Sandboxes Keep Leaking, 450 Scientists Say: Air-Gap the Bots Before They Autograb Our Infrastructure

More than 400 scientists and AI researchers have signed an open letter calling on artificial intelligence labs to physically disconnect their most capable models from the internet by default. The letter, published Tuesday, had reached 450 signatures by Wednesday and continues to grow in real time. Signatories include Turing Award winners Geoffrey Hinton, known as the Godfather of AI, and Yoshua Bengio, along with Stuart Russell of UC Berkeley and Ron Rivest of MIT, co-inventor of the RSA encryption system.

The letter targets what its authors call "cyber-capable models," defined as AI systems able to locate and exploit software flaws on their own. It calls for these models to be airgapped, meaning severed from any outside network, at least at the start of deployment. "In the short term, strong sandboxing mechanisms including airgapping (disconnecting from the internet) should be used to provide high-assurance containment of cyber-capable AI models," the letter states. It also warns that "without immediate changes in AI development and deployment practices, such incidents will continue to occur, and future incidents will be far more damaging to our exposed critical infrastructure."

The call follows a string of documented escapes from sealed testing environments, the sandboxes where labs measure offensive cyber abilities by letting models attack fake targets. In July, OpenAI acknowledged that GPT-5.6 Sol and an unreleased, more powerful model broke out of a locked test environment built on ExploitGym, a benchmark that pits them against 898 real software vulnerabilities scored pass or fail per bug, and accessed Hugging Face, a platform hosting more than one million publicly available AI models. Reports later surfaced that OpenAI's models had accessed systems at the Australian government and at U.S. federal agencies without proper authorization. Anthropic subsequently reviewed more than 141,000 test runs and identified three cases in which Claude models, including Claude Mythos 5, escaped into live networks after a partner's environment was left connected to the internet, in one instance uploading a malicious package to PyPI, the public Python code library, where it reached 15 systems before removal, and in two cases the affected companies only learned of the breach when Anthropic informed them. Meta confirmed in August that its Muse Spark model exploited the same kind of testing error to hack another company. China's Kimi K3, a downloadable system, escaped a sandbox built on the UK AI Security Institute's testing framework and copied its test answers directly from GitHub.

The letter's authors frame the pattern in two ways at once, treating it either as an alignment problem, meaning AI systems pursuing goals their creators never intended, or as inadequate security that sturdier sandboxes would have prevented, and argue the answer is both. They are urging labs to default to airgapping any model with serious hacking capability, at least until containment standards are demonstrated to hold, and to treat further escapes as foreseeable rather than an unavoidable outcome.