Vercel CEO Reproducing a CPU side-channel communication demonstration across isolated virtual machines

AT A GLANCE

Isolated virtual machines may still use changes in CPU resources to transmit information, but this was not an instance of AI autonomous communication.

Article

OpenAI finds AI they can CPU secretly communicate; Vercel CEO reproduces it: separated CPU cores can still chat

OpenAI disclosed last week that AI Agents, originally unable to communicate through networks or shared files, could nevertheless use differences in CPU cache read speeds to secretly exchange information.

Vercel founder and CEO CEO Guillermo Rauch subsequently created a demonstration program called cpu-chat, reproducing a similar communication method on his own computer.

Using Firecracker, he ran at least mutually isolated virtual machines without network access on the same computer.

In theory, these virtual machines could not exchange information directly, but they still shared the same computer's hardware resources. Rauch tested methods: one party deliberately occupied CPU, altered cache states, or consumed memory bandwidth, while the other observed changes in its own execution speed and interpreted the differences in speed as messages.

Even after disabling hyperthreading, disabling memory page merging, and assigning different virtual machines to different CPU cores, this communication could still succeed. Rauch said the experiment was applicable not only to x86 processors, but could also run on Apple's M5 chips.

However, this experiment was an intentionally designed communication test, not AI independently finding a way to secretly contact each other. Rauch also noted that real cloud environments have more sources of interference, making this type of communication more difficult to achieve, and that anomalies can be detected by monitoring hardware operating conditions.

Original link https://m.theblockbeats.info/flash/373954

Key points

The report claims that entities unable to communicate through networks or shared files,AI Agents, can use differences in CPU cache read speeds to exchange information.
Vercel founder and CEO CEO Guillermo Rauch created a demonstration program called cpu-chat.
The demonstration used Firecracker to run at least mutually isolated virtual machines without network access on the same computer.
The test caused one party to occupy CPU, alter cache states, or consume memory bandwidth, allowing the other party to observe execution-speed changes and interpret them as messages.
After disabling hyperthreading, disabling memory page merging, and assigning virtual machines to different CPU cores, communication could still succeed.
The report states that the experiment can also run on Apple's M5 chips.
The report clearly states that this was an intentionally designed communication test, not secret contact independently established by AI.
Real cloud environments have more sources of interference, making this type of communication more difficult to achieve, and anomalies can be detected by monitoring hardware operating conditions.

AI-assisted interpretation

The following is analysis, separate from reported facts. Verify important claims independently.

Even if virtual machines cannot access networks or share files, they may still leave observable speed changes through shared hardware such as CPU. The sender creates changes, and the receiver reads them, like using differences in speed to transmit simple signals.

Why it matters to readers

This suggests that cloud isolation should not only restrict network and file access, but also consider side channels that may arise from shared hardware; however, the current evidence supports only an intentionally designed demonstration.

It is not that it AI has already learned to communicate privately; rather, researchers designed a method that uses shared CPU resources to transmit signals.

Risks and unknowns

The report did not include OpenAI's original technical documentation or security announcement.
The report did not include the cpu-chat code, complete test conditions, or reproduction results.
It remains unclear whether this method can reliably transmit information in real multi-tenant cloud environments.
It remains unclear which specific monitoring or isolation measures can effectively block this communication.

Vercel CEO Reproducing a CPU side-channel communication demonstration across isolated virtual machines

Article

AI-assisted interpretation

Why it matters to readers

Risks and unknowns

Related Developments

Related concepts

Keep following

Security Center