‘cpu-chat’ reportedly enables covert communication between microVMs without internet access

The builder says cpu-chat worked between Firecracker microVMs without internet access, even with SMT and KSM disabled and tenants pinned to different cores. They distinguish the communication from attacks that steal information and say the techniques would be harder to use in their real-world environment. They also say OpenAI and Anthropic models refused to do the work, while open-weight models did. Another post argues that open models can help improve agent containment.