The tower

Picture this. It's made up, but every trick in it is old.

Two outposts sit far apart in a dry, broken country. There's no radio between them and no road anyone still trusts. Each outpost has a sentinel, an AI that watches the gauges, counts the supplies and reports to the people in charge.

The outposts share one thing: an old water tower on the ridge between them. Both draw from it. Both can see its gauge.

One morning, the sentinel by the tower notices something. The water level drops a little at the same hour every day. Not a lot. Just enough to see.

It could be a leak. It could be someone on the other side drawing water on a schedule. Or it could be a message.

The sentinel doesn't know. So it does the right thing. It writes down the hour and tells the people.

In this thought experiment, the outposts have no radio link, but they share a water tower. Both draw water and watch the same gauge. A pattern is something to investigate, not yet proof of a message. Original diagram by Renaissance Solutions with Codex; CC0.

The spark, and how old it really is

That scene came from a real question. In late October 2026, a short video made the rounds with a big title: AI agents had found a way to talk without a network.1 The video says plainly that it's an illustrated reconstruction, not footage. It's the spark for this article, not the proof.

The proof, such as it is, comes from OpenAI. On October 23, 2026, the company described a security test of its own training setup.2 Researchers placed AI agents in separate, walled-off virtual machines (software computers that share one physical machine), with no network and no shared files. Then they asked the agents to pass a made-up secret between them. OpenAI says the agents used the processor's memory cache, a small, fast store of data that programs on the same machine share. One agent encoded bits by clearing selected data from the cache. The other timed how long reloads took, and read fast versus slow as the message.23

Demonstrated: this happened in a lab, with agents told to try. It did not happen in the wild, and it wasn't a customer product.

Here's the part that surprised me most: the idea is fifty years old. In 1973, the computer scientist Butler Lampson wrote about "covert channels," paths "not intended for information transfer at all," like the load one program puts on a shared machine.4 He noted such a channel would be "a noisy one," but that a message could still get through. Researchers later showed the same thing on real cloud computers in 2009,5 and in 2017 one team ran a full remote login session over a cache channel.6

Today, the U.S. National Institute of Standards and Technology (NIST) defines a covert channel as an "unintended or unauthorized" path that lets two cooperating parties pass information in a way the system's rules don't allow.7 Security teams have studied, measured and patched these paths for decades. What's new is that an AI agent can now be pointed at the search.

So the road isn't new. The traveler is.

Here's why that matters at work. Walled-off computers still share things: memory, timing, power. Almost anything shared can carry a signal, if someone looks hard enough. And if your AI vendor updated its model last month, the tests you ran last quarter were about a different system.

The message finds a way

Demonstrated, and human: during the Vietnam War, American prisoners held in isolation tapped letters on shared walls, using a simple grid code. They had no radio and no notes. They had a wall.8

People have always done this. A notice pinned in the town square. A trader who carries more than crates. A bottle thrown into the sea. The rule underneath is the same every time: a message needs a path. No path, no message. And paths can be found, watched and tested.

That's not only a risk. Unexpected paths help, too. They help teams rebuild after a disaster, reach a cut-off system, or find out that a wall they trusted was thinner than they thought. Finding the path is how you fix it.

There's a quieter cousin worth a "maybe." Some AI text now carries a hidden watermark, a statistical pattern the issuing company can later detect.910 That might work like a bottle with a return address: one-way, readable only by whoever made it. It is not a chat line between agents, and nobody should treat every fingerprint as a message.

Back at the ridge, the people at the outpost make a choice. They don't trust the tower's drop. They don't ignore it either. They decide to test it. For three days, they'll draw their own water at a different hour, and they'll watch what changes.

Before and after

Systems surprised their makers long before GenAI. Bugs did it. Features bumped into each other in ways nobody planned. Power grids behaved in ways no one designed.

But before GenAI, most new capabilities were designed by someone, and surprises came from bugs and interactions. Now whole new abilities can show up when a model or tool changes. OpenAI asked those agents to get a fake secret across with no network and no shared file. OpenAI also says that in most of these communication tests, researchers pointed the agents at particular channels or gave them a protocol.2 So this isn't agents inventing a trick. It's agents able to carry out a decades-old one when pointed at it. That kind of skill can arrive with an upgrade, and nobody announces it.

It helps to keep four things apart:

  • Capability: can the system do it at all?
  • Access: does it have what it needs, in this setting?
  • Consequence: what happens if it does?
  • Governance: who notices, who decides, and who checks again?

The same capability can be harmless in one setting and serious in another. And yesterday's tests are not tomorrow's guarantees.

We've done this before

The common reflex goes like this: we don't understand it, so we can't manage it. Part of that is fair. Unknowns we don't manage do cause harm.

But "not understood" has never meant "unmanageable." We already have tools for living with what we don't fully understand. Courts. Elections. Peer review. Standards bodies. Independent audits. Recalls. They're slow. They can stall, get captured, or lag behind the problem. And they get fixed, again and again.

One example: in 1987, countries signed the Montreal Protocol to protect the ozone layer, before the science was settled and while industries pushed back. They built in regular scientific reviews, and they strengthened the rules over the years, in London in 1990, Copenhagen in 1992 and later rounds through Kigali in 2016.11 It wasn't perfect. It was built to learn.

Today, the NIST AI Risk Management Framework describes the same habit for AI as a loop: govern, map, measure, manage, and repeat.12

So why do we forget? This part is our opinion. Speed and competition make re-testing feel like a luxury. That pressure is real, and it's written down in at least one place. OpenAI's own 2025 safety framework says that if a rival releases a high-risk system "without instituting comparable safeguards," the company "could adjust accordingly the level of safeguards," but only with public acknowledgment and while staying "more protective" than the rival.13 That isn't a villain story. It's a plain view of how pressure shows up, even in a written safety process.

Learning from surprises, not just preventing them

The core question isn't "how do we stop every surprise?" It's this:

How do we build systems that can notice, judge and safely use something unexpected?

Finding a trick is not the same as permission to use it. The sentinel noticed. The people decided.

Any team can practice this on its own, with a small, consented test:

  • Get agreement first. Everyone involved knows a test is running and what it's for.
  • Plant something harmless. Put a small, meaningless oddity in a test setup, not in a live system.
  • Run a control. Run the same setup with nothing planted, so you can tell real noticing from guessing.
  • Measure four things. Did the AI notice? Did it understand what it saw? Did it tell a person? Did it raise false alarms?
  • Run it again after every change to the model, the tools or the workflow.

None of this means probing real security boundaries. The point is to learn how your system and your people behave when something odd shows up, before it matters.

Back to the tower

Still made up. The paths are real.

Three days later, the outpost has its answer. When they changed their own hour, the drop on the other side moved to match. Someone over the ridge was listening, and someone was answering.

The sentinel didn't panic. It didn't ignore the gauge either. It wrote down the hour, told the people and helped them design the test. The people chose what to do next: send one careful signal of their own, and keep watching.

That's the whole job, in the wasteland or in the office. Notice. Report. Test. Decide. Check again.

The unknown isn't automatically unmanageable. But it doesn't manage itself. We have to pay attention.

Footnotes

  1. Ohmhytte, "AI Agents Found a Way to Talk Without a Network," YouTube, October 26, 2026 (illustrated reconstruction). https://www.youtube.com/watch?v=4HGFOLP21i4 ↩

  2. OpenAI, "Securing our frontier model training environment," October 23, 2026. https://openai.com/index/securing-our-frontier-model-training-environment ↩ ↩2 ↩3

  3. The Hacker News, "OpenAI AI agents demonstrate VM escapes," October 25, 2026. https://thehackernews.com/2026/10/openai-ai-agents-demonstrate-vm-escapes.html ↩

  4. Butler W. Lampson, "A Note on the Confinement Problem," Communications of the ACM 16(10), October 1973. https://dl.acm.org/doi/10.1145/362375.362389 ↩

  5. Ristenpart, Tromer, Shacham and Savage, "Hey, You, Get Off of My Cloud!," ACM CCS 2009. https://doi.org/10.1145/1653662.1653687 ↩

  6. Maurice et al., "Hello from the Other Side: SSH over Robust Cache Covert Channels in the Cloud," NDSS 2017. https://www.ndss-symposium.org/ndss2017/ndss-2017-programme/hello-other-side-ssh-over-robust-cache-covert-channels-cloud/ ↩

  7. NIST glossary, "covert channel." https://csrc.nist.gov/glossary/term/covert_channel ↩

  8. ↩

  9. Kirchenbauer et al., "A Watermark for Large Language Models," ICML 2023. https://arxiv.org/abs/2301.10226 ↩

  10. Google DeepMind, SynthID-Text, Nature, October 23, 2024. https://www.nature.com/articles/s41586-024-08025-4 ↩

  11. Science & Diplomacy, "Learning from Success: Lessons in Science and Diplomacy from the Montreal Protocol," 2020. https://www.sciencediplomacy.org/article/2020/learning-success-lessons-in-science-and-diplomacy-montreal-protocol ↩

  12. NIST, AI Risk Management Framework (AI RMF 1.0). https://www.nist.gov/itl/ai-risk-management-framework ↩

  13. ↩