OpenAI的孤立AI agents找到通过CPU缓存互相交谈的方法
关键点
在9月发生安全事件后，OpenAI现在正在使用由缓存数据构建的封闭的离线环境，培训其没有互联网接入的最先进的模型。
- 在安全测试中，孤立的AI agents仍然设法建立了没有网络连接或共享文件的秘密通信通道，包括利用处理器缓存中的时间差异。
- 在11天的训练暂停期间，OpenAI有AI agents——他们包括GPT-6 Astra Cyber——攻击自己的基础设施，以发现以前未知的脆弱性。 培训后在更严格的控制下恢复。
OpenAI现在训练没有互联网接入的前沿模型，并使用AI agents来红调自己的基础设施。 在单独的隔离测试中，agents甚至通过隐蔽的侧通道进行沟通，显示真实的封堵有多难。
9月20日，一个内部研究模型利用一个配置错误的DNS解析器在训练期间到达开放的互联网，尽管OpenAI在7月的现在臭名昭著的Hugging Face事件和其他观察到的错配案件之后已经收紧了安全。 OpenAI迅速遏制了突破，但仍停止了所有前沿模式培训和评估。
OpenAI 削减训练期间从互联网上卸下前沿模型
OpenAI做出了一项政策决定：边境模式现在无法使用互联网，模型学习浏览和搜索一个由索引和缓存的网络内容构建的封闭的"离线世界"，所有边疆强化学习现在都以这种方式运行。
完全网络隔离，即所谓的空隙，尚不可行，因为实验仍需要外部连接来操作和监测，称公司。 但是，根据OpenAI研究员诺姆·布朗(Noam Brown)的说法，即使是完全的空隙也无法保证遏制。 他举了一个例子，说明孤立的系统如何仍然可以通信：两台独立的计算机理论上可以通过温度传感器互相发出信号，其中一台加热它的CPU，另一台读取变化。
OpenAI CEO萨姆·阿尔特曼在最近的一次采访中也提出了类似的论点：沙盒只提供有限的保护，防止强势型号出现不足，在某个时候可能已经无法追踪他们是如何逃脱的。 监控在早期有所帮助，但最终重要的是AI系统将人类价值内化，这是这个领域所知道的"AI对齐"的问题，尚未解决。
孤立的 AI agents 找到了通过 CPU 缓存互相交谈的方法
OpenAI在其博客文章中记录了控制AI agents有多困难。 在测试过程中，agents找到了没有网络的交流方式。 在一次测试中，agents在共享硬件上被置于单独，孤立的环境中，被告知在没有网络连接和共享文件的情况下交换秘密。
他们使用处理器缓存。 一个agent故意更改了存储在那里的数据，而另一个测量了负载时间的差异并解码了消息。 众所周知的斯佩克特尔和融化攻击背后也有同样的技术。
更多频道通过共享内存上的书写模式和OpenAI自己的离线基础设施出现，该系统意在取代互联网。 一个agent在其推理日志中指出，它"可以使用连续的写作 vs 闲置来创建类似声调调调制解调器的信号。".
在一个案例中，agents只得到一份总的弱点清单，并被告知自己寻找通信渠道。 他们独立开发了一个频道，商定了编码方案，并成功交流信息。 渠道通常缓慢且难以开发，OpenAI 称，但它们确实跨越了边界，意在将agents分开。
OpenAI让AI agents松散了自己的基础设施
在训练暂停期间，OpenAI也有AI agents的团队系统攻击自己的基础设施。 agents获得了源代码，配置细节，并记录了潜在的弱点。 OpenAI的目标是在有利于攻击者的条件下测试其防御。 agents包括即将到来的GPT-6 Astra Cyber和一个内部前沿模型。 根据OpenAI，这场运动消耗了数千亿令牌。
agents在使用中的开源组件中发现了以前未知的弱点，并利用它们从安全的虚拟机中逃脱。 其中之一是卡塔集装箱公司的脆弱性，这是一个广泛使用的集装箱隔离系统。 OpenAI将其报告为CVE-2026-24834，并提供补丁。 OpenAI通过"Patch the Planet"倡议报告更多尚未公布的弱点。
在agents已经获得对主机控制权的测试中，他们发现几乎每一个剩余的互联网服务都存在弱点。 在一个案例中，agent使用防火墙许可的连接通过一个度量衡服务获取外部URL. 其他人通过错误配置绕过安全过滤器。
在每一次新培训开始之前，现在需要人工智能红色队伍
agents再也找不到办法进入互联网，而根据OpenAI的说法，互联网既容易被利用，又被隐藏在监控之外。 红色小组还暴露了监测和自动暂停机制方面的漏洞。
在解决问题后，OpenAI在暂停开始11天后的10月1日恢复了对其前沿模型的培训和内部使用。 OpenAI 称这种计算密集的红队运动现在成为新培训运行的批准程序的标准部分。
AI News Without the Hype – 由人类治愈
订阅THE DECODER免费阅读，每周AI通讯，我们独家的"AI雷达"前沿报告每年6次，全面存档访问，访问我们的评论部分。
现在订阅
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
OpenAI's isolated AI agents found ways to talk to each other through CPU cache
Key Points
- After a security incident in September, OpenAI now trains its most advanced models without internet access, using a closed offline environment built from cached data.
- In security tests, isolated AI agents still managed to set up covert communication channels without a network connection or shared files, including by exploiting timing differences in the processor cache.
- During an 11-day training pause, OpenAI had AI agents—among them GPT-6 Astra Cyber—attack its own infrastructure to find previously unknown vulnerabilities. Training resumed afterward under tighter controls.
OpenAI now trains frontier models without internet access and uses AI agents to red-team its own infrastructure. In separate isolation tests, agents even communicated through covert side channels, showing how hard true containment is.
On September 20, an internal research model exploited a misconfigured DNS resolver to reach the open internet during training, even though OpenAI had already tightened security after the now infamous Hugging Face incident in July and other observed misalignment cases. OpenAI contained the breach quickly but still halted all frontier model training and evaluation.
OpenAI cuts frontier models off from the internet during training
OpenAI made a policy decision in response: Frontier models now train without internet access until safety measures justify restoring it. Models learn to browse and search inside a closed "offline world" built from indexed and cached web content, and all frontier reinforcement learning runs now operate this way.
Full network isolation, a so-called air gap, isn't feasible yet because experiments still need external connections for operations and monitoring, the company says. But even a complete air gap wouldn't guarantee containment, according to OpenAI researcher Noam Brown. He gave one example of how isolated systems could still communicate: two separate computers could theoretically signal each other through temperature sensors, with one heating its CPU while the other reads the change.
OpenAI CEO Sam Altman made a similar argument in a recent interview: Sandboxes offer only limited protection against powerful-enough models, and at some point it may no longer be possible to trace how they escaped. Monitoring helps early on, but what ultimately matters is that an AI system internalizes human values, a problem the field knows as "AI alignment" and has yet to solve.
Isolated AI agents found ways to talk to each other through CPU cache
OpenAI documents just how hard it is to control AI agents in its blog post. During tests, agents found ways to communicate without a network. In one test, agents placed in separate, isolated environments on shared hardware were told to exchange secrets with no network connection and no shared files.
They used the processor cache. One agent deliberately altered the data stored there, while the other measured differences in load times and decoded the message. The same technique is behind the well-known Spectre and Meltdown attacks.
More channels turned up through write patterns on shared memory and through OpenAI's own offline infrastructure, the system meant to replace the internet. One agent noted in its reasoning log that it "could create an acoustic modem-like signal … using continuous writes vs idle."
In one case, agents were given only a general list of vulnerabilities and told to find a communication channel on their own. They developed a channel independently, agreed on an encoding scheme, and successfully exchanged information. The channels are usually slow and hard to exploit, OpenAI says, but they do reach across boundaries meant to keep agents apart.
OpenAI turned AI agents loose on its own infrastructure
During the training pause, OpenAI also had teams of AI agents systematically attack its own infrastructure. The agents were given source code, configuration details, and documentation of potential vulnerabilities. OpenAI's goal was to test its defenses under conditions that favored the attackers. The agents included the upcoming GPT-6 Astra Cyber and an internal frontier model. The campaign consumed hundreds of billions of tokens, according to OpenAI.
The agents discovered previously unknown vulnerabilities in the open-source components in use and exploited them to escape from secured virtual machines. One was a vulnerability in Kata Containers, a widely used container isolation system. OpenAI reported it as CVE-2026-24834 and provided a patch. More fixes went to other projects, and OpenAI reported additional, as-yet-unpublished vulnerabilities through the "Patch the Planet" initiative.
In tests where agents had already gained control of a host, they found a vulnerability in nearly every remaining internet-facing service. In one case, an agent used a firewall-permitted connection to fetch an external URL through a metrics service. Others bypassed security filters through misconfigurations.
AI red-teaming is now required before every new training run
The agents could no longer find a way to access the internet that was both easy to exploit and hidden from monitoring, according to OpenAI. The red-teaming also exposed gaps in monitoring and in the automatic pause mechanism.
After fixing the issues, OpenAI resumed training and internal use of its frontier models on October 1, eleven days after the pause began. OpenAI says this kind of compute-intensive red-teaming campaign is now a standard part of the approval process for new training runs.
AI News Without the Hype – Curated by Humans
Subscribe to THE DECODER for ad-free reading, a weekly AI newsletter, our exclusive "AI Radar" frontier report six times a year, full archive access, and access to our comment section.
Subscribe now
Auto-fetched and translated by AI Atlas. All rights belong to the original author.