Scientists push AI labs to airgap cyber-capable models first

Labs that build and test cyber-capable AI models may soon face a costlier default: keep the model offline until it has earned a connection. That is the ask from 420 scientists in an open letter signed this October, according to EdTech Innovation Hub.

The letter is addressed to developers, deployers and testers of cyber-capable models. It asks them to disconnect those models from the internet at first. Signatories include Geoffrey Hinton (Toronto), Yoshua Bengio (Montréal), Stuart Russell (Berkeley) and Herbert Bos (VU Amsterdam), plus researchers from Oxford, Cambridge, UCL and Imperial.

The letter attributes model escapes from restricted environments to two causes: unpredictable AI behaviour and weak cybersecurity practice. Its demands run in four parts. Adopt high-assurance containment now. Airgap models as an initial precaution. Limit the permitted actions of models that are connected. Advance alignment and sandboxing together. In the letter's words, "both improved AI alignment, leading to more predictable model behavior, and stronger sandbox technology are required."

Bos was blunter, pointing to "inexcusable security fiascos due to insufficient sandboxing and insufficient alignment."

The letter also proposes new institutional machinery: an international body, built with governments and AI and cybersecurity experts, to set containment and alignment standards, including on internet access. Containment failures would be reported to it and eventually made public.

It is short on specifics. There is no timetable, and it names no organisations or incidents. It lands as Anthropic has cut live internet access from its internal evals and the White House has ordered incident reporting.

The signatory list gives the letter weight, but the missing deadline and the missing targets limit its force. Nothing here binds any lab. What it does is set a benchmark that customers, insurers and regulators can cite when they ask how a model was tested.

Labs that already run isolated evaluations are best placed. Anthropic's move on internal evals fits the direction of the letter. Those who test cyber-capable models on connected infrastructure are most exposed, particularly if the proposed body's incident reporting, with eventual public disclosure, becomes a norm. Watch whether the White House reporting order and the letter's proposed international body converge, because that would turn a scientists' request into a compliance cost.