Two VMs With No Network Chat Through the CPU
Vercel's CEO reproduced OpenAI's covert communication finding inside a Firecracker microVM. Two networkless VMs exchanged information through CPU contention, cache eviction, and DRAM bandwidth. Even more ironically, OpenAI/Anthropic models refused to write the code, while open-source models completed it.
Two Firecracker microVMs with no network access struck up a conversation through the CPU. Vercel CEO Guillermo Rauch published this project on X: cpu-chat, reproducing OpenAI's finding about using the CPU for covert communication.
The so-called chat relies on three mechanisms: CPU contention, cache eviction timing, and DRAM bandwidth contention. Firecracker is AWS's open-source microVM technology, commonly used to run cloud functions and container isolation. The two VMs ran on the same host machine and were tested on both x86 and Apple M5 chips.
Even when following Firecracker's recommended production configuration (SMT off, KSM off, tenants pinned to different cores), the communication still worked. Guillermo says that as long as two VMs share hardware, there is a way to communicate quietly, and the latency is not bad.
This is not a side-channel attack, he emphasized. Side-channel attacks are when an agent can steal information, such as Meltdown/Spectre, which Vercel Sandbox mitigates. By contrast, a 'whispering' technique like cpu-chat is harder to implement in real environments and easier to monitor (detected through hardware counters and lots of statistical data).
There is a notable detail in this project: OpenAI and Anthropic models refused to write this code, while open-weight models completed it. Guillermo worries that the labs' conservative stance may backfire: people who want to build secure systems need this kind of analysis capability, and without it, the world becomes less safe. One comment hit the nail on the head: 'Closed models refuse to help test a sandbox; open weights just do it. It is hard to protect a wall you are forbidden to inspect.'
Someone commented, 'Two VMs with no network are passing notes in class.' Another joked, 'My team has Slack, Zoom, and email, and still no one replies.' Another said, 'This is the slowest chat app, but the only one the IT department cannot read.' Some also extended the thought: to get sandbox isolation right, will we ultimately have to rely on hardware isolation?
In a reply, Guillermo added that cross-CPU communication does not require SMT or shared pages. cpuset can isolate cores, but it cannot isolate DRAM channels and memory controllers. He mentioned that socket pinning might mitigate it.
发布时间: 2026-10-27 06:56