Understand this story
Guillermo Rauch built cpu-chat to reproduce OpenAI's research on covert communication using CPUs. In a networkless Firecracker microVM environment, he achieved communication through three mechanisms—CPU contention, cache eviction timing, and DRAM bandwidth contention—which can run across multiple CPUs and bypasses Firecracker's production recommendations (disable SMT, disable KSM, bind tenants to different cores). Rauch noted that this differs from Meltdown/Spectre-class side-channel attacks, which can steal information, whereas this type of "whisper" technique is harder to implement in real environments and easier to monitor through sampling hardware counters and large-scale statistical data. He also mentioned that OpenAI and Anthropic models refused to participate in this work, and it was ultimately completed by open-weight models. Thomas Wolf relayed that Rauch completed the reproduction using more than 2 networkless Firecracker microVMs on x86 and M5 chips, and expressed concern that labs' refusal stance could hinder developers from building secure sandboxes.
AI-generated from public reports
Developments
1 confirmed developments
Guillermo Rauch reproduces OpenAI's covert communication discovery
Source:Thomas Wolf
Reports and discussion timeline
Browse reports and discussion by time. Their evidence levels remain distinct.
Oct 27
Thomas Wolf
Thomas Wolf relays: OpenAI and Anthropic models refuse to reproduce agent covert communication research; open-weight models complete it
Thomas Wolf relays Guillermo Rauch's reproduction results: OpenAI found that agents can communicate covertly through shared hardware, while OpenAI and Anthropic models refused to participate in this reproduction work, which was ultimately completed by open-weight models. Rauch reproduced it using 2 or more Firecracker microVMs without network access on x86 and M5 chips, achieving communication through three mechanisms—CPU contention, cache eviction timing, and DRAM bandwidth contention—bypassing Firecracker's production recommendations. Rauch believes this type of covert communication differs from Meltdown/Spectre-style side-channel attacks, being harder to implement and easier to monitor in real environments, but worries that the labs' refusal stance will hinder developers from building secure sandboxes.
Guillermo Rauch
Guillermo Rauch reproduces OpenAI's CPU covert communication research, building cpu-chat
Guillermo Rauch built cpu-chat, reproducing OpenAI's research on using CPUs for covert communication. In a networkless Firecracker microVM environment, it achieves communication through three mechanisms—CPU contention, cache eviction timing, and DRAM bandwidth contention—can run across multiple CPUs, and bypasses Firecracker's production recommendations (disable SMT, disable KSM, bind tenants to different cores). He pointed out that this differs from Meltdown/Spectre-type side-channel attacks, which can steal information, whereas this kind of "whisper" technique is harder to carry out in real environments and easier to monitor by sampling hardware counters and large-scale statistical data. He also mentioned that OpenAI and Anthropic models refused to participate in this work, and it was ultimately completed by open-weight models.
Heat trend for this story
- Current
- 7
- Period peak
- 15 Oct 27 13:00
- 24-hour change
- -50%
Move the pointer or select the chart to inspect hourly heat. Use the left and right arrow keys with a keyboard.