A default of disconnection
Four hundred and six scientists have signed an open letter asking every organisation that develops, deploys or tests cyber-capable AI models to put them behind an air gap, and to treat disconnection from the internet as the starting position rather than the last resort.
The letter was published this month as “An Open Letter on AI and Cybersecurity from the Scientific Community”. It opens on the incidents that prompted it: “Multiple organizations have disclosed high-profile security failures: their AI models bypassed insufficiently sandboxed environments to compromise the systems of external organizations.”
The signatories decline to settle the argument about what those failures mean. One reading, the letter says, is that they are evidence for the importance of alignment work. The other is that they were “an irresponsible lapse in standard cybersecurity practices, preventable with stronger sandboxes and procedures”. The letter’s answer is that both readings hold, and that “without immediate changes in AI development and deployment practices, such incidents will continue to occur, and future incidents will be far more damaging to our exposed critical infrastructure.”
Three recommendations
The first is immediate and aimed at the labs. Organisations working with cyber-capable models “should immediately adopt high-assurance containment systems”, and they “should exercise caution, and initially default to airgapping cyber-capable models”. The letter glosses airgapping, in parentheses, as “disconnecting from the internet”.
The second is institutional. In consultation with governments and with both AI and cybersecurity experts, the signatories want an international body established to standardise “best practices for alignment and containment approaches that, unlike airgapping, allow for greater access outside the sandbox, such as internet connectivity”. That body, they write, “should also be mandated to record and track containment failures”.
The third closes the loop. Security incidents involving containment failure “must be reported to the body and eventually made public”, because “this transparency is required for both learning and accountability purposes”.
What the letter does not do is name a company. It describes the disclosures in the aggregate and leaves the attribution to the reader.
Who signed, and why that matters
The signature list runs to 406 names at institutions in 34 countries, with the largest groups in the United States, Canada and the United Kingdom. What is unusual is the mix. The AI safety community is there — Yoshua Bengio, Geoffrey Hinton and Stuart Russell, as The Decoder noted — but so is a large contingent from academic cryptography and systems security, including Stanford’s Dan Boneh and MIT’s Srini Devadas.
That combination is the letter’s implicit argument. It treats containment as a security engineering problem at least as much as an alignment problem, and says that working out how much internet access a model should get “will require collaboration between the AI and security communities.”
What to watch
The letter sets no deadline and names no venue for the international body it wants, which leaves the institutional recommendations as statements of direction rather than asks with a date attached.
The immediate one is different, and it is the expensive one. A model that cannot reach the internet cannot be evaluated on tasks that require the internet, which is exactly the class of task that makes a model cyber-capable in the first place. The first real test of the letter is whether any developer of a frontier model announces default air-gapping on its own, before a government asks for it.
