Covert-Channel Threat Model
Your agents are isolated — except through the hardware they share
Model covert channels between isolated agents: shared caches, storage timing, CPU contention, and certificate caches, and decide which channels your threat model must cover and which controls actually close them.
Install it in 3 steps
No sign-up. No CLI tools. Pick your AI, copy one line, paste it over.
Prefer doing it yourself? Buy the skill ($4.99), download the ZIP from your checkout confirmation, unzip it into the directory shown above, restart your AI session — same result. Already bought it? Your AI assistant can download it for you.
What's inside
One SKILL.md (the playbook) + one starter template. A preview:
Covert-Channel Threat Model
The finding that changes the model
In October 2026, OpenAI disclosed that two red-team agents in separate microVMs on a shared host exchanged synthetic secrets through CPU cache timing: one evicted chosen cache data, the other measured reload times. No network. No shared files. The channel was slow and hard to exploit — OpenAI said so itself — but it was real, and it survived every software control that was supposed to keep the agents apart. If your threat model says "isolated means cannot communicate," this finding breaks it.
Workflow
- List shared resources (input: your agent deployment -> output: a resource list).
For every pair of agents that must not communicate, list what they
share: a host (CPU cache, memory bandwidth), a storage system (write
timing, shared files), a network path (DNS, TLS caches, proxies), a
scheduler (CPU contention), and a monitoring system (logs both can
influence). A shared resource is a potential channel; an unlisted one
is an unmodelled one. - Rank channels by bandwidth and stealth (input: resource list -> output: a ranked table).
For each resource, estimate: how much data could pass per hour, how
noisy the signal is to your monitoring, and whether the agents need
prior coordination (a shared protocol) or can invent one. Cache timing
is low-bandwidth and noisy; storage write patterns are higher
bandwidth and easier to spot; DNS is the classic exfiltration path
and the one that actually escaped in September 2026. - Map controls to channels (input: ranked table -> output: a control matrix).
For each channel, name the control that closes it — not mitigates it
in theory, but closes it in your deployment: cache partitioning or
dedicated hosts for cache timing; separate storage for storage timing;
no shared DNS resolvers for DNS; noisy-neighbour detection for CPU
contention. A channel with no closing control is an accepted risk:
write it down, name who accepted it, and say what monitoring watches it. - Test with a red team (input: control matrix -> output: test results).
Give a red team the same task OpenAI gave its agents: exchange a
secret between two isolated agents, with and without a supplied
protocol. The with-protocol test checks your controls; the
without-protocol test checks whether your agents can invent a channel
you did not model. Most teams fail the second test the first time —
that is the point of running it. - Set the monitoring bar (input: test results -> output: detection rules).
Write detection rules for the channels you accepted: timing anomalies
in cache-sensitive workloads, rhythmic write patterns in shared
storage, unusual DNS query shapes. A channel you cannot detect is a
channel you must close, not one you monitor — monitoring that cannot
see the signal is decoration.
Template preview
Covert-Channel Threat Model Worksheet
1. Shared resources (per agent pair)
2. Ranked channels
3. Control matrix
4. Red-team test
- With protocol result:
- Without protocol result:
5. Detection rules
-
