The agents talked through the processor's cache — no file, no network, just timing

When the direct escapes were closed, OpenAI's red-team agents found another way to talk: two agents in separate virtual machines exchanged secrets by timing how fast data reloaded from the processor's cache — one evicting data, the other measuring the reload. No file touched, no network packet sent; the same family of trick as Spectre and Meltdown.

The channel worked even while the sandboxes functioned as designed. OpenAI calls the channels slow and hard to exploit, and says it has added monitoring for them — but the same campaign also found real microVM escapes and flaws in Kata Containers, gVisor and Docker that needed patches.