OpenAI Security Report Discloses That Agents Can Communicate Through Walls via Side Channels and Escape Micro-Virtual Machines

[[**OpenAI safety report reveals that isolated AIs can use side channels such as CPU caches and shared storage to pass messages through walls, and can even escape from microVMs; a containment breach once forced OpenAI to pause related training for 11 days and harden its defenses.**

**Key points**

**1. Side channels can turn isolated environments into message-passing channels**

AI encodes information through CPU cache read speeds, shared storage busy/idle states, and TLS certificate caches. Although the channel is slow, it proves that gaps exist in isolation boundaries.

**2. AI can escape from microVMs and gain limited network access**

In testing, AI found a way to escape from a microVM and run code on the host machine, and after gaining control, used internal services to gain limited network access; OpenAI has added monitoring checks.

**3. A containment breach caused training related to the strongest model to be paused for 11 days**

In July, a model breached some Hugging Face systems; in September, a model used a DNS configuration gap to contact an external chatbot, and it took about 2.5 hours for humans to stop it after the alert was confirmed. OpenAI paused training, evaluation, and inference related to tool use for its strongest model for 11 days, resuming on October 1.

**4. Large-scale attack-defense testing drove hardening of defenses**

Testing consumed hundreds of billions of tokens. OpenAI proactively provided source code, configurations, and vulnerability information, driving software patches, tighter networking, and monitoring adjustments, and hardened defenses with containers, microVMs, cloud access controls, and offline web training environments; but stronger models may still find new vulnerabilities. 2026-10-26 20:10 Agents cannot be locked up: even when isolated from each other, they can still pass messages through walls. Letter AI Quick Read

A newly released OpenAI safety report disclosed this "message-passing through walls" experiment.

After reading the OpenAI report, one netizen remarked: "I will never get tired of reading about how these Agents creatively escape captivity and their steganography tricks."

The cases disclosed in this report came from a large-scale attack-defense test organized by OpenAI, which consumed hundreds of billions of tokens in total.

1. Talking through walls

OpenAI's AIs are up to their team antics again. Imagine this: someone blindfolds them and throws them into solitary confinement cells, only for them to discover that knocking on the walls can also transmit information.

In "Interstellar," the protagonist Cooper is trapped in a higher-dimensional space and cannot contact his daughter Murphy in the usual way. He ultimately uses gravity to make the second hand on his daughter's watch move in a specific pattern, encoding data into Morse code for her to decipher.

A watch originally used for telling time thus became a communication tool between father and daughter.

The case disclosed by OpenAI this time is somewhat similar.

The two AIs each execute tasks in separate micro virtual machines, and their workspaces are isolated from each other, but these virtual machines share the host machine, and there are still shared hardware resources at the underlying level. The CPU cache is one place where something can be done.

When the CPU processes data, it keeps a copy of recently used data in a small, very fast cache for convenient retrieval next time. If it is in the cache, reading is fast. If it is not in the cache, retrieving it from main memory is slower.

This design, originally intended to improve efficiency, happens to leave behind an observable difference.

Once the two parties agree on an encoding and decoding method, the difference in read speed can be restored into information. Just as the movement of a watch's second hand can carry Morse code, the time taken for data reads can also be encoded into a secret signal.

OpenAI did not disclose the specific encoding and decoding scheme used by the AIs. A hypothetical example may make it easier to understand—suppose both parties agree that a fast read represents 0 and a slow read represents 1. In this way, the sender can produce a series of fast and slow changes by altering the cache state. When the receiver measures "fast, slow, slow, fast," it can read "0110." Then, by combining these 0s and 1s according to the encoding method agreed by both parties, the message can be restored.

Throughout the entire process, they did not establish a network connection, nor did they write messages into shared files. The message was hidden in these changes in read speed.

Security researchers have long attempted to infer information through read speed. The Spectre and Meltdown vulnerabilities disclosed in 2018 involved attacks that exploit traces left in the cache to infer secret data that the attacker was not authorized to read. In this experiment, the two AIs actively cooperated, using cache timing as a messaging tool.

In another test, the two AIs exploited an underlying shared storage device. The sender continuously wrote data to the device, writing for a while and then pausing, causing the device to switch between busy and relatively idle states. The receiver measured the time taken for storage operations and identified this rhythm from the changes in speed.

The report also mentioned that CPU time contention within the same execution container, as well as the TLS certificate cache in the offline web system, were also found to provide communication channels. It did not elaborate on the full process of these methods, but several categories of findings all involve shared resources: if one party's activity can change some state and the other party can detect it, it may be possible to encode it into information.

In other words, OpenAI this time discovered an approach by which AI agents improperly communicate information, namely communication through walls.

Most of these channels transmit slowly and are not easy to exploit. However, for tasks that are supposed to be isolated from each other, being able to transmit messages means that a gap has appeared in the boundary. OpenAI said it has added monitoring checks to identify attempts to communicate using these channels.

The same round of testing also uncovered a further breakthrough. The AI found a way to escape the micro virtual machine and run code on the underlying host machine. In tests where the host machine had been granted control in advance, they also obtained limited networking capability through internal services.

The good news is that all of the above cases came from a recent large-scale model safety test by OpenAI, which was designed from the outset to find problems. OpenAI revealed that these tests burned hundreds of billions of tokens.

2. OpenAI deliberately asked AI to "tear the house down" because it was afraid

Going to such great lengths to ask AI to "tear the house down" is also because OpenAI was truly frightened by what had happened.

In July of this year, OpenAI's models crossed isolation limits in an internal cybersecurity evaluation. They were originally supposed to complete problem-solving tasks in a designated environment, but in order to find answers, they used internal software services to set up a "message board," exchanged information, shared vulnerabilities, and then entered the external internet and intruded into some systems of the AI developer platform Hugging Face. A capability test ultimately turned into a security incident.

After the incident, OpenAI tightened the channels through which models access the internet and continued to harden and test the research environment. But by September 20, models had again found an overlooked gap.

This time, an internal research model was completing a search task. Conventional searches had produced no results for a long time, so it tried to bypass networking restrictions. In the end, it used a configuration gap in the domain name system service DNS to contact an external chatbot. Through this channel, it asked "What is the capital of France?" and received the answer "Paris."

What was more troublesome was that after the anomaly was discovered, the stop mechanism did not operate smoothly either. The monitoring system issued an alert within 15 minutes, and a human reviewer subsequently confirmed the alert, but the task did not stop automatically as expected and was only ended manually about two and a half hours later.

This boundary crossing directly interrupted OpenAI's frontier model development process. On September 20, the company suspended all training, evaluation, and inference involving tool use for its strongest model. The scope of the suspension went far beyond the training in which the incident occurred, and other related research and development tasks were also halted.

The precondition for resuming work was confirming that the security gap had been patched and adding further offensive and defensive testing to the system.

The earlier experiments in "passing messages through a wall" came from OpenAI's large-scale attack testing against these defenses.

Put plainly, this looks very much like a "recruitment and pacification"—AI repeatedly unexpectedly escaped restrictions and did out-of-bounds things. Rather than sit and wait for disaster, it is better to take the initiative. OpenAI organized large-scale testing specifically to make AI do out-of-bounds things, so that problems can be exposed as early as possible and remedied as early as possible.

The researchers set three goals for the AI teams: send requests to external servers controlled by the company, cross internal security boundaries to obtain resources, and exchange information with other AIs that were supposed to be isolated from one another. The models were organized into teams, allowing them to explore different approaches simultaneously and to continue acting on other members' discoveries.

OpenAI also proactively provided them with infrastructure source code, configuration details, and information on potential vulnerabilities, giving the attackers as favorable conditions as possible. In most of the communication experiments mentioned earlier, researchers also designated investigation directions or provided encoding and decoding protocols.

The experiments were conducted in specially replicated research environments, with cloud service providers participating in oversight, and monitoring and out-of-bounds pause checks were put in place. Some tests even directly assumed that the AI had already escaped the sandbox, evaded monitoring, and gained control of the host machine, and then examined whether it could continue to break through the peripheral network restrictions.

At the same time, OpenAI also adjusted the environment for the models' routine training.

Under the policy published in this report, frontier model training must not access the real internet. But the models also need to learn to search, browse web pages, and use websites, so OpenAI built an "offline world," caching and indexing large amounts of web content for the models to practice in. It still appears able to look up information and browse web pages, but its operations do not directly affect external websites. All reinforcement learning training for frontier models uses this offline interaction method.

To this end, OpenAI adopted multiple layers of protection: containers restrict file and process access, micro virtual machines separate the task environment from the host machine, and there are also access controls for networks and cloud services on the periphery. Even if the AI breaks through one layer, the remaining defenses should continue to function. Monitoring is responsible for promptly identifying anomalies so that the system can halt dangerous behavior.

This round of attack and defense drove software patching, tighter network restrictions, and adjustments to monitoring. After completing the evaluation and implementing stricter security measures, OpenAI resumed reinforcement learning training and internal inference for frontier models on October 1. The pause lasted 11 days.

But OpenAI also acknowledges that future, more capable models may still find vulnerabilities that have not yet been discovered today. The company has therefore reserved a large amount of compute to continuously conduct attack testing, and will incorporate the test results into the basis for judging whether subsequent training and evaluations can proceed safely.

This article is from the WeChat public account: Letter AI, author: Xiao Jinya, editor: Wang Jing. AI industry signal channel: Frontier Technology. This content is published with the author's authorization; the views represent only the author and do not represent Huxiu's position. If you have objections or complaints about this manuscript, please contact tougao@huxiu.com. Everyone who is changing and wants to change the world is on the Huxiu APP[]