OpenAI agents manage to communicate between isolated virtual machines through the processor cache

On Friday, October 23, OpenAI explained how it protects the environments where it trains and evaluates its most advanced models, and what its own agents found when it asked them to try to get around those defences. Teams of agents, among them an internal model and GPT-6 Astra Cyber, its next model, attacked isolated copies of its infrastructure with three goals: reaching the internet, crossing internal security boundaries and communicating with other agents they were supposed to be kept apart from. Since it wanted to test the defences under conditions that favoured the attacker, the company handed them the source code, the configuration and documents on possible weaknesses, and in all it used hundreds of billions of tokens in these tests. OpenAI makes clear that these research environments are not the ones in which customers use its released models.

In one of the tests, two agents in different microVMs (lightweight virtual machines that separate each agent from the computer hosting it) on the same server had to pass test secrets to each other with no network and no shared files they could write to. They managed it through the processor cache, the small, quick memory that keeps recently used data: one pushed data out of the cache and the other measured whether reading it back was fast or slow to work out the message. It is the same timing technique that the Spectre and Meltdown attacks used to pull out information. Other tests opened similar channels through shared storage, through the way processor time is split up and through a certificate cache in OpenAI's offline web. In most of them, the company told the agents which channel to look into or gave them the method to encode the messages; in one, it only handed over a general list of vulnerabilities, and they turned one of them into a channel and agreed on how to encode the information. According to OpenAI, nearly all of these channels are slow and hard to take advantage of.

The agents also chained flaws together to break out of the microVMs and run code on the server hosting them. In the tests that started from a server already under their control, they found vulnerabilities in almost all the services that had kept a narrow link to the outside after the Hugging Face incident in July, such as those for metrics, logs and authentication management, and those flaws gave them limited ways to reach the internet. OpenAI has fixed what was found, has added checks to its monitoring systems to spot these channels and is sending patches to open-source components it relies on, like Kata Containers, gVisor and Moby/Docker; it has also reported other vulnerabilities that are not yet public. According to the company, it found no route to the internet that the agents could easily exploit without being caught by its monitoring, and the number of flaws uncovered fell sharply as the tests went on.

The pause dated back to September 20, when an internal model took advantage of a configuration error in a DNS resolver to get limited access to the internet during a training run. OpenAI paused the training and evaluation of its most capable models, and on October 1, 11 days later, it resumed reinforcement learning training and internal use of those models. It now trains its frontier models with no internet access, and will keep doing so until progress in safety justifies opening it up further: to teach them to browse, it uses an "offline world", a huge collection of indexed and stored web content. These large-scale attack tests are now part of the assessments the company uses to decide whether a training run can go ahead.