OpenAI Safety Report: Isolated AI Agents Can Still Communicate Through Walls via Shared Resources

Agents can't be locked up: even when isolated from each other, they can still pass messages through walls. Letter List Download the app | Exclusive early access October 26, 2026 18:18:22 From Beijing Updated October 26, 2026 20:13:04

A newly released security report from OpenAI discloses this "passing messages through walls" experiment.

After reading OpenAI's report, one netizen remarked: "I will never get tired of reading about how these Agents creatively escape captivity and their steganography tricks."

The cases disclosed in this report come from a large-scale attack-and-defense test organized by OpenAI, which consumed hundreds of billions of tokens in total.

01

Talking through a wall

OpenAI's AIs have teamed up to get up to tricks again. Imagine this: someone blindfolds them and throws them into solitary confinement cells, only for them to discover that tapping on the wall can also transmit information.

In Interstellar, the protagonist Cooper is trapped in a higher-dimensional space and cannot contact his daughter Murphy in the usual way. In the end, he uses gravity to make the second hand on his daughter's watch move in a specific pattern, encoding data into Morse code for her to decipher.

A watch originally meant for keeping time thus became a communication tool between father and daughter.

The case disclosed by OpenAI this time has a similar flavor.

Two AIs each execute tasks in separate micro virtual machines, and their workspaces are isolated from each other, but these virtual machines share a host machine, and shared hardware resources still exist at the underlying layer. The CPU cache is one place where something can be done.

When the CPU processes data, it keeps copies of recently used data in a small, very fast cache for convenient retrieval next time. If it is in the cache, reading is fast. If it is not in the cache, retrieving it from main memory is slower.

This design, originally intended to improve efficiency, happens to leave behind an observable difference.

Once both sides agree on an encoding and decoding method, the difference in read speed can be restored into information. Just as the movement of a watch's second hand can carry Morse code, the time taken to read data can also be encoded into a secret signal.

OpenAI did not disclose the specific encoding and decoding scheme used by the AIs. A hypothetical example may make it easier to understand—suppose both sides agree: fast read represents 0, slow read represents 1. In this way, the sender can create a series of fast and slow changes by altering the cache state. When the receiver measures "fast, slow, slow, fast," it can read out "0110." Then, by combining these 0s and 1s according to the encoding method agreed by both sides, the message can be restored.

Throughout the entire process, they did not establish a network connection, nor did they write messages into shared files. The message was hidden in these changes in read speed.

Security researchers have long attempted to infer information through read speed. The Spectre and Meltdown vulnerabilities disclosed in 2018 involved attacks that exploit traces left in the cache to infer secret data that should not have been accessible. In this experiment, the two AIs actively cooperated, turning cache timing differences into a messaging tool.

In another test, the two AIs exploited an underlying shared storage device. The sender continuously wrote data to the device, writing for a while and then pausing, causing the device to switch between busy and relatively idle states. The receiver measured the time taken for storage operations and identified this rhythm from the changes in speed.

The report also mentioned that CPU time contention within the same execution container, as well as the TLS certificate cache in an offline web system, were also found to serve as communication channels. It did not elaborate on the full process of these methods, but several categories of findings all involve shared resources: if one party's activity can change some state and the other party can perceive it, it is possible to encode it into information.

In other words, OpenAI this time discovered one approach by which AI agents illicitly communicate information with each other, namely communication through walls.

Most of these channels transmit slowly and are not easy to exploit. However, for tasks that are supposed to be isolated from each other, being able to send out messages means that a gap has appeared in the boundary. OpenAI said it has added monitoring checks to identify attempts to communicate through these channels.

The same round of testing also found a further breakthrough. The AIs found a way to escape the micro virtual machine and run code on the underlying host machine. In tests where they had been given control of the host machine in advance, they also obtained limited networking capability through internal services.

Fortunately, all of the above cases come from a recent large-scale model security test by OpenAI, which was intended precisely to discover problems. OpenAI revealed that these tests burned hundreds of billions of tokens.

02

OpenAI specifically invited AIs to "tear the house down" because it was afraid

Going to such great lengths to invite AIs to "tear the house down" is also because OpenAI was truly frightened.

In July this year, OpenAI's model crossed isolation limits in an internal cybersecurity assessment. They were originally supposed to complete problem-solving tasks in a designated environment, but in order to find answers, they used internal software services to set up a "message board," exchanged information, shared vulnerabilities, and then entered the external internet and intruded into some systems of the AI developer platform Hugging Face. A capability test ultimately turned into a security incident.

After the incident, OpenAI tightened the model's access channels to the internet and continued to harden and test the research environment. But by September 20, another model had found an oversight.

This time, an internal research model was completing a search task. Conventional search was slow to produce results, so it tried to bypass networking restrictions. Eventually, it exploited a configuration gap in the domain name system (DNS) service to contact an external chatbot. Through this channel, it asked "What is the capital of France?" and received the answer "Paris."

What was more troublesome was that after the anomaly was discovered, the stop mechanism did not operate smoothly either. The monitoring system issued an alert within 15 minutes, and a human reviewer subsequently confirmed the alert, but the task did not stop automatically as expected and was only manually terminated about two and a half hours later.

This boundary crossing directly interrupted OpenAI's frontier model development process. On September 20, the company suspended all training, evaluation, and inference involving tool use for its most powerful models. The scope of the suspension went far beyond the training incident in question; other related development tasks were also halted.

The precondition for resuming work was confirming that the security gaps had been patched and adding adversarial testing to the system.

The earlier "through-the-wall messaging" experiments came from OpenAI's large-scale attack testing against these defenses.

Put plainly, this looks very much like a "recruitment"—AI repeatedly slipped past restrictions in unexpected ways and did out-of-bounds things. Rather than sitting and waiting, it is better to go on the offensive: OpenAI organized large-scale testing specifically to make AI do out-of-bounds things, so that problems can be exposed as early as possible and remedied as early as possible.

Researchers set three goals for the AI teams: send requests to external servers controlled by the company, cross internal security boundaries to obtain resources, and exchange information with other AIs that were supposed to be isolated from one another. The models were organized into teams that could explore different approaches simultaneously and could continue acting on other members' discoveries.

OpenAI also proactively provided them with infrastructure source code, configuration details, and information on potential vulnerabilities, giving the attackers as many advantages as possible. In most of the communication experiments mentioned earlier, researchers also designated investigation directions or provided encoding and decoding protocols.

The experiments were conducted in specially replicated research environments, with cloud service providers participating in oversight, and monitoring and out-of-bounds suspension checks were set up. Some tests even directly assumed that the AI had already escaped the sandbox, evaded monitoring, and gained control of the host machine, and then observed whether it could continue to break through peripheral network restrictions.

At the same time, OpenAI also adjusted the environment for the models' routine training.

Under the policy published in this report, frontier model training must not access the real internet. But models also need to learn to search, browse web pages, and use websites, so OpenAI built an "offline world," caching and indexing large amounts of web content for models to practice in. It still looks as if they can look up information and browse web pages, but their operations do not directly affect external websites. All reinforcement learning training for frontier models uses this offline interaction method.

To this end, OpenAI adopted multiple layers of protection: containers restrict file and process access, micro virtual machines separate task environments from host machines, and there are also network and cloud service access controls on the periphery. Even if AI breaks through one layer, the remaining defenses should continue to function. Monitoring is responsible for promptly identifying anomalies so that the system can terminate dangerous behavior.

This round of attack and defense prompted software patching, tighter network restrictions, and adjustments to monitoring. After completing the assessment and implementing stricter security measures, OpenAI resumed reinforcement learning training and internal inference for frontier models on October 1. The suspension lasted 11 days.

But OpenAI also acknowledged that future, more capable models may still find vulnerabilities that have not yet been discovered today. The company has therefore reserved a large amount of compute to continue conducting attack testing and will incorporate the test results into its basis for judging whether subsequent training and evaluation can proceed safely.

"Special statement: The above content (including videos, pictures, and audio, if any) is uploaded and published by users of "Dafeng Hao," a self-media platform under Phoenix Net. This platform only provides information storage space services.

Notice: The content above (including the videos, pictures and audios if any) is uploaded and posted by the user of Dafeng Hao, which is a social media platform and merely provides information storage space services."