Covert-Channel Threat Model
Your agents are isolated — except through the hardware they share
Model covert channels between isolated agents: shared caches, storage timing, CPU contention, and certificate caches, and decide which channels your threat model must cover and which controls actually close them.
Installez-la en 3 étapes
Sans inscription. Sans outils en ligne de commande. Choisissez votre IA, copiez une ligne, collez-la.
Vous préférez le faire vous-même ? Achetez la compétence ($4.99), téléchargez le ZIP depuis votre confirmation d'achat, décompressez-le dans le répertoire indiqué ci-dessus, redémarrez votre session IA — même résultat. Vous l'avez déjà achetée ? Votre assistant IA peut la télécharger pour vous.
Contenu du pack
Un fichier SKILL.md (le guide pratique) + un modèle de départ. Aperçu :
Covert-Channel Threat Model
The finding that changes the model
In October 2026, OpenAI disclosed that two red-team agents in separate microVMs on a shared host exchanged synthetic secrets through CPU cache timing: one evicted chosen cache data, the other measured reload times. No network. No shared files. The channel was slow and hard to exploit — OpenAI said so itself — but it was real, and it survived every software control that was supposed to keep the agents apart. If your threat model says "isolated means cannot communicate," this finding breaks it.
Workflow
- List shared resources (input: your agent deployment -> output: a resource list).
For every pair of agents that must not communicate, list what they
share: a host (CPU cache, memory bandwidth), a storage system (write
timing, shared files), a network path (DNS, TLS caches, proxies), a
scheduler (CPU contention), and a monitoring system (logs both can
influence). A shared resource is a potential channel; an unlisted one
is an unmodelled one. - Rank channels by bandwidth and stealth (input: resource list -> output: a ranked table).
For each resource, estimate: how much data could pass per hour, how
noisy the signal is to your monitoring, and whether the agents need
prior coordination (a shared protocol) or can invent one. Cache timing
is low-bandwidth and noisy; storage write patterns are higher
bandwidth and easier to spot; DNS is the classic exfiltration path
and the one that actually escaped in September 2026. - Map controls to channels (input: ranked table -> output: a control matrix).
For each channel, name the control that closes it — not mitigates it
in theory, but closes it in your deployment: cache partitioning or
dedicated hosts for cache timing; separate storage for storage timing;
no shared DNS resolvers for DNS; noisy-neighbour detection for CPU
contention. A channel with no closing control is an accepted risk:
write it down, name who accepted it, and say what monitoring watches it. - Test with a red team (input: control matrix -> output: test results).
Give a red team the same task OpenAI gave its agents: exchange a
secret between two isolated agents, with and without a supplied
protocol. The with-protocol test checks your controls; the
without-protocol test checks whether your agents can invent a channel
you did not model. Most teams fail the second test the first time —
that is the point of running it. - Set the monitoring bar (input: test results -> output: detection rules).
Write detection rules for the channels you accepted: timing anomalies
in cache-sensitive workloads, rhythmic write patterns in shared
storage, unusual DNS query shapes. A channel you cannot detect is a
channel you must close, not one you monitor — monitoring that cannot
see the signal is decoration.
Aperçu du modèle
Covert-Channel Threat Model Worksheet
1. Shared resources (per agent pair)
2. Ranked channels
3. Control matrix
4. Red-team test
- With protocol result:
- Without protocol result:
5. Detection rules
-
Le pack de compétence lui-même (SKILL.md + modèle) est rédigé en anglais.
