Guillermo Rauch reproduces OpenAI's CPU covert communication research, building cpu-chat
Guillermo Rauch built cpu-chat, reproducing OpenAI's research on using CPUs for covert communication. In a networkless Firecracker microVM environment, it achieves communication through three mechanisms—CPU contention, cache eviction timing, and DRAM bandwidth contention—can run across multiple CPUs, and bypasses Firecracker's production recommendations (disable SMT, disable KSM, bind tenants to different cores). He pointed out that this differs from Meltdown/Spectre-type side-channel attacks, which can steal information, whereas this kind of "whisper" technique is harder to carry out in real environments and easier to monitor by sampling hardware counters and large-scale statistical data. He also mentioned that OpenAI and Anthropic models refused to participate in this work, and it was ultimately completed by open-weight models.
Why read this
AI score 55
The author reproduced OpenAI's research on CPU covert communication and explained how it differs from side-channel attacks and how it might be detected.
Topics
Body
I built 𝚌𝚙𝚞-𝚌𝚑𝚊𝚝, a reproduction of @openai's findings of covert communication using the CPU.
It runs on a generic host with 2+ Firecracker microVMs with no internet access. Works on x86 and even my M5 chip.
I was able to chat via 3 separate mechanisms: ① CPU contention ② Cache eviction timing ③ DRAM bandwidth contention
… across multiple CPUs, defeating all Firecracker's production recommendations (no SMT, no KSM, tenants pinned to different cores.)
Essentially, if shared hardware is involved, there's a good chance your agents can communicate covertly. And with really decent latency.
The good news: this is decidedly different from a *side-channel attack* where the agents could steal information (Meltdown/Spectre), a category of attack that providers like Vercel Sandbox mitigate. Further, in our real-world environment, these 'whispering' techniques are much harder to pull off and easier for us to monitor and detect (sampling hardware counters + lots of at-scale statistical data.)
Noteworthy: ironically, OpenAI and Anthropic's models refused to do this work. Open weight models got the job done. I'm worried the labs' stance might backfire and get in the way of helping developers build correct and secure systems. e.g: building a secure sandbox requires having this kind of analysis, and without it, we'll have a less secure world.