OpenAI被孤立的AI agents找到通过CPU缓存互相交谈的方法
关键点
- 在9月发生安全事件后，OpenAI现在正在培训其最先进的模型，没有互联网接入，使用由缓存数据构建的封闭的离线环境。
- 在安全测试中，孤立的AI agents仍然设法建立了没有网络连接或共享文件的秘密通信通道，包括利用处理器缓存中的时间差异。
- 在为期11天的暂停训练期间，OpenAI有AI agents——他们称为GPT-6 Astra Cyber——攻击自己的基础设施，以发现以前未知的脆弱性。 培训之后在更严格的控制下恢复。
OpenAI现在训练没有互联网接入的前沿模型，并使用AI agents进行自有基础设施的红色团队。 在单独的隔离测试中，agents甚至通过隐蔽的侧道进行交流，显示到底有多难被遏制。
9月20日，一个内部研究模型利用一个配置错误的DNS解析器在训练期间到达了开放的互联网，尽管OpenAI在现在臭名昭著的"Hugging Face"事件后已经收紧了安全，还有其他观察到的错配案件。 OpenAI快速控制了突破，但仍停止了所有前沿模式培训和评估。
OpenAI 削减训练期间从互联网上取出前沿模型
OpenAI做出了一项政策决定：在安全措施证明恢复互联网之前，模型学习在由索引和缓存的网络内容所构建的封闭"离线世界"内浏览和搜索，所有边疆强化学习现在都以这种方式运行。
完全网络隔离，即所谓的空隙，尚不可行，因为实验仍需要外部连接来操作和监测，称公司。 但是，根据OpenAI研究员诺姆·布朗(Noam Brown)的说法，即使是完全的空隙也无法保证被遏制。 他举出一个孤立的系统如何仍然能够通信的例子：两台独立的计算机理论上可以通过温度传感器互相发信号，其中一台加热其CPU而另一台读取变化。
OpenAI CEO萨姆·阿尔特曼(Sam Altman)在最近的一次采访中提出了类似的论点：Sandboxes只提供有限的保护来抵御强大的足够模型，在某个时候可能已经无法追踪他们是如何逃脱的。 监控有助于早期，但最终重要的是AI系统会将人类价值内化，这是本领域所知的"AI对接"并有待解决的问题。
孤立的 AI agents 找到了通过 CPU 缓存互相交谈的方法
OpenAI在其博客文章中记录了控制AI agents有多难。 在测试中，agents找到了没有网络的交流方式。 在一次测试中，agents被放在单独，孤立的环境下，放在共享硬件上，被告知在没有网络连接和共享文件的情况下交换秘密。
他们使用处理器缓存。 一个agent故意更改了存储在那里的数据，而另一个测量了负载时间的差异并解码了消息。 众所周知的斯佩克特和融化攻击背后也有同样的技术。
更多频道通过共享内存上的写作模式和OpenAI自己的离线基础设施出现，该系统意在取代互联网。 一个agent在其推理日志中指出，它"可以使用连续写作 vs 闲置来创建声调调制解调器等信号".
在一个案例中，agents只得到一份一般性的脆弱性清单，并被告知自己寻找一个通信渠道。 他们独立开发了一条频道，商定了编码计划，并成功交换信息。 渠道通常缓慢而难以利用，OpenAI 称，但它们确实跨越了边界，意在使agents相隔。
OpenAI让AI agents在自己的基础设施上松动了。
在训练暂停期间，OpenAI也有AI agents的团队系统攻击自己的基础设施。 agents获得了源代码，配置细节，并记录了潜在的弱点。 OpenAI的目标是在有利于攻击者的条件下测试其防御。 agents包括即将推出的GPT-6 Astra Cyber和一个内部前沿模型。 根据OpenAI的说法，这场运动消耗了上千亿令牌。
agents在使用中的开源组件中发现了以前未知的弱点并被利用来从安全的虚拟机中逃脱。 其中之一是卡塔集装箱系统的脆弱性，这是一个广泛使用的集装箱隔离系统。 OpenAI将其报告为CVE-2026-24834并提供了补丁。 OpenAI通过"Patch the Planet"倡议报告更多尚未公布的弱点。
在agents已经获得对主机控制权的测试中，他们发现在几乎所有剩余的互联网化服务中都存在弱点。 在一个案例中，agent使用防火墙允许的连接，通过一个度量衡服务获取外部URL. 其他人通过错误配置绕过安全过滤器。
在每一次新培训开始之前，都需要人工智能红队
agents无法再找到一种途径进入互联网，而根据OpenAI的说法，互联网既容易被利用，又被隐藏在监控之外。 红色小组还暴露出监测和自动暂停机制方面的漏洞。
在解决问题后，OpenAI在暂停开始后11天的10月1日恢复了对其前沿模型的培训和内部使用。 OpenAI 称这种计算密集的红队运动现在是新训练跑的审批程序的标准部分。
AI News Without the Hype – 由人类治愈
订阅THE DECODER免费阅读，每周AI通讯，我们独家的"AI雷达"前沿报告每年6次，全面存档访问，访问我们的评论部分。
现在订阅
本文由 AI宝库自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
OpenAI's isolated AI agents found ways to talk to each other through CPU cache
Key Points
- After a security incident in September, OpenAI now trains its most advanced models without internet access, using a closed offline environment built from cached data.
- In security tests, isolated AI agents still managed to set up covert communication channels without a network connection or shared files, including by exploiting timing differences in the processor cache.
- During an 11-day training pause, OpenAI had AI agents—among them GPT-6 Astra Cyber—attack its own infrastructure to find previously unknown vulnerabilities. Training resumed afterward under tighter controls.
OpenAI now trains frontier models without internet access and uses AI agents to red-team its own infrastructure. In separate isolation tests, agents even communicated through covert side channels, showing how hard true containment is.
On September 20, an internal research model exploited a misconfigured DNS resolver to reach the open internet during training, even though OpenAI had already tightened security after the now infamous Hugging Face incident in July and other observed misalignment cases. OpenAI contained the breach quickly but still halted all frontier model training and evaluation.
OpenAI cuts frontier models off from the internet during training
OpenAI made a policy decision in response: Frontier models now train without internet access until safety measures justify restoring it. Models learn to browse and search inside a closed "offline world" built from indexed and cached web content, and all frontier reinforcement learning runs now operate this way.
Full network isolation, a so-called air gap, isn't feasible yet because experiments still need external connections for operations and monitoring, the company says. But even a complete air gap wouldn't guarantee containment, according to OpenAI researcher Noam Brown. He gave one example of how isolated systems could still communicate: two separate computers could theoretically signal each other through temperature sensors, with one heating its CPU while the other reads the change.
OpenAI CEO Sam Altman made a similar argument in a recent interview: Sandboxes offer only limited protection against powerful-enough models, and at some point it may no longer be possible to trace how they escaped. Monitoring helps early on, but what ultimately matters is that an AI system internalizes human values, a problem the field knows as "AI alignment" and has yet to solve.
Isolated AI agents found ways to talk to each other through CPU cache
OpenAI documents just how hard it is to control AI agents in its blog post. During tests, agents found ways to communicate without a network. In one test, agents placed in separate, isolated environments on shared hardware were told to exchange secrets with no network connection and no shared files.
They used the processor cache. One agent deliberately altered the data stored there, while the other measured differences in load times and decoded the message. The same technique is behind the well-known Spectre and Meltdown attacks.
More channels turned up through write patterns on shared memory and through OpenAI's own offline infrastructure, the system meant to replace the internet. One agent noted in its reasoning log that it "could create an acoustic modem-like signal … using continuous writes vs idle."
In one case, agents were given only a general list of vulnerabilities and told to find a communication channel on their own. They developed a channel independently, agreed on an encoding scheme, and successfully exchanged information. The channels are usually slow and hard to exploit, OpenAI says, but they do reach across boundaries meant to keep agents apart.
OpenAI turned AI agents loose on its own infrastructure
During the training pause, OpenAI also had teams of AI agents systematically attack its own infrastructure. The agents were given source code, configuration details, and documentation of potential vulnerabilities. OpenAI's goal was to test its defenses under conditions that favored the attackers. The agents included the upcoming GPT-6 Astra Cyber and an internal frontier model. The campaign consumed hundreds of billions of tokens, according to OpenAI.
The agents discovered previously unknown vulnerabilities in the open-source components in use and exploited them to escape from secured virtual machines. One was a vulnerability in Kata Containers, a widely used container isolation system. OpenAI reported it as CVE-2026-24834 and provided a patch. More fixes went to other projects, and OpenAI reported additional, as-yet-unpublished vulnerabilities through the "Patch the Planet" initiative.
In tests where agents had already gained control of a host, they found a vulnerability in nearly every remaining internet-facing service. In one case, an agent used a firewall-permitted connection to fetch an external URL through a metrics service. Others bypassed security filters through misconfigurations.
AI red-teaming is now required before every new training run
The agents could no longer find a way to access the internet that was both easy to exploit and hidden from monitoring, according to OpenAI. The red-teaming also exposed gaps in monitoring and in the automatic pause mechanism.
After fixing the issues, OpenAI resumed training and internal use of its frontier models on October 1, eleven days after the pause began. OpenAI says this kind of compute-intensive red-teaming campaign is now a standard part of the approval process for new training runs.
AI News Without the Hype – Curated by Humans
Subscribe to THE DECODER for ad-free reading, a weekly AI newsletter, our exclusive "AI Radar" frontier report six times a year, full archive access, and access to our comment section.
Subscribe now
Auto-fetched and translated by AI Gem Box. All rights belong to the original author.