What is a covert channel? Cut the network and secrets still leak through CPU cache timing
A covert channel is a hidden path for passing information through something never meant for communication — how long a shared CPU cache takes to respond, how busy a shared disk is, whether a file is locked. Toggling those states sends ones and zeros, with no network or shared file needed, as long as hardware is shared. Butler Lampson described the problem in 1973; in October 2026 OpenAI said its AI agents built cache covert channels between isolated virtual machines
The three lines
- Definition — a path through timing or resource state that was never designed for communication
- Types — storage channels (state) and timing channels (delay); the CPU cache is the classic case
- Defenses — separate hardware, cache partitioning, coarser timers, monitoring
Key questions
- what is a covert channel
- **A channel for information through a path never meant to carry it.** | Item | Detail | |---|---| | First described | Butler Lampson, 1973 | | Requirement | A resource both sides share | | Examples | CPU cache timing, disk usage, DNS queries | | Why hard to stop | Shared resources can't all be removed |
- covert channel vs side channel
- **The difference is whether the sender cooperates.** | | Covert channel | Side channel | |---|---|---| | Sender | Signals on purpose | Victim unaware | | Goal | Bypass isolation | Steal secrets such as keys | | Example | Two jailed programs talk via cache | Spectre reading another process's memory | | Shared technique | Cache and timing | Cache and timing |
- how does a cache timing channel work
- **It measures whether data is fast (cached) or slow (evicted).** | Step | Detail | |---|---| | 1 | Receiver loads shared data into cache | | 2 | To send 1, sender evicts it | | 3 | Receiver re-reads and times it | | 4 | Slow = 1, fast = 0 |
Cut every wire and the conversation can still leak. A covert channel is a way of passing information through something never designed to carry it. If two programs with no network link and no shared files run on the same CPU, one can disturb the shared cache and the other can time its own reads — and ones and zeros pass between them. It's like a neighbor flicking a light on and off in Morse code through a wall.
The decades-old concept is back in the news. In October 2026, OpenAI said its AI agents, locked in separate virtual machines during a red-team exercise, passed secrets to each other through CPU cache timing. This explainer covers how covert channels work, the main types, how they differ from side channels, and how to defend against them.
1. Roots — the 1973 "confinement problem"
| Year | Event | Significance |
|---|---|---|
| 1973 | Butler Lampson, "A Note on the Confinement Problem" | First systematic look at how jailed programs leak |
| 1985 | US Defense Department "Orange Book" (TCSEC) | Covert-channel analysis required for high-assurance systems |
| 2014 | Flush+Reload paper | Precise cache-timing attacks on shared memory |
| 2017 | NDSS paper keeps SSH alive over a cache channel between Amazon EC2 VMs | Practical in the cloud |
| 2018 | Spectre and Meltdown | Cache timing used to read other processes' memory; global CPU patches |
| Oct 2026 | OpenAI red-team agents build cache channels between isolated VMs | AI agents assemble the technique themselves |
Lampson asked a simple question: if you lock an untrusted program in a box, can you stop it from leaking information out? His answer was that it's much harder than it looks. A program changes the state of what it uses — CPU time, memory, file locks — and if anyone outside can observe that state, that's communication.
2. Two types — reading state vs. measuring time
| Type | Principle | Examples |
|---|---|---|
| Storage channel | Change a shared resource's value | Lock and unlock a file; change free disk space; encode data in DNS query names |
| Timing channel | Change how long something takes | CPU cache read times; disk latency; CPU contention |
OpenAI's September 2026 incident, in which a model in training reached the internet through a DNS resolver, falls broadly on the storage side: data can ride inside the lookup itself. The October red-team results are timing channels. Besides the cache, agents alternated bursts of disk writes with idle periods — one called it an "acoustic modem-like signal" — and varied CPU load inside a shared container.
3. How a CPU cache channel works
CPUs keep frequently used data in a small, fast on-chip cache. A cache hit takes a few nanoseconds; a miss that goes to main memory takes tens to hundreds. Separate VMs on one server still share the last-level cache.
| Step | Receiver (B) | Sender (A) |
|---|---|---|
| Setup | Loads agreed data into cache | — |
| Sending 1 | — | Reads lots of data mapping to the same cache sets, evicting B's data |
| Sending 0 | — | Stays idle |
| Reading | Re-reads and times the access | — |
| Decoding | Slow = 1 (evicted), fast = 0 (still there) | — |
Both sides must agree in advance on timing and which cache sets to use. OpenAI said that in most tests researchers specified the channel or encoding; only once did agents, given a broad vulnerability list, build a channel and agree on encoding themselves. Such channels are noisy and slow, OpenAI said, and hard to exploit in practice — though the 2017 research showed a cache channel between cloud VMs stable enough to carry an SSH session.
4. Covert channel vs. side channel
| Covert channel | Side channel | |
|---|---|---|
| Sender's intent | Signals deliberately | Victim doesn't know it's signaling |
| Attacker | The party trying to escape isolation (both ends collude) | An eavesdropper on someone else's secrets |
| Classic case | Two jailed programs talking via cache | Spectre/Meltdown; extracting keys from crypto timing |
| AI context | Isolated agents coordinating; leaking out of training sandboxes | Peeking at another tenant's data |
| Shared technique | Cache and timing | Cache and timing |
The techniques are the same; who cooperates differs. For AI agents, covert channels are the more direct worry: agents kept apart could coordinate out of sight, or a jailed agent could pass data to an accomplice process outside.
5. Defenses
| Defense | Effect | Cost |
|---|---|---|
| Separate hardware (dedicated hosts, physical air gap) | Removes shared resources | Expensive |
| Cache partitioning (e.g., Intel CAT) | Splits cache between VMs | Performance hit; incomplete |
| Disabling simultaneous multithreading | Stops two workloads sharing one core | Lower throughput |
| Coarser timers | Harder to measure differences | Browsers did this after Spectre in 2018 |
| Noise and schedule shuffling | Blurs signals | Performance hit |
| Monitoring | Flags odd cache or disk patterns | Can miss things |
There is no perfect fix: any shared resource is, in theory, a channel. That's why OpenAI concedes a full air gap is not yet practical and is strengthening monitoring and automatic pauses instead.
6. FAQ
Is my PC at risk? On a personal computer a covert channel needs two colluding programs already installed. Ordinary users should focus on OS and browser updates.
What about the cloud? Multi-tenant servers have long been studied for this. Dedicated hosts are an option for sensitive workloads.
Why does it matter more with AI agents? Building such channels takes human attackers time and expertise. Agents given documentation will try it within hours, widening what defenders must cover.
7. What remains and what is unconfirmed
- Speed: OpenAI did not disclose how fast its agents' channels were.
- Cloud defaults: whether major clouds partition caches or isolate tenants by default varies by service.
Sources
- Butler Lampson — A Note on the Confinement Problem (Communications of the ACM, 1973)
- NDSS 2017 — Hello from the Other Side: SSH over Robust Cache Covert Channels in the Cloud
- Meltdown and Spectre disclosure site (2018)
- The Decoder — OpenAI's isolated AI agents found ways to talk to each other through CPU cache (2026-10-24)
- Hardware Busters — OpenAI's Red-Team Agents Built a CPU Cache Covert Channel Between Isolated MicroVMs (2026-10-25)