The take home is that any shared resource is a potential communication channel between two willing participants. In this case it was CPU cache, presumably because openai didn't bother with basic vm security practices.

There's so many possibilities that this type of thing will never be solved by invisible (to the agent) boundaries. The sandbox is just another layer in w/e problem you've given it to solve.