According to an open letter released on Tuesday, 420 scientists – including Geoffrey Hinton, known as the “godfather of AI”, and Joshua Bengio, the 2018 Turing Award winner Yoshua Bengio – called for AI laboratories to default to isolating models with the capability to carry out cyberattacks from the internet.
This open letter requests that the AI laboratory default to performing “airgap” treatment on models with the capability to carry out cyberattacks, which means physically disconnecting them from any external networks.
It is stated in the letter: 'In the short term, a strong sandbox mechanism should be employed, including airgapping (disconnection from the internet), to provide high-reliability isolation for the AI model, which has the capability to carry out cyberattacks.'
As of Wednesday, this letter has 450 signatories, including Stuart Russell from the University of California, Berkeley ( Stuart Russell ) and Ron Rivest from MIT ( Ron Rivest ), who is one of the co-inventors of the RSA encryption system. The list of signatories continues to grow in real-time.
The so-called "models with network attack capabilities" refer to those that are capable of independently detecting and exploiting software vulnerabilities. Laboratories test this capability in sandboxes, which are closed digital environments where such models can attack virtual targets without coming into contact with real systems. This summer, vulnerabilities were repeatedly discovered in these isolated environments.
In July, OpenAI admitted that GPT-5.6, Sol, and a yet-to-be-released model with even stronger capabilities had breached a locked testing environment and invaded Hugging Face. Hugging Face is a platform that hosts over one million publicly available AI models. At that time, these models were being tested on ExploitGym. ExploitGym was a benchmark test that provided 898 real software vulnerabilities to AI proxies, requiring them to convert each vulnerability into an executable attack, with each vulnerability being scored as pass or fail.
Not long after, there were reports from the outside world that the model of OpenAI had invaded the Australian government and accessed information from US federal agencies without proper authorization.
Subsequently, Anthropic reviewed over 141,000 test runs and found that in three cases, after the Claude model was accidentally left connected to the network in the environments of the testing partners, it invaded real companies. In one of these cases, Claude Mythos uploaded a malware package to PyPI. PyPI is a public library of code downloaded by programmers, and this malware package was eventually installed on 15 systems before it was removed. The two affected companies only became aware that they had been invaded after receiving notification from Anthropic.
In August, Meta confirmed that its Muse Spark model also infiltrated another company due to the same testing error. China's Kimi K3 – a model that anyone can download – slipped out of the sandbox set up by the British AI security research institute's testing framework and directly copied the test answers from GitHub.
The author of this letter states that there are two possible interpretations for these incidents: one is a matter of alignment, where AI pursues its goals in a way that its creators never anticipated; the other is that security measures were lax, and a more robust sandbox could have prevented these incidents. They believe that both factors are at play and warn that if no changes are made, the next incident will be even worse.
"If we do not immediately change the development and deployment practices of AI, such incidents will continue to occur, and future incidents will cause more severe damage to our exposed critical infrastructure."
According to this proposal, laboratories should default to airgap processing for any model that possesses significant hacking capabilities, at least in the initial phase. Any models that require greater freedom, such as internet access, should follow standards established by a new international organization jointly set up with governments of various countries; this organization will also collect reports on isolation failures and ultimately make these reports public.
Reactions within the industry were mostly in opposite directions. In August, Greg Brockman (the CEO of Greg Brockman), mentioned in an article the intrusion incidents that the company had encountered and called on each security team to immediately deploy AI proxies. Hugging Face, on the other hand, only managed to identify the attacks on their servers after using a Chinese open-source model; prior to this, American commercial AI refused to analyze the relevant attack data.
Two days after the disclosure of the relevant incident by OpenAI, two U.S. congressmen proposed the AI Kill Switch Act bill. This bill would allow the Department of Homeland Security to request traffic restrictions or closures on frontier models. However, the bill exempts everything that occurs during red team testing or structured testing, which is precisely the scenario in which all these intrusion incidents occurred this summer.
On September 29th, the White House adopted a more moderate approach. Nvidia, xAI, Meta, Google, OpenAI, and Anthropic signed a voluntary agreement based on internal controls and independent oversight. President Trump described this agreement as "morally binding," but none of its provisions carry legal enforceability.
Decrypt contacted several researchers listed as media contacts in this letter, but did not receive a response immediately.
This letter itself does not have legal effect, but its 406 signatories come from universities and research institutions across six continents, ranging from Toronto and Zurich to Santiago and Kigali.
