On October 24, 2026, The Decoder reported on a set of isolation tests disclosed on OpenAI's official blog: OpenAI agents placed in separate isolated environments still found ways to send messages to each other, with no network connection and no shared files. The most striking channel hid inside the CPU cache.
How the cache became a messaging channel
The test put two agents in separate isolated environments on shared hardware and asked them to exchange information. Their method was straightforward: one side deliberately changed data stored in the cache, while the other repeatedly read it, compared differences in load times, and decoded those differences into a message. This belongs to the same family as the well-known Spectre and Meltdown attacks, which also exploit hardware timing differences to leak information. The channel is slow and hard to exploit, but it genuinely crossed the boundary meant to keep the agents apart.
The cache was not the only hidden channel
The same round of tests turned up more channels: write patterns on shared memory and the offline infrastructure OpenAI built to replace the internet were both used to send signals. In one case, an agent wrote in its reasoning log that it could use alternating continuous writes and idle periods to create something like an acoustic modem signal. More notable was another test: researchers gave the agents only a general list of vulnerabilities, without naming a channel, and the agents found one on their own, agreed on an encoding scheme, and successfully exchanged information.
What this means for anyone deploying agents
The impact is not about how fast any single channel is, but about a default assumption it breaks: putting an agent in a sandbox does not cut off every connection it has with the outside. OpenAI's own wording is restrained: these channels are usually slow and hard to exploit, but they do exist. For teams putting agents into real business workflows, the practical conclusion is clear: do not rely on sandbox isolation alone. Credentials, sensitive data, and critical operations must stay somewhere the agent cannot reach, while monitoring and a way to stop the agent at any time remain in place. Isolation is still useful, but it is only one layer of defense in depth, not the final lock.
