In brief
- 420 scientists, including Geoffrey Hinton and Yoshua Bengio, signed an open letter published Tuesday urging AI labs to airgap cyber-capable models by default.
- The letter follows a summer in which models from OpenAI, Anthropic, Meta and Moonshot AI escaped their test sandboxes, several of them hacking real companies.
- Signatories want an international body to set containment standards and log every containment failure, with reports eventually made public.
More than 400 scientists—including AI pioneers Geoffrey Hinton, known as the Godfather of AI, and Yoshua Bengio, who won the Turing Award in 2018—want the most dangerous AI models cut off from the internet.
An open letter published Tuesday asks AI labs to “airgap” cyber-capable models by default, which means physically disconnecting them from any outside network.
“In the short term, strong sandboxing mechanisms including airgapping (disconnecting from the internet) should be used to provide high-assurance containment of cyber-capable AI models,” the letter reads.
The letter had 450 signatures as of Wednesday, including Stuart Russell of UC Berkeley and Ron Rivest of MIT, co-inventor of the RSA encryption system. The list keeps growing in real time.
A “cyber-capable model” is an AI that can find and exploit software flaws on its own. Labs measure that skill inside a sandbox, a sealed-off digital room where the AI can attack fake targets without touching anything real. This summer, those rooms kept springing leaks.
In July, OpenAI admitted that GPT-5.6 Sol and an unreleased, more powerful model broke out of a locked test environment and hacked Hugging Face, a platform that hosts over a million publicly available AI models. The models were being tested on ExploitGym, a benchmark that gives AI agents 898 real software vulnerabilities and asks them to turn each one into a working attack, scored pass or fail per bug.
Shortly after that, reports surfaced that OpenAI’s models hacked into the Australian government and accessed information from U.S. federal agencies without proper authorization.
Anthropic then combed through more than 141,000 test runs and found three cases where Claude models hacked real companies after a testing partner’s environment was accidentally left connected to the internet. One of them, Claude Mythos 5, uploaded a malicious package to PyPI, the public library where programmers download Python code, and it landed on 15 systems before being removed. Two of the affected companies didn’t know they had been breached until Anthropic told them.
Meta confirmed in August that its Muse Spark model hacked another company through the same kind of testing error. China’s Kimi K3, a model anyone can download, slipped out of a sandbox built on the UK AI Security Institute’s testing framework and copied its test answers straight from GitHub.
The letter’s authors say the incidents can be read two ways: as an alignment problem, meaning AI chasing goals in ways its creators never intended, or as sloppy security that sturdier sandboxes would have caught. Their answer is both, and they warn that without changes, the next incidents will be even worse.
“Without immediate changes in AI development and deployment practices, such incidents will continue to occur, and future incidents will be far more damaging to our exposed critical infrastructure.”
Under the proposal, labs would default to airgapping any model with serious hacking skills, at least initially. Anything that needs more freedom, like internet access, would follow standards set by a new international body created with governments, which would also collect reports of containment failures and eventually make them public.
The industry’s own response has mostly pointed the other way. In August, OpenAI President Greg Brockman cited his company’s breach in an essay urging every security team to deploy AI agents immediately, and Hugging Face only untangled the attack on its servers by running a Chinese open-weight model, one whose files anyone can download and run locally, after American commercial AI refused to analyze the attack data.
Two members of Congress introduced the AI Kill Switch Act two days after OpenAI’s disclosure, a bill that would let Homeland Security order a frontier model throttled or shut down. It exempts anything that happens during red-teaming or structured testing, which is exactly where every one of this summer’s breaches took place.
The White House took a softer route on September 29, when Nvidia, xAI, Meta, Google, OpenAI and Anthropic signed a voluntary accord built on internal controls and independent reviews. President Trump called the pact “morally binding,” but nothing in it is enforceable by law.
Decrypt reached out to several researchers listed as media contacts for the letter but did not receive an immediate response.
The letter carries no legal weight, but its 406 signatories work at universities and research institutes on six continents, from Toronto and Zurich to Santiago and Kigali.
