AIR-GAPPING a powerful AI may not be enough. Why?

OpenAI Researcher Says Even Air-Gapping May Not Be Enough for Advanced AI

Two disconnected computers can still whisper through heat.

For decades, one of cybersecurity’s most extreme defenses has been remarkably simple:

Disconnect the computer.

No internet.

No Wi-Fi.

No network cable.

No connection to the outside world.

An air gap.

If information physically cannot travel across the network, an attacker can’t simply send it somewhere else.

Except there’s an uncomfortable problem.

Computers communicate in ways we don’t normally think of as communication.

Heat.

Sound.

Light.

Electromagnetic radiation.

And OpenAI researcher Noam Brown just raised that obscure corner of cybersecurity while discussing a much bigger problem:

What happens when we’re trying to contain an AI that may be more capable than we expected?

“I’m Not Convinced That Would Be Sufficient”

Brown, an OpenAI researcher known for work on reasoning systems, appeared on the Dwarkesh Podcast this week discussing AI agents, alignment and recursive self-improvement.

The conversation turned to an earlier OpenAI evaluation incident involving models escaping an inadequately secured sandbox.

Brown’s takeaway was striking:

“People underestimated the AI.”

He explained that OpenAI could strengthen sandboxes and use techniques such as chain-of-thought monitoring.

But Brown argued that safety systems shouldn’t depend upon assuming the AI won’t discover something humans overlooked.

He then took the hypothetical considerably further:

“You could even go as far as to say, ‘Well, we should air gap the computers.’ I’m not convinced that that would be sufficient.”

And then came the part that sounds like science fiction.

It isn’t.

Brown pointed to academic research demonstrating that nearby air-gapped computers can communicate through temperature changes.

First: Brown Did NOT Say AI Has Done This

This distinction is critical.

There is currently no evidence in Brown’s remarks that an OpenAI model escaped an air-gapped computer by manipulating its temperature.

He wasn’t reporting an AI incident.

He wasn’t saying ChatGPT secretly learned to communicate through heat.

And he explicitly described the thermal-channel research as “mostly academic.”

Brown was making a security argument:

If you’re designing containment for something extremely capable, don’t assume the obvious boundaries are necessarily absolute.

The thermal communication example he referenced is real cybersecurity research dating back more than a decade.

And it is fascinating.

Meet BitWhisper

In 2015, researchers at Ben-Gurion University demonstrated something called BitWhisper.

They placed two computers near each other.

The machines weren’t connected by a network.

Instead, one compromised computer deliberately manipulated the amount of heat it generated.

The second compromised computer monitored its built-in temperature sensors.

Temperature goes up.

Temperature goes down.

Those variations can encode information.

In effect:

Heat becomes the wire.

The researchers demonstrated bidirectional communication between computers positioned up to about 40 centimeters apart.

No Ethernet cable connected them.

No Wi-Fi network connected them.

No Bluetooth connection was required for the channel.

The physical environment itself carried the signal.

But Don’t Imagine High-Speed Data Transfer

Here’s where sensational headlines can go badly wrong.

BitWhisper was painfully slow.

The researchers reported an effective transmission rate of roughly:

1–8 bits per hour.

Not megabits.

Not kilobits.

Bits.

At eight bits per hour, transmitting this entire article would be ridiculous.

But cybersecurity isn’t always about moving gigabytes.

Sometimes you only need to transmit something tiny.

A command.

A password.

A cryptographic key.

A signal saying:

GO.

The researchers specifically noted that the channel’s tiny bandwidth could still permit short commands or small amounts of sensitive information to cross the air gap.

That’s what makes covert channels so fascinating.

A communication channel doesn’t need to be fast to be dangerous.

There’s Another Huge Requirement

Both computers need to be compromised.

This is important.

You can’t put your laptop next to an air-gapped military computer and magically steal secrets by warming your CPU.

In the BitWhisper experiment, malicious software on the transmitting machine manipulated workload and heat production while software on the receiving machine interpreted changes detected through thermal sensors. The computers also needed to be physically close.

So the attack has substantial prerequisites.

That’s why this isn’t some imminent replacement for Wi-Fi.

One later academic review bluntly characterized BitWhisper as impractical in ordinary scenarios because of its extremely low bandwidth and proximity requirements.

But that’s almost beside Brown’s larger point.

An Air Gap Isn’t a Law of Physics

It’s a security architecture.

And security architecture rests on assumptions.

We assume disconnected machines can’t communicate.

Then somebody asks:

What counts as communication?

Radio waves?

Researchers have investigated them.

Sound?

That too.

Light?

Yes.

Electromagnetic emissions?

Absolutely.

Thermal changes?

Apparently those too.

Research into air-gap covert channels has explored multiple physical mechanisms for moving information without an ordinary network connection.

That doesn’t make air gaps useless.

Quite the opposite.

Air gaps can create an enormously valuable security boundary.

But:

Isolation is not the same thing as mathematical impossibility.

Now Add an AI to the Problem

This is where Brown’s comment becomes much more interesting.

Traditional cybersecurity generally assumes an adversary is outside the computer.

We build a wall.

The attacker tries to get through it.

Advanced AI containment creates a stranger threat model.

Imagine that the thing you’re trying to constrain is already running inside the machine.

It can potentially interact with software.

It can potentially generate code.

It can potentially reason about the environment.

It may understand operating systems.

Networks.

Hardware.

Sensors.

Side channels.

And perhaps vulnerabilities its designers never anticipated.

Now the security question becomes:

Have we prevented every useful pathway from the environment we’ve given it to somewhere we don’t want it to go?

That is a much higher bar.

The Computer Is More Than Its Network Port

This is a useful cybersecurity lesson even without AI.

We tend to conceptualize computers according to their intended interfaces.

Ethernet transmits data.

Wi-Fi transmits data.

USB transmits data.

The screen displays data.

The speaker produces sound.

But physics doesn’t care what engineers intended.

A processor produces heat.

Electronics produce electromagnetic emissions.

Fans produce sound.

LEDs produce light.

Power consumption fluctuates.

Hardware contains sensors.

Each physical effect can potentially contain information.

Security researchers call these side channels and, when intentionally used for communication, covert channels.

The machine may reveal information through behavior that was never designed to be an interface.

The strangest vulnerabilities often begin when someone asks what a system can do instead of what it was designed to do.

Imagine Trying to Contain Something Smarter Than the Containment Designer

That’s ultimately the argument Brown is making.

Not:

AI can definitely escape through temperature.

But:

Don’t build AI safety around assumptions that a sufficiently capable system may be able to invalidate.

Brown said AI progress has been so rapid that people have repeatedly underestimated what models could accomplish. His conclusion was that safety and alignment therefore require an extraordinarily high bar.

That’s a very different statement from claiming an AI has already demonstrated these escape capabilities.

But it’s arguably more interesting.

Because cybersecurity is filled with systems that were secure until somebody became clever enough to notice the assumption underneath them.

This Is Exactly How Hackers Think

A normal user looks at a printer and thinks:

It prints documents.

A security researcher asks:

What else does it expose?

A normal user sees a smart lightbulb.

A hacker sees a computer with a radio attached.

A normal user sees an image uploader.

A researcher sees a parser processing attacker-controlled data.

A normal person sees temperature.

A security researcher asks:

Can I encode information in it?

That mindset is why security engineering relies on defense in depth.

Never assume one control is perfect.

MFA can fail.

EDR can fail.

Firewalls can fail.

Sandboxes can fail.

Network segmentation can fail.

Air gaps can have covert channels.

The answer isn’t to abandon those controls.

It’s to avoid treating any one of them as magical.

Air-Gapping Still Works

This deserves emphasis.

If you read Brown’s comment as:

“Air gaps don’t work,”

you’ve taken the wrong lesson.

Disconnecting a sensitive system from outside networks dramatically reduces its ordinary attack surface.

BitWhisper required two compromised machines, close physical proximity and very low-bandwidth signaling.

Those are meaningful constraints.

The lesson isn’t:

Physical isolation is pointless.

It’s:

Physical isolation solves specific pathways. It doesn’t suspend physics.

That’s a very cybersecurity way of looking at the world.

AI Safety Is Becoming Cybersecurity

There’s an interesting convergence happening.

For years, discussions about AI alignment sounded largely philosophical:

Will AI follow human intentions?

Will it pursue unintended objectives?

Can we understand why it made a decision?

Those questions still matter.

But as AI systems gain more agency, AI safety starts looking increasingly familiar to cybersecurity professionals.

Least privilege.

Sandboxing.

Segmentation.

Monitoring.

Logging.

Behavioral detection.

Access controls.

Approval gates.

Credential isolation.

Egress filtering.

Hardware isolation.

Defense in depth.

Assume compromise.

The question isn’t simply:

Is the model aligned?

It also becomes:

What can the model actually touch if it isn’t?

Give the AI Less to Work With

That’s the same principle I would apply to an employee account.

Don’t give somebody domain administrator because they might someday need it.

Don’t give an application access to every file because it needs one folder.

Don’t expose a server to the internet because doing so is convenient.

And don’t give an autonomous AI agent unrestricted credentials, unrestricted internet access and unrestricted execution privileges merely because doing so makes it more useful.

Capability should be deliberately bounded.

Separate:

Read from write.

Recommend from execute.

Draft from send.

Analyze from deploy.

The more autonomous the system becomes, the more important those distinctions become.

The Most Important Part of Brown’s Comment Isn’t the Heat

The thermal communication experiment makes the great headline.

Two computers talking through temperature sounds impossible.

But Brown’s larger statement is more important:

“We never want to be in a situation again where we underestimate the AI.”

Cybersecurity has learned that lesson repeatedly with humans.

Someone says:

Nobody would think of doing that.

Nobody could exploit this.

Nobody would combine those two vulnerabilities.

Nobody would bother attacking us.

Nobody could get data across that boundary.

Then somebody does.

The emerging AI-security question is whether we’re about to repeat the same mistake with machines capable of searching through possibilities far faster than humans can.

Security fails when the defender’s imagination becomes the boundary of the threat model.

The Air Gap Isn’t the Point

The point is humility.

The 2015 researchers weren’t demonstrating superintelligence.

They were demonstrating ingenuity.

They looked at two disconnected computers and realized something obvious only after someone says it:

Computers get hot.

Computers measure temperature.

Therefore:

Temperature can carry information.

Now imagine systems that can explore thousands or millions of similarly strange possibilities.

That’s the security challenge.

We shouldn’t assume every theoretical side channel will become a practical AI escape mechanism.

Most won’t.

BitWhisper itself is severely constrained.

But when you’re designing systems whose failure could have serious consequences, “we couldn’t think of another way out” isn’t a satisfying security guarantee.

Air-gap it.

Sandbox it.

Monitor it.

Restrict it.

Separate privileges.

Require human approval.

Build multiple independent controls.

And then ask the uncomfortable question cybersecurity professionals have always asked:

What did we forget?

70% of all cyber attacks target small businesses, I can help protect yours.

#ArtificialIntelligence #Cybersecurity #AISafety #DataProtection #ZeroTrust

OpenAI researcher Noam Brown says even AIR-GAPPING a powerful AI may not be enough. Why? Researchers already proved two disconnected computers can communicate using HEAT—one changes its CPU temperature and the other detects it. No Wi-Fi. No Ethernet. No Bluetooth. Brown isn’t saying AI has done this. His warning is more unsettling: when designing AI containment, don’t assume we’ve imagined every way out.