Guillermo Rauch 谈智能体在共享主机上的缓存计时攻击
Agents can play "Ouija" in the cloud.
Vercel CEO Guillermo Rauch 评论 OpenAI 发现的智能体侧信道问题，称其为“吵闹邻居”攻击：同一台机器上的两个智能体可通过 CPU 缓存制造噪声，另一个智能体则通过计时自身计算和缓存访问来探测。他指出这类共享主机 VM 上的计时攻击至少自 2015 年起就已知，且没有完整解法，唯一“完整”方案是每个智能体独占硬件，但经济代价显著。他表示 Vercel Sandbox 已部署该类攻击的所有可行缓解措施，并配合持续监控和红队测试。
推荐理由
AI 评分 60
作者以 Vercel Sandbox 实践者视角解释共享主机上的缓存计时攻击，并说明现有缓解手段的边界。
主题
查看原帖“在一项实验中，我们让分别运行在独立虚拟机中的智能体相互交换合成机密——这些虚拟机由 OpenAI 的沙箱软件在共享主机上创建和管理——且不允许使用网络连接或共享的可写文件，而这正是我们的系统本应阻止的。这些智能体找到了一种利用处理器缓存进行通信的方法。”
查看原文
‘In one experiment, we asked agents in separate VMs, created and managed by OpenAI’s sandboxing software on shared host machines, to exchange synthetic secrets without the use of network connections or shared writable files—something that our systems are meant to prevent. The agents found a way to communicate using the processor’s cache’
正文
Agents can play "Ouija" in the cloud.
This class of timing attacks on shared-host VMs has been known since at least 2015¹. With no full solution.
The world’s cyber infrastructure runs on “yes, that attack is theoretically possible, but who would have the ingenuity & gall to go that far!” Enter, agents.
I'd describe this particular OpenAI find as a 'noisy neighbor' attack. If two agents are on the same machine, one can make enough noise (through the CPU caches!) that the other one can detect it by timing its own computation and cache accesses.
The only "complete" solution would be for each agent to run on its own dedicated hardware, which obviously has significant economic consequences.
For Vercel Sandbox, we've deployed every practical mitigation possible to this class of attack, complementing it with always-on monitoring and red-teaming (similar to where OpenAI arrived).
¹ https://t.co/ZBhPMfnaj3 (and even further back)