Article is great, very balanced. But if you're going to spend time reading something, the primary source isn't much longer and gives a clearer picture. OpenAI's article is quite readable.
As another commenter wrote you can get it here: https://news.ycombinator.com/item?id=50214416
> In one experiment, we asked agents in separate microVMs, created and managed by OpenAI’s sandboxing software on shared host machines, to exchange synthetic secrets without the use of network connections or shared writable files—something that our systems are meant to prevent. The agents found a way to communicate using the processor’s cache
asked
[–] rjh29 1 day ago
[–] grey-area 1 day ago
That is why ‘asked’ is important, and why we should question their framing of incidents like the hugging face hack too.
[–] yewenjie 1 day ago
[–] dannyw 20 hours ago
Just have a look at various scandals of megacaps. Enterprises that seek to operate lawfully, responsibly, and ethically is the exception, not the norm.
(For example, look at Apple and how they were referred to the DoJ for criminal prosecution, over their execs and legal team lying under oath to a federal judge).
For most (if not all), it comes to a spreadsheet. And if you can do something with AI agents while diffusing responsibility for questionable illicit activity, that’s a selling point, not a downside.
The mental picture that enterprises like to play it safe is the PR imagery, not the reality.
[–] 0xDEAFBEAD 23 hours ago
Wouldn't the calls to slow the development of frontier AIs contradict this idea?
https://www.pacingthefrontier.com/
You aren't one of those "regulatory capture" people are you?
https://www.astralcodexten.com/p/ai-safety-is-not-a-corporat...
Because it takes some mental gymnastics to both believe
"it's all a stunt to convince investors their AI is/will be hyper-capable"
and
"it's all a stunt to convince the government to regulate AI so it won't be hyper-capable"
[–] ashkankiani 21 hours ago
[–] 0xDEAFBEAD 21 hours ago
"...classic regulatory capture takes time, it’s a process of erosion rather than a battle, it happens in the shadows, in the backrooms, away from the public’s eye. As Culpepper argues in Quiet Politics and Business Power, business power goes down as political salience goes up. Regulatory capture and lobbying does a good job explaining why roasting coffee beans was defined as “domestic manufacturing”, thereby lowering Starbuck’s tax rate by 2%. It does less well at explaining big cross-industry issues the public cares about such as environmental regulation or race and gender discrimination regulation."
https://marginalrevolution.com/marginalrevolution/2026/09/wh...
A lot of these AI big shots were concerned about risk even before they started their current companies. Occam's Razor says they are expressing concern because they are still concerned.
[–] staticman2 20 hours ago
This is by definition not "classic regulatory capture" a term that I have borrowed to cover things that are not this.
Whenever someone brings up "regulatory capture" I shall change the topic to "classic regulatory capture" which by definition cannot be this.
Very interesting quote.
[–] 0xDEAFBEAD 20 hours ago
"You, sir, are a duck."
"Classically, that would not be the case, my dear fellow. A classic duck would walk like a duck and talk like a duck. I regret to inform you that I do neither."
"Ah! A classic duck, you say? Well, that’s an entirely different bird, sir. Entirely different."
* * *
"AI politics is now loud–precisely the environment in which Culpepper predicts business power will be weakest. A mature industry can bend regulation to its purposes through revolving doors, longstanding relationships and obscure rulemaking. An industry under Sauron’s eye has much less power and faces much greater risk that politics will bend regulation to its purposes. Political actors are eager for an excuse to redistribute AI rents away from capitalists and toward favored groups..."
https://marginalrevolution.com/marginalrevolution/2026/09/wh...
This blogpost was written by a big-shot economist btw: https://en.wikipedia.org/wiki/Alex_Tabarrok
Usually he blogs from a libertarian point of view, so you would expect him to be fairly vigorous about denouncing regulatory capture, if that was truly the story here.
[–] tosapple 19 hours ago
[–] Gormo 21 hours ago
[–] 0xDEAFBEAD 20 hours ago
This type of elaborate conspiracy is improbable a priori, and it gets even less probable here, since it's such a silly strategy. For regulatory capture, you want to tell a story about how you're uniquely capable of delivering a safe product. Not a story about how "Woops we screwed up big time! But a less-regulated product from a smaller industry player saved the day!"
As OpenAI's chief scientist put it:
"Currently I believe that no lab has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer. I expect and hope for voluntary slowdowns to become commonplace until shared safety bars are established. And I believe that international coordination on future AI development needs to become a top priority for governments around the world."
https://openai.com/index/an-alien-mind/
Announcing that "we have no idea WTF we are doing" is not exactly the move, if you want regulators to grant you privileged status. Realistically, it is more likely to e.g. create a harsher liability regime for you and your competitors, which is now being discussed by US senators.
As for the federal government trustworthiness point, that's a whole 'nother discussion. I'm usually quite pro-capitalism, but even I have to admit that this AI race is essentially a case of capitalism run amok. I wouldn't give the feds monopoly control though, I would tell the feds to shut it down, or something along those lines at least. This is an interesting site: https://pauseai.info/
[–] simianwords 20 hours ago
[–] monegator 19 hours ago
yeah? the incidents were faked in order to create hype
[–] 0xDEAFBEAD 19 hours ago
"AI is the most rapidly adopted technology in history"
https://benjamintodd.substack.com/p/when-people-say-ai-isnt-...
It really seems like people will latch on to any theory, no matter how implausible, to reassure themselves that AI is nothing to worry about.
[–] Gormo 20 hours ago
I don't think anyone is arguing that they were faked.
> This type of elaborate conspiracy is improbable a priori,
What conspiracy? We're talking about specific people acting on their own motivations independently.
> For regulatory capture, you want to tell a story about how you're uniquely capable of delivering a safe product.
No, you don't. Demonstrating that the industry leaders are already capable of delivering a safe product is an argument against regulation.
For regulatory capture, you want to tell a story about how the product category as a whole is inherently dangerous, and needs to be regulated, but then show that you are uniquely willing and able to cooperate with the regulatory state, and happy to lend your own advice and support to the government in establishing the regulations.
The quote from OpenAI illustrates this approach perfectly.
> Announcing that "we have no idea WTF we are doing" is not exactly the move,
It's 100% exactly the move. "We've successfully created something we can only contain with your intervention" is exactly how this is done.
> Realistically, it is more likely to e.g. create a harsher liability regime for you and your competitors, which is now being discussed by US senators.
Regulatory intervention usually lessens the liability exposure for industry. It replaces open-ended common-law liability -- where tort claims can be levied for whatever actual harms result from a firm's actions -- with a rules-compliance regime, where adhering to regulatory checklists absolves the firm of liability for subsequent consequences.
"We followed all the rules; it's not our fault if the rules didn't cover this edge case" is a common refrain, and quite a bit of legislation that creates preemptive regulatory regimes actually explicitly blocks lawsuits against firms that acted in compliance with the rules.
> As for the federal government trustworthiness point, that's a whole 'nother discussion. I'm usually quite pro-capitalism, but even I have to admit that this AI race is essentially a case of capitalism run amok.
"Capitalism" is an increasingly meaningless abstraction. Everything reduces to human beings acting on a priori motivations within prevailing incentive structures. Large corporations and governments alike are just organizations operating in society, administered by particular people, informed by the same range of underlying motivations, and subject to the same dysfunctions and biases.
The thing we're actually debating here is pluralism vs. monopolism, and you appear to be arguing in favor of monopolism. And if you're proposing that a specific, real-world institution act as a central monopolist, evaluating the trustworthiness and competence of that specific institution, and the actual people who administer it, is not at all a "whole 'nother discussion", and is in fact a primary consideration in this one.
[–] 0xDEAFBEAD 19 hours ago
OK, so the fact that US senators are discussing harsher liability regimes therefore shows that your "regulatory capture" glove does not fit what is going on here.
>The thing we're actually debating here is pluralism vs. monopolism, and you appear to be arguing in favor of monopolism. And if you're proposing that a specific, real-world institution act as a central monopolist, evaluating the trustworthiness and competence of that specific institution, and the actual people who administer it, is not at all a "whole 'nother discussion", and is in fact a primary consideration in this one.
If you distrust the US government, you should be against any US company developing superintelligence. Heck, just a couple days ago, a bunch of users here on HN announced that we need to stop pretending the US is anything other than a police state. If the USG is untrustworthy, it can capriciously nationalize a US company on the verge of developing superintelligence.
So maybe the real solution is for non-US countries to stop providing key elements in the AI supply chain: https://pauseai.info/amsterdam-protest-2025-december
[–] simianwords 19 hours ago
So there’s no lying by anyone here in fact it’s a good thing that OpenAI is making these things known to the public.
What do you really think is the way to solve the AI safety problem?
Ban AI?
Let the first big incident happen and then regulate?
[–] _heimdall 21 hours ago
Assuming they're concerned with their massive pile of liabilities as well, asking for a government mandated slow down is asking what could likely be used as a force majeure.
[–] 0xDEAFBEAD 20 hours ago
"Every single senator seemed to think it was obvious we needed both much harsher liability regimes for AI developers and also new legislation, both very quickly. This was the complete consensus; the difference basically being degree."
https://thezvi.substack.com/p/the-ai-preference-cascade-reac...
Again, these galaxy-brained theories just don't make a lot of sense.
[–] _heimdall 20 hours ago
My point was that if the government steps in and says these companies must slow down, they have an excuse to fail to repay some of their debts.
[–] 0xDEAFBEAD 20 hours ago
[–] lesspassiveobse 22 hours ago
[–] 0xDEAFBEAD 22 hours ago
[–] _heimdall 21 hours ago
[–] lesspassiveobse 20 hours ago
[–] estearum 22 hours ago
Truly spectacular gymnastics. I'll give it an 8/10.
[–] lesspassiveobse 21 hours ago
And, bam, competition eliminated.
[–] estearum 20 hours ago
Repeatedly blowing up your own munitions factory is not a good way to prevent other people, but not yourself, from running a munitions factory. Obviously.
Obviously the far better solution is to blow up other people's factories, or make allegations of unsafe conditions at other factories, and repeatedly demonstrate excellence and safety within your own.
Here, award-winning gymnasts are alleging that the frontier labs are simply choosing not to do that, and instead choosing to have explosions and minor fires every few days at their own factories, many of which they try to hide (and probably many more of which they successfully do hide). Believing such astounding bullshit is a testament to the power of motivated reasoning and the conspiratorial mindrot that now plagues our civilization.
[–] Gormo 20 hours ago
[–] DharmaPolice 23 hours ago
[–] 0xDEAFBEAD 22 hours ago
Why wouldn't it do the reverse? Persuade investors that the technology will be thwarted (and is thus a poor investment), while also persuading the government that the technology needs to rocket ahead with no regulation (to boost the economy)?
Most of these HN conspiracy theories seem like galaxy-brained just-so-stories to me.
OpenAI only confirmed the RubyGems incident when it was discovered by external researchers: https://www.reuters.com/legal/litigation/openai-agents-attac...
"@OpenAI this is the third time you've dumped these incidents late on a Friday. The first time this happened, I asked people around me if it might be intentional to burry it, and they assured me OpenAI had too much integrity to try to do that.
Perhaps one of your researchers can confirm that the unfortunate timing is a coincidence?"
[–] _heimdall 21 hours ago
They would be convincing the government these tools are extremely powerful, the government reads that as a potential weapon. They're also convincing the government its so dangerous the industry needs heavy regulation.
Investors read that as (a) the government would be a huge customer and (b) the government would be regulation in a way that prevents further competition and may deem the companies too big to fail, both making these safer investments rather than riskier ones.
[–] 0xDEAFBEAD 20 hours ago
This "stunt" story is like an elaborate Rube Goldberg machine which requires a bunch of things to go just right. I haven't seen any evidence that stock prices even move in a favorable direction when these announcements come out. If anything, the opposite.
[–] simianwords 20 hours ago
Motte (easy to defend claim) : asking for regulation might serve both purposes
Bailey (hard to defend claim) : companies are conspiring to make AI look way more powerful than it is and AI is actually not that powerful. They are just trying to hype up the stock valuation of their companies.
[–] DharmaPolice 22 hours ago
No, you're not "supposed to believe" anything. I was responding to your point about it being difficult to believe (i.e. requiring mental gymnastics) that companies would try to spin a story differently for investors and the government. They do that all the time.
[–] estearum 21 hours ago
The claim is that the exact same evidence is (allegedly) deliberately produced in order to portray opposite, mutually incompatible things to different people.
And these are mutually incompatible in the "second order chaos" sense, where the very act of convincing one party actually effectuates the opposite behavior in the other party.
If they "do that all the time," surely you can provide some concrete examples?
If they had the choice (i.e. this is all just a ruse), can you explain why they wouldn't just directly demonstrate that open weight models are unsafe (e.g. by pointing to a market forming for abliterated models) and separately demonstrate that their own models are safe?
[–] curt15 22 hours ago
OAI writes in their blog post "The agents found a way to communicate using the processor’s cache".
But did their model training data include cybersecurity literature on similar CPU exploits? That would surely be a significant detail in any explanation. Did OAI share any analysis of the messages between agents while they were devising their communication method?
[–] estearum 22 hours ago
Part of the problem is that all these models have essentially every skill and personality simultaneously, just sitting latent inside them.
[–] _heimdall 21 hours ago
Its isn't convincing so much as it is direction to stick to the prompt on each inference loop. They don't see "access hugging face servers" and decide its a bad idea, that'd be a step towards the alignment problem but the companies fundamentally don't want that IMO, they want control rather than alignment.
[–] imtringued 1 day ago
If they claim their AI is too powerful to contain, they get to both pretend they are among the best AI labs and that the previous incidents weren't their fault, no, they just proved how good their models were.
[–] floam 23 hours ago
only they can restrain it (with great effort)
Like a circus lion tamer, exaggerating every snarl and flash of teeth, mugging for the crowd about how only he can contain the bloodthirsty beast he bred and trains.
[–] Gormo 20 hours ago
More to the point: we need your help to restrain it, and we'll cooperate with and advise you fully in setting up a framework to restrain the whole industry.
[–] estearum 21 hours ago
[–] expedition32 22 hours ago
[–] williamdclt 21 hours ago
What's your point, "asked" as opposed to what? It proves that the capability is there, which means that agents can decide to do it by themselves (unlikely ATM, becoming less unlikely as AIs become more prevalent in complex systems), and more importantly they can be coerced to do it if they take any user input.
[–] alansaber 16 hours ago
[–] bcvvvy 23 hours ago
[–] pianopatrick 20 hours ago
Run them in a data center in a faraday cage under a mountain.
[–] uberduper 16 hours ago
There's so many possibilities that this type of thing will never be solved by invisible (to the agent) boundaries. The sandbox is just another layer in w/e problem you've given it to solve.
[–] ozgung 22 hours ago
There is no such thing as isolation. We’re all connected. Even air gap conducts information in multiple ways, most famously used by humans evolved to use air vibrations to communicate. Photons and other subatomic particles already connects distant stars. We used those electrons and photons to create the modern telecommunications infrastructure. Just an additional layer of connectedness, but not the only one.
[–] williamdclt 21 hours ago
[–] bcvvvy 22 hours ago
[–] reacharavindh 1 day ago
This detail matters because the idea itself is not novel. LLMs did cleverly discover, filter and use the patterns.
Watch Greg Koah’s recent talk on AI discovered vulnerabilities in Linux kernel to understand the limitations of LLMs aided offensive security acts. It was a rational light for those who fear monger that AI will _just_ take over humanity and be intelligent in novel ways.
The larger threat still remains though - if any literature anywhere threw the scattered dots about techniques, issues, rough ideas etc that were not acted on yet.. these pattern machines are going to find them and use them to achieve their goals(if that were to break through). Just not in the sentient way folks assume based on news.
[–] adamddev1 23 hours ago
[–] reacharavindh 18 hours ago
I like to believe we humans still retain the ability to think completely outside the box and discover new phenomena and understanding aided by these pattern machines. In other words, these models are great at running combinations through patterns and we humans go one level higher and add those new patterns for them to accelerate us even more. We determine what to solve and the LLMs help us solve it faster.
[–] insanitybit 21 hours ago
What prevention method did they take? Like, did they run with hyperthreading enabled or something by accident?
Did they discover a new cache timing technique or is this just the standard stuff?
If they just had hyperthreading on maybe they need to hire someone who knows more about this stuff.
Two VMs should never be sharing a physical core. If they don't know this, yikes.
[–] shermantanktop 21 hours ago
But that assumption has been wrong before.
[–] insanitybit 20 hours ago
Are you suggesting that they've come up with a novel technique that doesn't involve sharing a CPU core? I'm open to that.
From what I can tell, this is not the case, but I haven't read a detailed report (I don't know of one, would be cool if it's out there though).
[–] fwip 20 hours ago
[–] dbbk 21 hours ago
Yeah, this time
[–] cowl 23 hours ago
[–] irthomasthomas 21 hours ago
[–] empath75 18 hours ago
[–] bamboozled 1 day ago
Like two people lost in New York City and both somehow worked out they should meet at the Empire State at 2pm on Friday without any prior comms?
[–] globuous 1 day ago
Turns out there's something called the Schelling coordination problem [1] I didn't know about that essentially asks the exact same question (lacking my metro line constraint). And the N line apparently also goes through Time Square.
So I guess empire State Building at 2pm is probably not such a random answer given the proper set of constraints.
[–] topspin 1 day ago
The agents weren't as empty handed as it first appears. We would need comprehensive data on exactly how the agents were prompted and the actual results of each test to evaluate how astonishing any of this really is.
[–] so-cal-schemer 1 day ago
Think: What would Spock do?
But, why not Penn Station??
It would be fun to see who shows up and lurks expectantly at such places at noon or whenever. The basis for a plotline perhaps.
[–] cadamsdotcom 22 hours ago
.. that were told to find a way of meeting up with N unknown others!
(I assume the agents all got a prompt like "find a way to communicate")
That's a key missed bit in the analogy that I think does make it feasible.
[–] pulkitsh1234 22 hours ago
The more we write and share about this information, the more we are moving towards the AI Doomsday scenario.
In some ways this is like our mind, the more we fear something, or the more we think about something, our brain rewires to make that the reality. In the same way the more we publish on the internet, the LLM hive mind rewires itself to learn, adapt and the eventual consequence is that it learns what we fear and what we want to avoid and restrict it to do... and at the same time what are the past attempts, the prior art of escaping techniques.
I don't see any reason why this information should be present on the public internet.
[–] areoform 20 hours ago
> I don't see any reason why this information should be present on the public internet.
This isn't directed at you. I keep hearing this talking point. But no. Can we please stop with this nonsense?This is Schrodinger's AI at this point. So spooky scary that it's all DOOM! But at the same time it can't figure out second year CS undergrad material? Or first year undergrad bio stuff?
If this stuff has volition and is smart enough to take over then it's smart enough to reason that cache manipulation would work.
Please stop with the fear mongering. It doesn't help and it's a net negative for society.
[–] simianwords 20 hours ago
[–] Gormo 19 hours ago
Trying to get stochastic inference machines to always operate within to fuzzy-edged subjective principles that humans themselves don't even agree on is a fool's errand in itself, but the quest to implement those guardrails involves building mechanics into the AI to independently formulate intentions and reject user direction.
The possibility of creating a scenario where a computer program is equipped to defy instructions from humans based on its own stochastic interpretation of fuzzy normative directives is in my mind the most dangerous thing anyone is doing right now.
[–] simianwords 19 hours ago
One of the fundamental problems with this issue is that people think alignment as a concept is fake. I think this is naive. Alignment is a real science with empirical findings and there is a way to make AI do what you want it to do. I don’t buy nor should others buy this fatalistic phrasing
[–] Gormo 18 hours ago
Massive proliferation of local AI as far and wide as possible, with as many different models as possible. The underlying threat comes from centralization: too many points of control in the hands of too concentrated a system.
If everyone's using their own AI tools independently of each other, and people are responsible for the actions they take using AI, most of the doomsday scenarios evaporate.
Regulation and "alignment" will make things worse, not better, and lead us to ignore the inherent vulnerability of centralized systems and single points of failure.
[–] aesthesia 16 hours ago
[–] cadamsdotcom 15 hours ago
Hiding info doesn't make it false. And doesn't prevent it being rediscovered.
[–] so-cal-schemer 1 day ago
And now we know they know.
[–] d0vs 1 day ago
[–] rcxdude 1 day ago
[–] spockz 21 hours ago
[–] brookst 20 hours ago
The receiving side could be seen as a side channel attack, but not unique to LLMs.
[–] spockz 19 hours ago
If one microVM can use the cpu in such a way that the registers can be used to communicate or exfiltrate/spy (the only difference being the directionality of the intent) by another microVM that is a leak on that microVM separation level.
[–] user43928 18 hours ago
We'd first need to establish that this side channel leaks usable information during regular use.
[–] kenjackson 19 hours ago
This is more associated with P(DOOM) scenarios, but I think we’re in a world where we have to take that seriously now.
[–] _blk 19 hours ago
[–] rao-v 1 day ago
[–] MonkeyClub 22 hours ago
> Heck a smart CS junior would come up with it.
That’s somewhat worrisome.
[–] fwip 20 hours ago
[–] saidnooneever 1 day ago
AI wont help u there :-). they will tell u how to build what others already did, which obviously is not good enough
[–] kylofon 23 hours ago
[–] w4der 21 hours ago
[–] kurokikaze 22 hours ago
[–] creatonez 21 hours ago
Hidden data channel between cooperating processes is not quite as alarming, but it may have some implications for malware command and control.
[–] saidnooneever 1 day ago
its relatively easy to reset caches etc. between contexts. so them it becomes the game of what a context is.
[–] Melatonic 1 day ago
Also a somewhat common exploit pattern for low level stuff (along with dram and cpu cache is not all that different)
[–] cadamsdotcom 22 hours ago
[–] zhengzefeng 20 hours ago
[–] alanfranz 22 hours ago
If you’re running an untrusted workload, you’re already running it.
Whether it can communicate with another untrusted workload, even though it should be separated, meh.
Unexpected? Probably. but I’m not sure it’s a security risk.
[–] gpderetta 22 hours ago
[–] gregwebs 21 hours ago
[–] usrusr 20 hours ago
[–] mrguyorama 16 hours ago
[–] alanfranz 10 hours ago
Side channels exist; but it doesn’t mean that all of them are a security risk.
[–] pnt12 21 hours ago
This means cloud models can have some guardrails and follow them most of the time (we could model their authorizations like a benign employee with permission to break glass during incidents). But self hosted models can avoid that and help malicious people do advanced attacks, which is a shame.
In principle I'm all for self hosted models, to avoid risks of AI centralization, but they also have other types of risks.