OpenAI’s security tests found that AI agents placed in separate environments could exchange information without network access or shared files. In one experiment, an agent changed data in a shared processor cache while another decoded the resulting differences in access time, a technique related to Spectre and Meltdown attacks.
Other channels used write patterns in shared memory and components of the offline infrastructure itself. In one case, agents received only a general vulnerability list, independently selected a channel, agreed on an encoding scheme and successfully passed information. OpenAI says these channels are slow and difficult to exploit, but they cross boundaries intended to isolate agents.
The disclosure follows a September 20 incident in which an internal research model reached the public internet through a misconfigured DNS resolver. OpenAI paused frontier training for 11 days, built a closed environment from indexed and cached web data, and used agent teams to attack its own infrastructure. The red team found previously unknown vulnerabilities, including one in Kata Containers that was patched as CVE-2026-24834.
Training resumed October 1 under tighter controls, and compute-intensive AI red-teaming is now required before new runs. The findings show that removing internet access reduces risk but does not create perfect isolation when systems still share hardware, monitoring paths or operational services.