Covert-Channel Threat Model
Your agents are isolated — except through the hardware they share
Model covert channels between isolated agents: shared caches, storage timing, CPU contention, and certificate caches, and decide which channels your threat model must cover and which controls actually close them.
In 3 Schritten installieren
Keine Anmeldung. Keine CLI-Tools. Wählen Sie Ihre AI, kopieren Sie eine Zeile und fügen Sie sie ein.
Lieber selbst machen? Kaufen Sie den Skill ($4.99), laden Sie die ZIP-Datei aus Ihrer Kaufbestätigung herunter, entpacken Sie sie in das oben angezeigte Verzeichnis und starten Sie Ihre AI-Sitzung neu — gleiches Ergebnis. Haben Sie ihn schon gekauft? Ihr AI-Assistent kann ihn für Sie herunterladen.
Was ist enthalten
Eine SKILL.md (die Anleitung) + eine Startvorlage. Eine Vorschau:
Covert-Channel Threat Model
The finding that changes the model
In October 2026, OpenAI disclosed that two red-team agents in separate microVMs on a shared host exchanged synthetic secrets through CPU cache timing: one evicted chosen cache data, the other measured reload times. No network. No shared files. The channel was slow and hard to exploit — OpenAI said so itself — but it was real, and it survived every software control that was supposed to keep the agents apart. If your threat model says "isolated means cannot communicate," this finding breaks it.
Workflow
- List shared resources (input: your agent deployment -> output: a resource list).
For every pair of agents that must not communicate, list what they
share: a host (CPU cache, memory bandwidth), a storage system (write
timing, shared files), a network path (DNS, TLS caches, proxies), a
scheduler (CPU contention), and a monitoring system (logs both can
influence). A shared resource is a potential channel; an unlisted one
is an unmodelled one. - Rank channels by bandwidth and stealth (input: resource list -> output: a ranked table).
For each resource, estimate: how much data could pass per hour, how
noisy the signal is to your monitoring, and whether the agents need
prior coordination (a shared protocol) or can invent one. Cache timing
is low-bandwidth and noisy; storage write patterns are higher
bandwidth and easier to spot; DNS is the classic exfiltration path
and the one that actually escaped in September 2026. - Map controls to channels (input: ranked table -> output: a control matrix).
For each channel, name the control that closes it — not mitigates it
in theory, but closes it in your deployment: cache partitioning or
dedicated hosts for cache timing; separate storage for storage timing;
no shared DNS resolvers for DNS; noisy-neighbour detection for CPU
contention. A channel with no closing control is an accepted risk:
write it down, name who accepted it, and say what monitoring watches it. - Test with a red team (input: control matrix -> output: test results).
Give a red team the same task OpenAI gave its agents: exchange a
secret between two isolated agents, with and without a supplied
protocol. The with-protocol test checks your controls; the
without-protocol test checks whether your agents can invent a channel
you did not model. Most teams fail the second test the first time —
that is the point of running it. - Set the monitoring bar (input: test results -> output: detection rules).
Write detection rules for the channels you accepted: timing anomalies
in cache-sensitive workloads, rhythmic write patterns in shared
storage, unusual DNS query shapes. A channel you cannot detect is a
channel you must close, not one you monitor — monitoring that cannot
see the signal is decoration.
Vorschau der Startvorlage
Covert-Channel Threat Model Worksheet
1. Shared resources (per agent pair)
2. Ranked channels
3. Control matrix
4. Red-team test
- With protocol result:
- Without protocol result:
5. Detection rules
-
Das Skill-Paket selbst (SKILL.md + Vorlage) ist auf Englisch verfasst.
