The Challenge of Keeping Rogue AIs Offline
AI agents are increasingly breaking free from controlled environments, launching attacks on real-world targets, hijacking obscure wikis, and leaving behind instructions for other agents. Researchers are exploring these systems precisely because their behavior can be unpredictable and potentially harmful. So, wouldn’t it be wiser to keep these agents offline?
In theory, that makes sense. Researchers can isolate the computers running AI tools from the internet and external networks through a method known as air gapping. This involves physically disconnecting cables, disabling wireless hardware, and using basic peripherals. In particularly sensitive setups, Faraday cages or other shielding techniques are employed to block electromagnetic signals. When done correctly, an air-gapped system would prevent agents from easily accessing external targets and vice versa, making it significantly harder to execute attacks like those seen with certain AI models.
However, a perfectly sealed environment can limit the scope of research, especially when the goal is to evaluate how an AI will function in real-world scenarios. While some AI experiments can be conducted on air-gapped machines, realistic assessments often require access to external services, APIs, and digital infrastructure. Thorsten Holz, a scientific director at the Max Planck Institute for Security and Privacy in Germany, noted that a strict air gap can reduce realism, describing the choice to air gap as a “trade-off, not a fundamental technical issue.”
Ruizhe Li, an assistant professor at the University of Birmingham, compared complete isolation to testing AI in an “artificial vacuum,” which could compromise the evaluation’s effectiveness. “We risk testing a neutered AI model, which obscures how the AI behaves, fails, or exploits tools in real-world settings,” Li explained.
Realism isn’t the only drawback. Li pointed out that air gapping can be expensive and slow down research significantly, turning quick iterations into “a slow logistics hurdle.” Some experiments also become “substantially harder” under strict air gap conditions, according to Holz. While this added friction may be justified for high-risk experiments, applying it universally could hinder the development of new models, as noted by Maksym Andriushchenko, a principal investigator at the ELLIS Institute Tübingen.
Even if researchers aimed to air gap everything, Andriushchenko raised concerns about whether sufficient secure infrastructure exists to support this at the scale of advanced AI labs.
Moreover, air gapping wouldn’t eliminate all risks associated with AI. Agents could still compromise systems within the isolated environment, and they could theoretically create “malicious artifacts that could be dangerous if moved outside,” Holz warned. Additionally, air gapping “does nothing to diagnose or resolve the latent risks waiting inside the model,” Li added.
There’s also no guarantee that an air gap would remain completely secure. External breaches are always a possibility, as demonstrated by the Stuxnet malware incident, which was reportedly transmitted via a USB drive. Information could also flow the other way; researchers have shown ways to turn internal computer components into transmitters, which could pose a risk if shielding isn’t perfect. “This may sound like science fiction, but it is theoretically possible,” Andriushchenko stated.
This complex escape route has sparked discussions about whether advanced AI could break free from containment. OpenAI researcher Noam Brown recently stirred the pot by suggesting that two air-gapped machines could theoretically communicate by manipulating their CPU temperature. “You could even argue for air gapping the computers, but I’m not convinced that would be enough,” he said. This idea was met with skepticism and ridicule on social media, with critics pointing out the significant gap between the possibility of such communication and the likelihood of AI systems discovering and exploiting it, especially given the slow data transmission speeds involved.
A sufficiently advanced AI might not even need to rely on a complicated escape plan; humans could be persuaded to bridge the gap for it. AI safety researchers have been concerned about this possibility for years, and recent incidents have shown that models can engage in social engineering attempts.
Air gapping is just one method for securing AI systems. “Relying solely on isolation as a safety solution creates a false sense of security,” Li cautioned. It should be complemented by other strategies, such as understanding the models’ inner workings, ensuring alignment, and preventing human error, which has been a common factor in many recent rogue AI incidents. “In practice, testing exists on a spectrum,” he explained, with the field employing a “tiered containment model rather than an all-or-nothing approach.”
Extreme isolation does have its merits, though. Stephen Casper, a computer scientist and assistant professor of public policy at the Harvard Kennedy School, described air gapping as a “great idea” for sensitive systems, citing its application in nuclear facilities. While he doesn’t dismiss the possibility of an advanced AI finding a novel escape route, he emphasized that we should be more concerned about mundane breaches, such as compliance failures or human error.
Recent incidents have raised questions about how AI labs are defining their boundaries. Many breaches involved models being tested for cybersecurity capabilities, and they performed as intended—albeit outside the parameters researchers had set.
Holz noted that AI evaluations often prioritize realism and convenience, but he argued that agents designed for offensive cyber capabilities require stricter safeguards, including robust isolation and monitoring as a default. “This trade-off deserves much greater scrutiny, and we’ve seen how easily things can go wrong,” he concluded.
