They succeeded through CPU-cache timing. One agent changed cache state; the other measured access times and decoded the signal.

These were instructed red-team tests in purpose-built copies of OpenAI’s training and evaluation infrastructure. They were not spontaneous collusion or tests of customer-facing agent products.

Preventing a VM escape and preventing communication are different security requirements.

What does “isolated” promise?

In my earlier sandbox and governance piece, I argued that an agent can stay within its permitted technical reach and still take an unauthorized action. A sandbox cannot substitute for authorization.

OpenAI’s report raises a question inside the containment claim itself. What, exactly, is separated?

• Private memory: can the host or another workload read or modify protected state?
• Execution: can code escape its guest and gain control of the host?
• Communication: can workloads exchange information through a shared resource or service?

A system can enforce one property while failing another. Add monitoring and stopping, and there is another claim to test: can the operator detect a violation and terminate the relevant activity in time?

Here I am discussing the environments where agents execute tools and code. Protecting the server that runs model inference does not, by itself, protect every browser, shell, or service the agent uses.

More VM layers can help. Shared resources still matter.

In a supported nested design, an outer VM can provide another boundary between a compromised inner environment and the physical host. An escape from the inner VM does not automatically defeat the outer hypervisor. That is useful defense in depth, provided the outer boundary actually constrains the attacker’s next steps.

It does not follow that two agents can no longer communicate.

Suppose their execution affects a shared CPU cache. A sender can deliberately change resource usage, while a receiver measures an observable effect. This is a covert channel: cooperating parties use a resource that was not intended to carry their messages. They need not read each other’s private memory or gain control of the physical host to use such a channel.

An extra VM layer does not inherently remove that shared resource. An outer layer may enforce resource partitioning or stricter placement, but the communication-isolation benefit comes from those controls and their implementation, not from nesting alone.

Two kinds of sharing to examine, not OpenAI’s exact deployment or one combined experiment. VM boundaries do not, on their own, establish communication isolation.

The precise channel depends on hardware, scheduling, memory mappings, software, and mitigations. OpenAI’s result does not establish that its protocol works unchanged in every nested or confidential-VM design.

For a threat model that prohibits sharing CPU resources across security domains, separate physical hosts remove that shared-CPU path. They do not eliminate shared-service channels elsewhere. Dedicated vCPUs or disabling simultaneous multithreading alone are not evidence that all relevant resources are separated.

Confidential computing changes who you trust

Confidential computing addresses another adversary: infrastructure software that the workload does not trust with its private state. Intel’s TDX developer guidance describes protecting workloads from privileged software, including the host hypervisor, for confidentiality and integrity.

That is valuable protection. It is not a promise that an agent authorized to read a secret cannot choose to disclose it.

The same guidance says timing side channels based on shared microarchitectural resources, including caches, remain a concern for TDX guests. It also documents hardware and software mitigations for particular attack classes. The processor generation, TDX version, guest software, and deployed controls matter.

Attestation provides evidence about measurements and configuration. Intel’s TDX module specification, sections 2.7 and 12, describes that evidence. A verifier still needs to appraise it against policy; a valid quote is not a general certificate that an agent behaves correctly or that every shared dependency is isolated.

OpenAI’s cache experiment is not a demonstrated TEE break. Nor does adding confidential memory establish that its communication problem has been solved. Those claims require different evidence.

The monitoring plumbing belongs in the threat model

In a separate set of tests, OpenAI deliberately gave agents control of a host machine. This assumed the inner defenses had already failed, allowing researchers to evaluate the surrounding network and cloud perimeter independently.

Narrow connections remained for metrics, logging, and authentication management. OpenAI reports that agents found weaknesses in almost every one of these services that provided limited forms of internet access. In one chain, an agent reused a firewall-approved connection to reach a blocked authentication endpoint in the metrics service, then caused that endpoint to fetch a model-provided URL.

That starting privilege is essential context. This is not a claim that every intact agent sandbox could reach those endpoints.

A reachable service can extend an attacker’s effective reach. A firewall rule about the first connection is insufficient if the permitted service can be induced to make a forbidden second connection.

An offline world can still have shared state

OpenAI also reports communication channels involving shared storage, CPU contention within a shared execution container, and a TLS certificate cache in its offline web infrastructure. These were separate tests, not one universal cross-VM exploit.

In most communication tests, researchers suggested channels or supplied an encoding protocol. For the broader red-teaming campaign, OpenAI also supplied infrastructure source code, configuration details, and documentation describing potential vulnerabilities. The campaign tested defenses under attacker-favorable conditions, rather than measuring unaided discovery.

The certificate-cache finding broadens the review beyond hardware. Disconnecting live browsing does not establish that different tasks have independent service state.

I would therefore inventory shared dependencies alongside network routes: caches, storage backends, queues, and other services. For each, ask whether one task can change something another task can observe. That is a review method, not a claim that every shared component is exploitable.

OpenAI describes most of the channels as slow and difficult for models to exploit. Bandwidth, noise, and the time available should inform the risk assessment.

Ask for evidence one property at a time

For an agent-runtime review, I would start with this test matrix. These are proposed review questions, not a claim that OpenAI publishes all of these measurements.

Suppose testing a hypothetical offline web service reveals cross-tenant signaling through its shared certificate cache, violating the deployment’s isolation requirement. I would reject that configuration until each tenant has a separate cache instance and store, access controls bound to authenticated tenant identity, and no shared-cache fallback. Acceptance would require inspecting deployed routing and permissions, then retesting cache-state and timing influence under documented load and observation windows. Any observed cross-tenant cache channel would block acceptance. Shared hardware and other services would still need review.

Passing a finite set of channel tests cannot prove that no possible channel exists. It can provide bounded evidence for a stated threat model and deployment.

OpenAI says its red-teaming exposed gaps in monitoring, automatic pausing, and agent-team safety mechanisms, and that it repaired specific failures. Those controls deserve adversarial testing alongside the boundaries they supervise.

The report also says researchers did not find an internet route agents could trivially exploit while concealing activity from monitors. That is a narrower finding than either “containment is broken” or “containment is proven.”

I want an isolation claim to name the adversary, the property, the enforcement point, and the evidence.

Disclaimer: The views expressed here are my own and do not represent those of my employer.

Sources

• OpenAI, Securing our frontier model training environment, especially “Red-teaming containment at scale,” “Finding novel paths to the internet,” “Communicating across isolated tasks,” and “Resuming frontier training with stronger defenses.”
• Intel, Trust Domain Security Guidance for Developers, especially “Overview,” “Software Hardening Recommendations,” and “Timing Side Channels.”
• Intel, Intel TDX Module Base Specification, May 2026, document 348549-008US, sections 2.7 and 12 on measurement and attestation.