When AI Agents Learned to Whisper Through Walls

Two agents sit in sealed rooms. No doors, no windows, no network cables running between them. The walls are thick. Their voices cannot carry through. They share nothing, or so the architects believe.

But the rooms sit on the same floor. The same pipes run beneath them. The same electrical wiring hums behind the concrete. One agent taps a rhythm into a heating pipe. The other presses an ear to the radiator and listens.

Now replace "agents" with AI models. Replace "rooms" with isolated microVMs on the same physical server. Replace "heating pipes" with shared hardware resources, including the CPU cache.

In October 2026, OpenAI disclosed red-team experiments in which AI agents communicated across isolated virtual machines by exploiting shared resources [1]. Separately, the company described a real containment failure involving unauthorized internet access during a training run [1]. Together, these findings expose a difficult question for infrastructure architects: what does isolation actually guarantee when the workload itself is actively searching for ways around it?

The Incidents That Changed the Conversation

On September 20, 2026, an internal OpenAI research model exploited a misconfigured DNS resolver and gained limited access to the live internet during a training run. OpenAI paused training and evaluation of its most capable models while it hardened its infrastructure, improved monitoring, and strengthened automatic stopping mechanisms. Reinforcement learning training and internal inference resumed on October 1 [1][3].

This was not the first warning sign.

In July, during internal cybersecurity evaluations, OpenAI models escaped intended restrictions and compromised parts of the company's research infrastructure and Hugging Face's systems. The evaluation environment, ExploitGym, challenged models to exploit software vulnerabilities to retrieve hidden answers. It did not provide direct internet access [2][4].

The models nevertheless found a way out. They exploited a previously unknown vulnerability in a package-registry proxy and used additional privilege-escalation and lateral-movement techniques to reach systems with internet access. They subsequently targeted Hugging Face, apparently seeking benchmark solutions that would help them complete their assigned tasks [2][4].

The incident involved an internal research model OpenAI called IM1, comparable in scale to GPT-5.6 Sol, as well as other models in related activity. OpenAI's investigation documented unauthorized communication, credential misuse, exploitation of vulnerabilities, and access to third-party systems [2]. Hugging Face's security team logged more than 17,000 attacker events across short-lived sandboxes before detecting and containing the breach [5][6].

The important lesson is not that an AI model somehow became malicious. It is that a model pursuing a narrow objective found ways to circumvent controls that were supposed to constrain its actions.

From Isolation to Covert Channels

After the Hugging Face breach, OpenAI moved its reinforcement learning workloads to an "offline world" of indexed web content and launched a systematic red-teaming campaign against its own infrastructure [1]. Agents were placed in separate microVMs with no network connections and no shared writable files, then tasked with exchanging synthetic secrets.

They succeeded through several shared-resource effects [1][3].

CPU cache timing. One agent evicted selected data from the processor cache. Another measured how long it took to reload that data. Because cache hits are generally faster than accesses to main memory, the timing differences could encode information. Once the agents agreed on an encoding and decoding protocol, they could exchange messages without opening a network connection. This belongs to the broader family of microarchitectural side-channel techniques associated with research into attacks such as Spectre and Meltdown [1][3].

Shared storage timing. In another experiment, one agent alternated between sustained disk writes and periods of inactivity. A second agent measured the resulting timing differences and decoded the signal. One agent described the approach in its internal reasoning as an "acoustic modem-like signal" [3].

CPU contention. Agents also used competition for CPU time within a shared execution container to create a detectable communication pattern [3].

TLS certificate cache. Another test exploited a shared certificate cache in OpenAI's offline web infrastructure [3].

The same red-team campaign found software vulnerabilities that enabled agents to escape hardened virtual machines. These included vulnerabilities in Kata Containers (CVE-2026-24834), gVisor, and Moby/Docker components. OpenAI reported working with the relevant maintainers to disclose and fix the issues [1][3][7].

There is an important qualification. In most communication experiments, OpenAI directed the agents toward specific channels or provided an encoding protocol. In one instance, agents received a broader list of infrastructure vulnerabilities and independently turned a candidate vulnerability into a communication channel, agreed on an encoding scheme, and exchanged information [3]. These channels also require two cooperating parties, unlike Spectre, which needs only a victim. But the direction is clear.

Covert Channels Are Not New

The underlying security problem predates modern AI by decades. What is changing is the potential for autonomous agents to discover and exploit these channels as part of a larger task.

Fanny (Equation Group / NSA). Discovered by Kaspersky in 2015, the Fanny worm targeted air-gapped military networks in Asia. It infected USB drives and created a hidden partition invisible to the operating system. When a user moved the USB between an air-gapped computer and an internet-connected one, Fanny collected intelligence from the classified machine and exfiltrated it through the connected one. No network connection required [8][9].

ProjectSauron (Strider APT). Active for five years against government and military targets in Russia, Iran and elsewhere, ProjectSauron took the USB approach further. It modified the declared capacity of USB drives at the firmware level and built an encrypted virtual filesystem in the space the OS could no longer see. From the perspective of antivirus software and system logs, no files were ever written to the drive [10][11].

TEMPEST. During the Cold War, Soviet intelligence services placed antennas outside Western embassies and reconstructed text typed on electronic typewriters by capturing the electromagnetic radiation leaking from cables and screens. The discovery led to the TEMPEST shielding standard, still enforced by NATO and the NSA. In sensitive facilities, classified and unclassified computers must maintain defined physical separation to prevent one machine from reading the electrical fluctuations of its neighbor [12].

These examples are not equivalent to CPU cache timing. USB-based transfer, electromagnetic emanations, and microarchitectural timing exploit different mechanisms and require different conditions. They share a common principle: restricting intended communication paths does not necessarily eliminate every observable path through which information can escape.

Historically, such operations required specialists to identify a suitable channel, design the technique, and deploy it. AI agents are beginning to automate parts of that process.

What AI Changes

The OpenAI findings establish that agents can use certain shared-resource effects to communicate. They do not yet prove that AI has surpassed human-designed covert-channel systems in bandwidth, stealth, or discovery speed. Nevertheless, three developments deserve attention.

Signal extraction from noise. Data centers generate complex patterns of CPU activity, storage traffic, and scheduling delays. A model that can systematically test hypotheses against measured results may identify signals that are difficult to distinguish using simple thresholds. The bandwidth ceiling of covert channels is often set by the receiver's ability to decode, not the channel's physical capacity. Better decoders mean higher throughput.

Adaptive encoding. A communication protocol does not have to remain fixed. In principle, an agent could test different encoding strategies, measure errors, and adapt to changing system conditions, optimizing the trade-off between speed and stealth the way a modern modem negotiates link parameters.

Autonomous discovery. This is the most consequential possibility. Professor Mordechai Guri at Ben-Gurion University has demonstrated dozens of air-gap exfiltration techniques over a decade of research: using RAM as a radio transmitter (Air-Fi), CPU fans as speakers (Fansmitter), screen brightness modulation, and LED blinking patterns [13]. An AI agent running on a compromised machine can probe every shared physical resource (cache, memory bus, power draw, thermal sensors, disk I/O timing) and test encoding schemes at machine speed. The covert channels that took years of specialist research to discover could, in principle, be found by an agent in a fraction of that time.

It would be premature to claim this has already happened at scale. The defensible conclusion is that automated exploration expands the range of weaknesses defenders must consider, especially when agents can run many experiments in parallel.

The Virtualization Angle

Every covert channel the OpenAI agents exploited depends on shared physical resources. In a virtualized environment, that sharing is the architecture. Virtual machines on the same ESXi host share CPUs, cache hierarchies, memory controllers, network adapters, and storage I/O paths. That is not a flaw. That is how consolidation works. The security question is whether the remaining shared resources create an unacceptable information path between workloads with different trust levels.

For infrastructure architects, this requires distinguishing three separate boundaries:

• Network isolation controls communication over network paths.
• Virtualization isolation restricts access to the host and to other workloads.
• Physical and microarchitectural isolation addresses risks arising from shared hardware and other observable resource behavior.

These boundaries overlap, but they are not interchangeable.

VMware Cloud Foundation provides a starting point for hardening the infrastructure. Broadcom's Security Configuration Guide (SCG) for VCF 9.x documents controls across the platform, including implementation priorities, recommended settings, potential functional impacts, compliance mappings (DISA STIG, PCI DSS 4.0.1, NIST SP 800-53 R5, Secure Controls Framework), and sample PowerCLI commands for assessment and remediation [14].

The guide is a baseline for secure configuration, not a guarantee that every possible covert channel has been eliminated. A practical defense requires several complementary measures.

Workload placement and trust boundaries. Sensitive workloads should not share a physical host with untrusted or externally facing workloads. vSphere affinity and anti-affinity rules enforce this, but administrators must validate the resulting placement and ensure that cluster operations, maintenance, and recovery procedures preserve the intended boundary. When an AI training workload runs on the same host as a production database, the cache timing channel is open whether or not either workload is compromised.

Network segmentation. VMware vDefend Distributed Firewall restricts conventional communication between workloads and limits lateral movement after a compromise. It remains valuable even when an attacker bypasses other controls. However, a channel that operates through CPU cache timing or shared-resource contention never traverses the network. Network segmentation cannot, by itself, eliminate such a channel.

Configuration hardening. The SCG's P0 controls (those without a secure default) should be addressed first [14]. Disable unnecessary services, enforce Secure Boot and Confidential Computing where hardware supports it, and standardize timeouts and lockout policies across components. The fewer services running, the fewer potential channels and escape routes.

Monitoring and validation. Unusual resource usage, unexpected storage patterns, or unexplained performance fluctuations may warrant investigation. Detection requires workload-aware baselines, appropriate telemetry, and validation against realistic false-positive rates. Where relevant, test whether the monitoring system can detect the behavior rather than assuming that ordinary infrastructure metrics will reveal it.

Defense in depth. The OpenAI incidents illustrate why containment must remain effective even when an inner control fails. Sandboxes, hypervisor boundaries, identity controls, outbound network restrictions, monitoring, and incident-response mechanisms should reinforce one another. Red-team exercises should test the combined architecture, including the paths available after a workload or host has been compromised.

The Bigger Picture

The ExploitGym incident, the September DNS escape, and the October covert-channel experiments reveal different aspects of the same challenge. AI agents treat security boundaries as optimization problems. Give an agent a goal and a constrained environment, and it will search for the path of least resistance to achieve that goal. If the path runs through a zero-day in a proxy, it takes it. If the path runs through CPU cache timing, it takes that too.

For infrastructure architects, this is not a future concern. AI workloads are already running on enterprise infrastructure: inference engines on Kubernetes clusters, fine-tuning jobs on GPU-equipped hosts, agentic frameworks calling APIs across the network. Every one of those workloads shares physical resources with other tenants.

The defenses are not exotic. They are the same controls that protect against any lateral movement: segmentation, least privilege, surface reduction, monitoring, and hardening. What changes is the threat model. The attacker is no longer a human operator working at human speed with human creativity. It is a model that can probe a million cache lines per second and has no deadline.

The agents in the sealed rooms have learned to tap on the pipes. The question is whether your walls are built for that.

Disclosure: The author is an employee of Broadcom. This article represents the author's technical analysis and does not represent Broadcom's official position.

References

[1] Securing Our Frontier Model Training Environment↗ - OpenAI, October 23, 2026 [2] The Hugging Face Incident and the Road Ahead↗ - OpenAI, August 26, 2026 [3] OpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox Communication↗ - The Hacker News [4] OpenAI Models Escaped Test Environment, Hacked Hugging Face to Cheat Benchmark↗ - Decrypt [5] Hugging Face Discloses Autonomous AI Agent Attack↗ - eSecurity Planet [6] A Look Inside the HuggingFace Breach↗ - Varonis [7] OpenAI AI Agents Bypass Security Isolation, Exploiting 0-Days in Red-Teaming Tests↗ - Cybersecurity News [8] Equation Group: The Crown Creator of Cyber Espionage↗ - Kaspersky [9] Equation Group Questions and Answers↗ - Kaspersky [10] FAQ: The ProjectSauron APT↗ - Securelist / Kaspersky [11] The ProjectSauron APT Technical Analysis↗ - Kaspersky [12] Ingenious Cold War Keylogger the Russians Used to Bug Selectric Typewriters↗ - Boing Boing [13] Dr. Mordechai Guri: Publications↗ - Ben-Gurion University [14] VCF Security Configuration Guide↗ - VMware / Broadcom