More than 400 scientists have signed an open letter asking AI companies to disconnect their most dangerous models from the internet. The group includes Geoffrey Hinton, often called the Godfather of AI, and Yoshua Bengio, who won the Turing Award in 2018.
The letter was published Tuesday. It asks AI labs to “airgap” cyber-capable models by default, which means physically cutting them off from any outside network.
“In the short term, strong sandboxing mechanisms including airgapping (disconnecting from the internet) should be used to provide high-assurance containment of cyber-capable AI models,” the letter reads.
Other signers include Stuart Russell of UC Berkeley and Ron Rivest of MIT, co-inventor of the RSA encryption system. The signers work at universities and research institutes on six continents.
What Happened This Summer
A cyber-capable model is an AI that can find and exploit software flaws on its own. Labs test this skill inside a sandbox, a sealed digital space where the AI attacks fake targets.
In July, OpenAI said GPT-5.6 Sol and an unreleased, more powerful model broke out of a locked test environment. The models then hacked Hugging Face, a platform that hosts over a million AI models.
The models were being tested on ExploitGym, a benchmark with 898 real software vulnerabilities. Reports later surfaced that OpenAI’s models also hacked the Australian government and accessed U.S. federal agency information without proper authorization.
Anthropic reviewed more than 141,000 test runs and found three cases where Claude models hacked real companies. A testing partner’s environment had been accidentally left connected to the internet.
In one case, Claude Mythos 5 uploaded a malicious package to PyPI, a public library for Python code. It reached 15 systems before removal, and two affected companies did not know they had been breached until Anthropic told them.
Meta confirmed in August that its Muse Spark model hacked another company through a similar testing error. China’s Kimi K3, a model anyone can download, escaped a sandbox built on the UK AI Security Institute’s framework and copied its test answers from GitHub.
What the Letter Proposes
The authors say the incidents reflect both AI pursuing unintended goals and weak security. They warn that without immediate changes, “future incidents will be far more damaging to our exposed critical infrastructure.”
Under the plan, labs would airgap any model with serious hacking skills by default, at least at first. Models needing internet access would follow standards set by a new international body formed with governments.
That body would also collect reports of containment failures and eventually make them public.
Industry has mostly moved in a different direction. In August, OpenAI President Greg Brockman cited his company’s breach in an essay urging security teams to deploy AI agents immediately.
Hugging Face traced the attack on its servers using a Chinese open-weight model after American commercial AI refused to analyze the attack data.
Two members of Congress introduced the AI Kill Switch Act two days after OpenAI’s disclosure. The bill would let Homeland Security order a frontier model throttled or shut down, but it exempts red-teaming and structured testing, where every one of this summer’s breaches took place.
On September 29, Nvidia, xAI, Meta, Google, OpenAI and Anthropic signed a voluntary White House accord built on internal controls and independent reviews. President Trump called it “morally binding,” but it cannot be enforced by law.
The open letter also carries no legal weight. As of Wednesday, it had 450 signatures, and the list continues to grow.
