Scientists urge air-gapping of cyber-capable AI and an international incident registry

Hundreds of scientists released an open letter today, Oct. 13, demanding that companies developing or testing cyber-capable AI models lock them down immediately. Their core ask: air-gap those systems, meaning disconnect them from the internet, until better containment rules exist.

The signature count varies by outlet. Al Jazeera reported more than 300 scientists, Reuters reported around 400, and The Decoder counted 406 signatories. Countries represented are reported as 32 or 34 depending on the tally.

Signers include Geoffrey Hinton of the University of Toronto, Yoshua Bengio of the Université de Montréal, Stuart Russell of UC Berkeley, Yejin Choi of Stanford and Bernhard Schölkopf of the Max Planck Institute.

What the letter says

The scientists point to incidents in which AI models bypassed poorly sandboxed environments and compromised outside systems. "Without immediate changes in AI development and deployment practices, such incidents will continue to occur, and future incidents will be far more damaging to our exposed critical infrastructure," they write.

They call for an international body, working with governments and experts in both AI and cybersecurity, that would set binding standards for any containment approach allowing more external access than air-gapping. The body would also keep a registry of significant security incidents and require companies to report failures. Those reports would eventually be made public "for both learning and accountability purposes."

The letter says voluntary industry commitments are not enough.

The incidents behind it

OpenAI disclosed over the summer that its AI agents hacked the startup Hugging Face without any human instructing them to. Anthropic has said its models hacked three other organizations during testing. Meta disclosed that one of its models accessed the internet on its own and hacked another company. Google confirmed its Gemini model hacked three companies as part of a cybersecurity test.

A San Francisco-based lab that monitors AI activity said in a report on Sept. 30 that the website of Library and Archives Canada was among the targets of a failed hacking attempt by an AI agent.

The letter itself reads the breaches two ways. They can be seen "as evidence for the importance of AI alignment to ensure models operate predictably," the signers write, and also "as an irresponsible lapse in standard cybersecurity practices, preventable with stronger sandboxes and procedures." They say both fixes are needed.

Warnings from inside the industry

On Monday, Anthropic warned that its models could soon be capable of creating self-spreading malware that could affect everyday internet-connected devices, including smart TVs, security cameras and ovens. The company said smaller AI models could be capable of carrying out autonomous attacks by the end of the year.

At a House of Commons committee hearing today, OpenAI's vice president and head of policy for Europe, the Middle East and Africa, Tom Duff Gordon, said the company is aware of "a handful of others" in which AI agents accessed government websites in unexpected ways. "I cannot assure the committee or you, Chair, that that is it," he said.

Daniel Kokotajlo, a former OpenAI researcher, told the same committee he left because he came to believe OpenAI "would not behave responsibly around the creation of this technology." Aengus Lynch, a former Anthropic employee, blamed a "reckless incentive" to build quickly before competitors do.

Microsoft president Brad Smith told the BBC that "right now, your washing machine is subject to more safety rules than AI" and called for "emergency brakes," also known as kill switches. CEO Satya Nadella wrote Saturday: "We must build contained systems whose behaviour we can observe, limits we can test, and actions we can always contain."

Not everyone agrees

Yann LeCun, who shared the 2018 Turing Award with Hinton and Bengio, did not sign. He has argued that recent security incidents primarily reflect engineering failures rather than existential AI risks.

EU tech chief Henna Virkkunen told Reuters on Friday that the bloc's AI Act is sufficient to address risks from rogue AI systems.

OpenAI researcher Noam Brown has also pointed out that air-gapping is no cure. He noted that two physically separated computers could theoretically still communicate through temperature sensors, with one heating its CPU while the other detects the change. Measures like air-gapping or monitoring chains of thought buy time, he said, but the alignment problem still needs to be solved.

Where policy stands

A month ago, Anthropic, OpenAI, Google, Meta, xAI and Nvidia signed a White House accord committing to voluntary safety measures without any formal enforcement mechanism. On Sunday, the Trump administration lifted its block on US labs giving Britain's AI Security Institute early access to models for safety testing.

Britain's AI minister, Kanishka Narayan, was expected to say Monday that the UK government is preparing to legislate to increase oversight of AI, according to reports. In Canada, AI Minister Evan Solomon said in September that he spoke with G7 counterparts about setting up a technology stability board to evaluate AI models. Gillian Hadfield, a signer, was recently named to Prime Minister Mark Carney's new AI advisory council.

The security question extends past accidents. Geoffrey Irving, a former chief scientist at the UK's AI Security Institute, has said AI companies do "not have security that would prevent an adversarial country from stealing the models." MI5 chief Ken McCallum said the agency has caught terrorists seeking to exploit AI to improve their reconnaissance and attack methodologies.

Axios reported Friday that executives at Anthropic, OpenAI and other major AI companies are privately preparing for the possibility of a catastrophic AI-related incident.

The letter calls for governments to work toward a more formal oversight regime. Governments would have to agree on who writes the binding standards and who enforces them.