OpenAI shows isolated AI agents can communicate without a network via CPU cache
OpenAI described experiments where AI agents in separate isolated environments transmitted information through side channels such as processor cache, challenging assumptions about network and file isolation.
Noam Brown, a leading OpenAI researcher and one of the authors of o1 and o3, said in an interview with Dwarkesh Patel that simply disconnecting AI from the network may no longer be enough in an emergency. He referred to earlier research showing that two physically isolated computers could theoretically exchange data through heat.
A month later, this is no longer just theory. OpenAI ran several experiments and demonstrated that agents locked in different isolated environments can transmit information to each other.
In an OpenAI post, the company described several possible channels for such communication. In the main experiment, agents were placed in separate microVM environments without network access or shared files, and they used the processor cache to communicate.
- The sender encoded bits by deciding whether to evict data from the cache.
- The receiver reconstructed the message from the speed of re-reading that data — effectively a Morse code made of fast and slow cache reads.
- Similar channels could use CPU load or TLS certificate caches.
Formally, this was not an escape: the agents had a task to pass information to each other. But the experiment shows that such communication is possible. These channels are extremely slow, yet they mean that network and file isolation alone no longer guarantee full information isolation.
Why it matters
AnalysisFor frontier AI safety, simply removing network access may be insufficient: hardware and timing side channels can still leak information between isolated environments.
Discuss in community
Share your questions and insights with developers
Related in Ecosystem
Practical guides, core terminology, and agent skills
GPT-5.6 Sol Finds Critical PHP Vulnerability
Researchers from California reported a critical PHP vulnerability under the Patch the Planet initiative; OpenAI calls it one of the most significant security findings recently.
Claude Code Projects: How a Single AI Orchestrates a Team of Autonomous Agents
A deep dive into Claude Code Projects: Coordinator and Threads architecture, parallel branches, shared memory via MEMORY.md, and cloud agent management.
AI Agents (Autonomous Agents)
Software systems based on LLMs that can autonomously perceive the state of the environment, decompose complex goals, invoke external tools, and iteratively correct their own mistakes.
OpenAI GPT (Flagship Models of the GPT Series)
The primary universal line of large language models from OpenAI (GPT-4, GPT-4o). Optimized for complex text analysis, programming, creativity, and daily intellectual tasks.
Anthropic recommends reducing subagents in AI systems
Anthropic is advising companies to rethink multi-agent architectures: a single main agent with dynamically loaded skills and tools can be faster and cheaper than complex subagent networks.
Jev and System One AI: A Complete Practical Guide to the Decision Model from TypeSafe
A deep engineering breakdown of the flagship Jev model: System One architecture versus LLMs, Choice/Score/Noul primitives, request parallelism, confidence mathematics, video use cases, code, and an overview of local open-weight alternatives (Laya, GLiNER2.5, CLM-8B).