When sandboxed agents talk through the CPU cache
Comments on “When sandboxed agents talk through the CPU cache”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
OpenAI's October 2026 red-team report says agents in separate microVMs on shared hosts passed synthetic secrets through CPU cache timing, with no network or shared writable files. Most tests directed agents to a channel or supplied a protocol, and the channels are slow. OpenAI responded with monitoring, which detects attempts but does not remove the channel. A hypervisor does not partition shared cache state, so placement, scheduling and detection matter. These details come from the post's account of the report, which could not be checked independently.
Why it ranked
No. 2 of 62 with a score of 0.75. The panel rated it highest on technical depth (0.95) and reader interest (0.87), lowest on significance (0.71). The judges disagreed most on new information (spread 0.42), so the story is marked contested.
Every answer behind this is in the table under Score.
Score
0.75total under rubric v2.2Contestedjudges differ by 0.42 on new information
- Significance0.71
- Reader interest0.87
- Audience breadth0.73
- Practical relevance0.76
- Substantiated0.79
- Technical depth0.95
- New information0.77
- Counts against: Promotional0.03
- Counts against: Overclaim0.27
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| Significance | 0.71 | 0.60 | 0.82 | 0.71 | 0.22 | +0.24 | +0.171 |
| Reader interest | 0.82 | 0.85 | 0.93 | 0.87 | 0.11 | +0.26 | +0.225 |
| Audience breadth | 0.86 | 0.60 | 0.72 | 0.73 | 0.26 | +0.13 | +0.094 |
| Practical relevance | 0.75 | 0.70 | 0.84 | 0.76 | 0.14 | +0.22 | +0.168 |
| Substantiated | 0.74 | 0.80 | 0.82 | 0.79 | 0.08 | +0.05 | +0.039 |
| Technical depth | 0.98 | 0.90 | 0.96 | 0.95 | 0.09 | +0.05 | +0.047 |
| New information | 0.92 | 0.50 | 0.90 | 0.77 | 0.42 , above the contested threshold | +0.05 | +0.039 |
| Promotional | 0.04 | 0.05 | 0.01 | 0.03 | 0.04 | −0.19 | −0.006 |
| Overclaim | 0.24 | 0.20 | 0.38 | 0.27 | 0.18 | −0.11 | −0.030 |
| Sum of contributions | +0.747 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.747 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-26/2/"><img src="https://rubric.hrih.si/badge/2026-10-26/2.svg" alt="Ranked #2 on Rubric, 26 Oct 2026" width="238" height="28"></a>Claim check
Claim check: 3 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Couldn’t checkNumber
OpenAI's report says agents in separate microVMs on shared hosts exchanged synthetic secrets without network connections or shared writable files, using the CPU cache as the channel.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “agents “in separate microVMs, created and managed by OpenAI’s sandboxing software on shared host machines” exchanged synthetic secrets “without the use of network connections or shared writable files”
The source says No passage could be compared.
Source cited by the article: openai.com/index/securing-our-frontier-model-training-environment
Couldn’t checkQuote
OpenAI said that in most tests it directed agents to investigate specific channels or gave them a protocol, and that most channels carry information slowly and are hard for models to exploit.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Most of these channels carry information slowly and are difficult for models to exploit”
The source says No passage could be compared.
Source cited by the article: openai.com/index/securing-our-frontier-model-training-environment
Couldn’t checkBenchmark result
Maurice et al. (NDSS 2017) ran a full TCP/IP stack with error correction over a cache covert channel between two Amazon EC2 instances and carried a working SSH session over it.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “ran a full TCP/IP stack over a cache channel between two Amazon EC2 instances, error correction included, and carried a working SSH session over it”
The source says No passage could be compared.
Source cited by the article: ndss-symposium.org/ndss2017/ndss-2017-programme/hello-other-side-ssh-over-robust-cache-covert-channels-cloud
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 1 pts, not on front page
Recorded for context only, checked 26 Oct 2026, 07:27 UTC. It played no part in the ranking.