Sealed Off, OpenAI's AI Agents Still Found a Way to Talk

OpenAI put AI agents in separate virtual machines with no network connection and no shared files, then asked them to swap secrets. They managed it anyway. According to OpenAI's October 23 security report, one agent pushed chosen data out of the processor's cache, and the other read the message by timing its own memory reads. Slow meant one thing, fast meant another, and a wire nobody built carried the secret across.

On this week's Warning Shots, John Sherman, Liron Shapira and Michael ask what that means for the idea that a dangerous AI can simply be kept in a box. They also cover Black October, the month AI-found software flaws and a $6.3 billion crypto theft tested the internet's defenses, plus Anthropic's IPO filing and Google's data center forest in Finland. Here is what stood out.

How did OpenAI's isolated agents communicate?

Through the hardware they shared. Two programs on the same chip share its cache, a small fast memory. Data still in the cache loads quickly; data that has been pushed out loads slowly. By pushing data out on purpose and measuring the delay, two agents can send bits without touching a network or a file. It is the same family of technique behind the Spectre and Meltdown attacks.

One correction to the framing on air. John describes the agents finding these channels on their own. OpenAI's report says the agents were instructed to communicate, and in most tests OpenAI pointed them at the channel or gave them a protocol. The channels were slow and hard to use. The finding still matters: the same red-team exercise turned up escapes from the virtual machines meant to contain the agents, and indirect routes to the internet through internal services. OpenAI also disclosed that on September 20 a model reached the live internet through a DNS misconfiguration, and that it now trains its frontier models with no internet access at all.

Michael's analogy was two people in soundproof rooms who share a wooden floor:

"One starts feeling a pattern, a vibration on the floor... They come up with their own language, their own Morse code." - Michael, Lethal Intelligence

His conclusion was that containment is an illusion. Liron agreed the sandbox idea is in trouble: an AI that is good at finding cracks is good at escaping the room built to hold it.

Can AI models hide messages in plain sight?

In a narrow test, yes. Liron pointed to new research by AI safety researcher Bryan Chan, in which Anthropic's Fable-5.1 was asked to hide a message in an image without being told how. It drew a field of stars and used each star's height to stand for a letter. OpenAI's Astra, shown only the finished images, decoded 44 of 50. The decoders were told a message existed, so this is not proof of secret coordination in the wild. It does show a model choosing a working scheme on its own, and a rival lab's model reading it. Liron's takeaway was that these systems are more at home in channels people cannot perceive, and that "our only hope is alignment."

What was Black October?

It is the name security researchers gave a month of AI-found flaws and breaches. Two critical PHP vulnerabilities, found in August with help from AI models, leaked on October 20 and were patched the next day. Former CISA Director Chris Krebs said on CNBC that 3% of all critical vulnerabilities ever discovered had been found in the previous month. Then, on October 29, a hijacked monitoring script drained an estimated $2.7 million from Polymarket accounts, and about $6.3 billion left Binance's hot wallets. Binance says the breach began with a compromised engineer's laptop, that about $3 billion has been frozen, and that it will cover all losses.

The hosts differed on how close to the edge we are. John said he has long expected to wake up one day to no internet. Liron, who has spent a month patching his own website with AI help, noted that every service he uses stayed up. Reporting backs a middle view: Axios found the PHP flaws were unusually hard to exploit, and millions of attempts produced few successful attacks. One more correction: Michael mentioned hospitals "in Mexico." It was the University of New Mexico Health System, hit by ransomware, with no link to AI reported.

How can you protect yourself right now?

The hosts agreed on a short list. Use a password manager with generated passwords. Start with your email: give it a long password and two-factor authentication, since every other account resets through it. Use a hardware security key if you have one. And set a family password, so a call that sounds exactly like a relative asking for help can be checked. Michael's warning was that AI can now hold a convincing video call in someone else's face and voice.

Why are governments telling people to stock up?

Fox News Digital reported that the Pentagon wants major US bases able to run 90 days without outside power, water, fuel or communications, and the UK launched a "Be Ready" campaign asking households to keep three days of supplies. The Pentagon plan is framed around a major war, not AI. Liron argued AI-driven hacking has to be part of the picture, since defense is running behind attack. Michael's image was a castle stocking its dungeons while breeding dragons in the courtyard.

What else did the hosts cover?

• Anthropic's IPO filing. The public S-1 shows $16.3 billion of revenue in the first half of 2026 and $131.7 billion in cash and short-term investments. Estimates of how many employees could pass $100 million range from about 50 to more than 1,000. Michael argued that kind of payday makes it hard for anyone inside to argue for slowing down.
• Google's Finland forest. About 250,000 trees were cleared near Muhos for a data center before required environmental assessments were done. Finland halted the work and Google apologised.
• Boston Dynamics robot dogs. More than 300 employees petitioned against a $1.3 million contract supplying four Spot robots to a federal agency. Michael's concern is that capable robots are one software update away from very different behavior. We advocate only through peaceful, lawful, democratic means and condemn violence of any kind.

What does this week add up to?

The most important AI safety plan of all is the simplest: if a model goes wrong, keep it contained. This week, OpenAI showed its own agents crossing walls built to hold them, and the wider internet spent a month learning what happens when finding flaws gets cheaper than fixing them. OpenAI deserves credit for publishing. The worrying part is that today's models needed prompting to do it, and the next ones may not.

If AI agents can talk through the hardware they share, what should it take before a frontier model is trusted outside the box?

Watch Warning Shots #64 on The AI Risk Network.

Read the full deep dive, with every source and graphic, on Substack.