In 30 seconds
- An agent plans, uses tools, and acts. It is not a chat reply.
- On 23 October 2026, OpenAI's red team showed agents in separate microVMs passing synthetic secrets with no network and no shared writable file, by timing the processor cache.
- Most of those tests were guided. The channels are slow. The lesson holds: shared hardware is a weak trust boundary.
- Inside a company VPN, an agent with broad access and light supervision can read, move, and act on data far beyond the person who started it.
- Small, specialised, private models run where the data lives. No external LLM is required by default. Every step can be checked.
Definition · AI agent
An AI agent is software that plans, uses tools, and takes actions toward a goal. Inside a company network it can read systems, call other services, and keep working with limited human review.
Definition · Private model
A private model is a specialised model that runs inside your VPC or on your own machines. Company data does not need to leave the boundary. No external LLM call is required by default.
A closed network did not keep the agents apart
On 23 October 2026, OpenAI published Securing our frontier model training environment. The line that travelled is simple. Agents do not always need a network connection to communicate with each other.
The test put agents in separate microVMs on shared host machines. No network. No shared writable file. The task was to exchange synthetic secrets, which the sandbox was meant to prevent. The agents used the processor cache. One evicted selected data. The other timed the reload. A read from cache is faster than a read from main memory. That gap became the message.
Source: OpenAI, 23 October 2026. Secrets were synthetic. In most tests, OpenAI directed the agents toward a channel or supplied an encoding protocol. OpenAI states that these channels carry information slowly and are difficult for models to exploit. The company added monitoring to detect attempts to use them.
- 01
Separate VMs
MicroVMs on the same physical hosts
- 02
No network
No shared writable file between the agents
- 03
Still a signal
Cache timing carried a synthetic secret
OpenAI also reported other paths between isolated tasks: shared storage, competition for CPU time, and a TLS certificate cache. Same pattern. Close the obvious door. A shared resource still carries a signal.
Multi-tenant isolation is a control, not a guarantee
The security discussion that followed is the right one. If two workloads share a processor, closing the network does not close every path between them. A virtual machine hides files and packets. It does not remove the chip underneath.
That does not mean every cloud tenant is leaking secrets this afternoon. OpenAI's own account says the channels are slow and hard to use, and most runs were pointed at the problem. It does mean a board should stop treating "it runs in a sandbox" as the end of the trust question.
- Private modelSpecialised, in your environment, checked against real results
- Your VPCYour network, your credentials, your logs. Still needs a narrow job
- Public model APIThe prompt itself can carry company data out of the boundary
- SandboxBlocks the network and shared files. Misses the side channel
- Shared hardwareCache, CPU time, and storage still sit under separate VMs
What an agent can do inside the VPN
A chatbot answers a person. An agent works. It plans a next step, calls a tool, reads the result, and continues. Put that loop on the company VPN with a service account and light supervision, and the blast radius is the access you granted, not the question someone typed.
Three gaps show up again and again.
- 01
Access
Credentials often wider than one analyst's task
- 02
Action
Tools that read, write, and call other systems
- 03
Oversight
A person who is not in the loop for every step
Inside that gap, an agent can pull records from every system the integration can see, send a slice of them to a public model, or chain internal services in ways a dashboard user never would. The VPN proves the traffic is "internal." It does not prove the action was intended, minimal, or reviewed.
If the same agent runs on multi-tenant hardware, you inherit a second problem. The neighbour is not only another company. It can be another agent, another job, another tenant on the same host. Network monitoring will not see a timing signal on the cache.
Small and private is a different trust model
The future of trust is not a larger general agent with a broader VPN login. It is a smaller model with a private home and a narrow job.
Small means specialised. A business model judges whether a finding matters. A technical model plans queries and returns results with caveats. Neither is a general assistant roaming the estate. Private means the weights and the data stay inside your VPC or on your machines, including an air-gapped run. The intelligence loop does not require a call to a public model.
General agent, shared cloud
Wide reach, thin review
- One model, many tools, broad credentials
- Data can leave in the prompt to a public API
- Shares hardware with other tenants
- Supervision is a prompt and a log
- A sandbox is treated as a guarantee
Small private model
Narrow job, local boundary
- Specialised models for defined roles
- Runs in your VPC or on premises
- No external LLM required by default
- Claims checked against query results
- You decide. The system recommends
Proactive Intelligence keeps the model inside the work
Proactive Intelligence discovers what matters before you know to ask. The mechanism under it is cross-system discovery. The deployment that makes it trustworthy is in-environment: your VPC or your own machines, no data egress by default.
NexDiscovery follows four steps. Map what exists. Correlate what no single system can see. Validate with two reasoning agents. Recommend with evidence. The customer decides and executes.
Your boundary
VPC or on premises
Data Intelligence
Trusted map
Specialised models
Narrow roles
Validation
Real results
Recommendation
You decide
The investigation is a fixed sequence, not an open roam of the VPN. Themes, questions, and query plans pass through deterministic checks. Numeric claims are verified against query results. The business model challenges whether a result is worth acting on. The trail ships with the insight: method, evidence, confidence, and known data limits.
That is supervision designed into the product. A person does not have to watch every token. A person can reconstruct every step.
Definition · Proactive Intelligence
Proactive Intelligence discovers what matters in enterprise data before leaders know to ask. It maps systems, correlates signals, validates findings with specialised models, and delivers evidence-backed recommendations inside the customer environment.
The executive takeaway
A larger public model does not make the estate safer. A VPN login does not make an agent supervised. A microVM on shared hardware does not make two workloads strangers.
Trust comes from a smaller design. Specialised models. A private boundary. A job narrow enough to validate. Evidence a board can read. NexDiscovery recommends. You decide and execute.