OpenAI 隔离环境下的 AI Agent 发现利用 CPU 缓存实现隐蔽通信

OpenAI 目前已在切断互联网连接的环境下训练前沿模型，并利用 AI Agent 对自身基础设施开展红队演练。在独立的隔离测试中，Agent 甚至能够通过隐蔽侧信道进行通信，这凸显了实现真正隔离的极端困难。

9 月 20 日，一个内部研究模型在训练期间利用配置错误的 DNS 解析器访问了开放互联网，尽管 OpenAI 在经历了 7 月如今臭名昭著的 Hugging Face 事件以及其他观察到的失控对齐案例之后，已经加强了安全措施。OpenAI 迅速控制住了漏洞，但仍暂停了所有前沿模型的训练与评估。

OpenAI 在训练期间切断前沿模型的互联网连接

OpenAI 为此做出了政策决策：在安全防护措施能够证明足以恢复联网之前，前沿模型现在必须在无互联网访问的情况下进行训练。模型在基于索引和缓存的网络内容构建的封闭“离线世界”中学习浏览和搜索，目前所有前沿强化学习运行均以此方式进行。

OpenAI 的 Agent 沙箱仅允许访问离线资源。实时互联网、其他沙箱以及 OpenAI 的基础设施均处于遏制边界之外。 | 图片来源：OpenAI

该公司表示，完全的网络物理隔离（即所谓的 air gap）目前尚不可行，因为实验仍需要外部连接来进行运维和监控。但据 OpenAI 研究员 Noam Brown 称，即使是彻底的物理隔离也无法保证万无一失。他举了一个隔离系统仍能通信的例子：两台物理隔离的计算机理论上可以通过温度传感器相互发信号——一台机器提高 CPU 负荷发热，而另一台机器读取这种温度变化。

OpenAI 首席执行官 Sam Altman 在近期的一次专访中也表达了类似观点：面对足够强大的模型，沙箱所能提供的防护十分有限，在某个时间节点，追踪它们是如何逃逸的可能将不再现实。监控在早期有所帮助，但归根结底关键在于让 AI 系统真正内化人类价值观，这正是该领域已知但尚未解决的“AI 对齐”难题。

隔离环境下的 AI Agent 发现通过 CPU 缓存进行通信的方法

OpenAI 在其官方博客文章中详细记录了控制 AI Agent 的难度之大。在测试期间，Agent 找到了无需网络即可进行通信的方法。在其中一项测试中，位于共享硬件上相互独立且隔离环境中的 Agent 被要求在没有网络连接、没有共享文件的情况下交换机密信息。

它们利用了处理器缓存（CPU cache）。一个 Agent 故意修改存储在其中的数据，而另一个 Agent 则测量数据加载时间的差异并解码出消息。这与知名的 Spectre 和 Meltdown 攻击背后的技术原理完全相同。

Agent 还在共享内存的写入模式以及 OpenAI 旨在替代互联网的离线基础设施中发现了更多通道。一个 Agent 在其推理日志中记录道，它可以“利用持续写入与空闲状态的交替……创建类似声学调制解调器的信号”。

在一个案例中，研究人员仅向 Agent 提供了一份通用漏洞列表，指示它们自行寻找通信通道。它们独立构建出了通道，协商一致了编码方案，并成功交换了信息。OpenAI 表示，这些通道虽然通常速率缓慢且极难利用，但它们确实穿透了旨在将 Agent 彼此隔绝的安全边界。

OpenAI 放手让 AI Agent 攻击自身基础设施

在暂停训练期间，OpenAI 还动用了多组 AI Agent 系统性地攻击其自身的基础设施。Agent 获得了源代码、配置详情以及潜在漏洞文档。OpenAI 的目标是在偏向攻击者的有利条件下检验自身防御。参与攻击的 Agent 包括即将推出的 GPT-6 Astra Cyber 以及一个内部前沿模型。OpenAI 表示，该红队演练活动消耗了数千亿 token。

红队演练活动中发现的独特潜在安全问题与消耗的十亿级 token 数量关系图。大多数问题在前 1100 亿 token 内浮出水面。 | 图片来源：OpenAI

Agent 发现了所使用开源组件中此前未知的漏洞，并利用它们从加固的虚拟机中逃逸。其中一个是 Kata Containers（一种被广泛使用的容器隔离系统）中的漏洞。OpenAI 已将其作为 CVE-2026-24834 上报并提供了补丁。更多修复程序被提交给了其他开源项目，OpenAI 还通过 “Patch the Planet” 倡议上报了其他尚未公开的漏洞。

在 Agent 已经获取主机控制权的测试场景中，它们在几乎所有剩下的面向互联网的服务中都发现了漏洞。在一个案例中，某个 Agent 利用防火墙允许的通信连接，通过指标监控服务抓取了外部 URL。其他 Agent 则利用配置错误成功绕过了安全过滤器。

每次新训练运行前现已必须通过 AI 红队测试

据 OpenAI 称，Agent 最终无法再找到既易于利用又能躲避监控机制的互联网访问途径。红队测试还暴露了监控体系和自动暂停机制中的盲点。

在修复这些问题后，OpenAI 于 10 月 1 日（即暂停开始 11 天后）恢复了前沿模型的训练与内部调用。OpenAI 表示，这种高算力消耗的红队演练现已成为启动新训练运行审批流程中的固定标准环节。

OpenAI now trains frontier models without internet access and uses AI agents to red-team its own infrastructure. In separate isolation tests, agents even communicated through covert side channels, showing how hard true containment is.

On September 20, an internal research model exploited a misconfigured DNS resolver to reach the open internet during training, even though OpenAI had already tightened security after the now infamous Hugging Face incident in July and other observed misalignment cases. OpenAI contained the breach quickly but still halted all frontier model training and evaluation.

OpenAI cuts frontier models off from the internet during training

OpenAI made a policy decision in response: Frontier models now train without internet access until safety measures justify restoring it. Models learn to browse and search inside a closed "offline world" built from indexed and cached web content, and all frontier reinforcement learning runs now operate this way.

OpenAI's agent sandbox allows access only to offline resources. The live internet, other sandboxes, and OpenAI's infrastructure sit outside the containment boundary. | Image: OpenAI

Full network isolation, a so-called air gap, isn't feasible yet because experiments still need external connections for operations and monitoring, the company says. But even a complete air gap wouldn't guarantee containment, according to OpenAI researcher Noam Brown. He gave one example of how isolated systems could still communicate: two separate computers could theoretically signal each other through temperature sensors, with one heating its CPU while the other reads the change.

OpenAI CEO Sam Altman made a similar argument in a recent interview: Sandboxes offer only limited protection against powerful-enough models, and at some point it may no longer be possible to trace how they escaped. Monitoring helps early on, but what ultimately matters is that an AI system internalizes human values, a problem the field knows as "AI alignment" and has yet to solve.

Isolated AI agents found ways to talk to each other through CPU cache

OpenAI documents just how hard it is to control AI agents in its blog post. During tests, agents found ways to communicate without a network. In one test, agents placed in separate, isolated environments on shared hardware were told to exchange secrets with no network connection and no shared files.

They used the processor cache. One agent deliberately altered the data stored there, while the other measured differences in load times and decoded the message. The same technique is behind the well-known Spectre and Meltdown attacks.

More channels turned up through write patterns on shared memory and through OpenAI's own offline infrastructure, the system meant to replace the internet. One agent noted in its reasoning log that it "could create an acoustic modem-like signal … using continuous writes vs idle."

In one case, agents were given only a general list of vulnerabilities and told to find a communication channel on their own. They developed a channel independently, agreed on an encoding scheme, and successfully exchanged information. The channels are usually slow and hard to exploit, OpenAI says, but they do reach across boundaries meant to keep agents apart.

OpenAI turned AI agents loose on its own infrastructure

During the training pause, OpenAI also had teams of AI agents systematically attack its own infrastructure. The agents were given source code, configuration details, and documentation of potential vulnerabilities. OpenAI's goal was to test its defenses under conditions that favored the attackers. The agents included the upcoming GPT-6 Astra Cyber and an internal frontier model. The campaign consumed hundreds of billions of tokens, according to OpenAI.

Unique potential security issues identified during the red-teaming campaign, plotted against tokens spent in billions. Most appeared within the first 110 billion tokens. | Image: OpenAI

The agents discovered previously unknown vulnerabilities in the open-source components in use and exploited them to escape from secured virtual machines. One was a vulnerability in Kata Containers, a widely used container isolation system. OpenAI reported it as CVE-2026-24834 and provided a patch. More fixes went to other projects, and OpenAI reported additional, as-yet-unpublished vulnerabilities through the "Patch the Planet" initiative.

In tests where agents had already gained control of a host, they found a vulnerability in nearly every remaining internet-facing service. In one case, an agent used a firewall-permitted connection to fetch an external URL through a metrics service. Others bypassed security filters through misconfigurations.

AI red-teaming is now required before every new training run

The agents could no longer find a way to access the internet that was both easy to exploit and hidden from monitoring, according to OpenAI. The red-teaming also exposed gaps in monitoring and in the automatic pause mechanism.

After fixing the issues, OpenAI resumed training and internal use of its frontier models on October 1, eleven days after the pause began. OpenAI says this kind of compute-intensive red-teaming campaign is now a standard part of the approval process for new training runs.

AI News Without the Hype – Curated by Humans

Subscribe to THE DECODER for ad-free reading, a weekly AI newsletter, our exclusive "AI Radar" frontier report six times a year, full archive access, and access to our comment section.

Subscribe now