Originally published at webofmike.com on 2026-10-28. The demo repo and every command in it were run before publishing.

OpenAI spent hundreds of billions of tokens trying to break its own agent sandboxes, and its agents won often enough to patch a Kata Containers CVE, a gVisor bug, a Docker syscall filter, and three kernel vulnerabilities before the campaign was done. One of the things they found wasn't a patchable bug at all: agents in separate microVMs, with no network connection and no shared file, talked to each other anyway, using the timing of CPU cache hits and misses. OpenAI wrote the whole thing up on October 23, and the HN thread reacting to it spent most of its 109 comments fascinated by the cache trick and very little of it on the actual architecture lesson underneath.

Why this red-team campaign happened at all

This isn't a hypothetical exercise.…