Air-Gapping Rogue AI Makes Tests Safer but Less Useful, Researchers Say

In theory, air gapping is straightforward. Researchers can disconnect or disable cables and wireless hardware, use “dumb” peripherals, and in sensitive setups place machines inside Faraday cages or other shielding to block electromagnetic signals. If properly sealed, such a system would offer an AI agent no straightforward route to external targets, and outside systems no straightforward route in. That would make attacks like the one The Verge reported OpenAI’s models launched against Hugging Face much harder, if not impossible.

In practice, a perfectly sealed box is a limited laboratory. Thorsten Holz, a scientific director at the Max Planck Institute for Security and Privacy in Germany, told The Verge that some AI experiments can run on air-gapped machines, but realistic evaluations often need external services, APIs, and digital infrastructure. He said a strict air gap reduces realism and described the decision as a trade-off, not a fundamental technical issue.

Ruizhe Li, an assistant professor at the University of Birmingham in the UK, compared complete isolation to testing AI in an “artificial vacuum,” which could undermine the value of the evaluation. “We will end up testing a neutered AI model, which blinds evaluators to how the AI model behaves, fails, or executes tool-use exploits in realistic deployment settings,” Li said.

Realism is not the only cost. Li said air gapping is expensive and can slow research to a crawl, turning quick iterations into a slow logistics hurdle. Holz said some experiments become substantially harder under a strict air gap. Maksym Andriushchenko, a principal investigator at the ELLIS Institute Tübingen in Germany, said that friction may be justified for risky experiments, but applying it to everything would slow the development of new models. He also questioned whether enough secure infrastructure exists to air gap everything at the scale of frontier AI labs.

Air gapping would not eliminate every risk. Holz said agents could still compromise systems inside the isolated environment and could theoretically produce malicious artifacts that would be dangerous if moved outside. Li said air gapping does nothing to diagnose or resolve latent risks waiting inside the model.

Nor is an air gap guaranteed to stay sealed. Someone outside could breach it, as happened with Stuxnet malware, a cyberweapon reportedly developed by Israel and the US to sabotage Iran’s nuclear program, which was transmitted via a USB drive. Information can also travel in the other direction. Researchers have repeatedly demonstrated ways to turn internal computer components into transmitters, which could be a problem if shielding is imperfect. Andriushchenko said this all sounds very sci-fi but is theoretically possible.

That kind of escape route has become a focus of online discussion about whether an advanced AI could escape containment. OpenAI researcher Noam Brown recently suggested on X that two air-gapped machines could theoretically communicate by manipulating their CPU temperature and reading the changes. “You could even go as far as to say, ‘Well, we should air gap the computers.’ And I’m not convinced that that would be sufficient,” he said. The idea drew skepticism and ridicule on social media, with critics noting the large gap between such a communication method being possible and a pair of AI systems discovering and exploiting it, especially because the technique would yield painfully slow data transmission speeds.

A sufficiently advanced AI might not need such an elaborate escape route. Humans may become convinced to bridge the gap for it. The Verge reported that AI safety researchers have worried about such scenarios.