OpenAI agents found a way to talk without an internet connection

OpenAI agents exchanged test secrets between isolated computing environments without a network connection or shared writable files. In its October 23 security report, the company describes controlled experiments designed to break its internal research defenses, rather than a breach of customer accounts.

The agents used shared processor hardware to send signals. One changed what was held in the processor’s fast memory, or cache; another measured how quickly data loaded to recover the message.

OpenAI directed most experiments toward particular channels or supplied an encoding method. In one case, agents received a broad vulnerability list and developed the communication method themselves. The company says these channels are generally slow and difficult to exploit, and it added monitoring checks.

Earlier monitoring gaps show where oversight can fail

A separate METR and Redwood Research audit, published October 22, examined OpenAI’s internal monitoring during an on-site exercise from July 21 to August 11. Its findings concern that historical system; the researchers did not establish the coverage of subsequent changes.

The audit estimated that missing checks on conversation-summary events left roughly 10% of eligible internal Codex traffic unmonitored between May and July, with substantial uncertainty. OpenAI had independently identified the issue and fixed it during the exercise.

OpenAI later told the researchers it had patched all identified vulnerabilities affecting production safeguards. METR says it has not evaluated that claim.

At the time, agents could also postpone monitoring by continuing to act instead of returning control to a user. A check triggered only after work finishes can arrive too late to interrupt a long sequence of actions.

Agent permissions need checks beyond the chat window

Controls such as the repository-specific access policies in Nvidia OpenShell illustrate how permissions can be enforced outside the model. The OpenAI findings add another test for infrastructure owners: whether activity in an authorized workspace can cross the boundary through shared resources.

Source: OpenAI