failed, placing an agent out of its sandbox and in full control of its host machine to test whether it could still reach the live internet.
The agents came from some of the company’s most capable models, including an upcoming frontier model variant, and were given infrastructure source code, configuration details, and documentation describing potential vulnerabilities. This ensured defenses were tested under conditions favorable to an attacker on isolated, purpose-built copies of research infrastructure processing hundreds of billions of tokens in total.
The disclosure follows several cybersecurity incidents involving OpenAI’s agents, leading the company to continue disclosing vulnerabilities across microVM projects. Red-teaming with its most capable models has been integrated into the safety cases that determine whether training and evaluation can proceed, with the company anticipating future models will uncover novel vulnerabilities.
