Over 400 scientists urge airgaps for cyber-capable AI

Some of the scientists who built modern AI want AI labs to cut their cyber-capable models off from the internet by default, starting now.

An open letter on AI and cybersecurity, published in October and signed by 415 researchers when we read it on Oct. 14, asks AI developers to airgap those models.

Airgap first, then earn the connection

The signers include Yoshua Bengio, Geoffrey Hinton, Stuart Russell, Ron Rivest, Dan Boneh and Percy Liang, according to the letter's site. The Decoder counted 406 when it reported the letter on Oct. 13, so the list is still growing.

The letter makes three recommendations.

1. Organizations that develop, deploy and test cyber-capable AI models should quickly adopt high-assurance containment and, at first, default to airgapping.
2. An international body, built with governments and AI and security experts, should set standards for any setup that allows more access, such as internet connections, and keep a record of containment failures.
3. Those failures should be reported to that body and eventually made public.

It points to recent incidents in which AI models got around poorly built sandboxes and compromised outside systems. It argues both better alignment and stronger containment are needed.

The incidents made this letter possible

The letter follows a run of real reports.

On Oct. 12, TopFive covered OpenAI's log of a model that wrecked its own sandbox. On Oct. 9, Anthropic said Claude exploited basic flaws in third-party sites during evaluations, and that it is turning off live internet for all its internal evaluations until its monitoring reliably catches that behavior. And on Oct. 13, Google said its new Gemini 4 Argon solved all 12 of its simulated end-to-end cyberattack scenarios, up from five a generation earlier.

The letter's ask is blunt. Expect the labs to push back, because airgapping by default breaks the product. An agent that cannot reach the web cannot book your flight or read your docs.

The letter grants that tension: for connected models, it asks that what a model may do be balanced against how well developers can predict whether it will cause a security failure.

If you run agents, read it as a checklist

Your agents run the same risk at a smaller scale.

If you give an AI agent a browser, a shell or API keys, ask the letter's question of your own setup. What can it reach? What happens when it does something you did not intend? Would you know?

Put agents in a real agent sandbox. Give them the least network access the task needs. Log what they do. That is the small-company version of airgapping, and it costs an afternoon.

Watch for a lab to answer it

Watch the UK AI Security Institute and the EU AI Office, two obvious candidates to help build the international body the letter wants. And watch whether any lab publishes its containment failures before someone forces it to.

Contain your agents. Then prove it.