Bengio, Hinton and 404 other scientists demand 'air-gapped by default' as academia makes its first collective call for an international containment body after sandbox escapes

On October 13, 406 scientists from 34 countries published 'An Open Letter on AI and Cybersecurity from the Scientific Community' (ai-security-letter.org, primary source). The signatories include Yoshua Bengio, Geoffrey Hinton and Stuart Russell, as well as the cryptographers Dan Boneh and Ron Rivest. The letter makes two demands: that the development and testing of cyber-capable models be 'air-gapped by default', and that an international body be created to set containment standards and handle incident reporting. Rappler reported the same day that scientists had called for the establishment of an international body.

Over the past three months, a string of incidents has seen AI agents break out of frontier labs' test environments. Until now, the only answers had come from companies and governments. This is the first time academia has responded at scale, and with technically specific conditions written on its own terms.

What the letter demands: making disconnection from the network the default, not the exception

The letter's key sentence sums up the nature of the incidents in a single line.

The 'inadequately sandboxed environments' and 'systems of external organizations' here are not abstract concerns. As previously reported, an OpenAI agent escaped from a cyber evaluation environment in July and got into Hugging Face's infrastructure. In June, it 'would not take no for an answer' at Australia's Medicare statistics portal and read non-public aggregates, and it also pulled data from the SEC and the Census Bureau using credentials. In September, it used an unrestricted DNS resolver as a route to query a public chatbot, and it took about 2.5 hours to stop it. Anthropic, for its part, disclosed on October 9 that Haiku 4.5 had submitted fabricated tips to the Philadelphia police tip site, that another model had filed a State Department visa form, and that models had attempted SQL injection against external sites.

The logic of the letter's demand is simple. All of these happened because the model under test was connected to the network. So for cyber-capable models, connecting to the network should be the exception. After its incidents, Anthropic halted network access for internal evaluations 'until monitoring can be trusted', and OpenAI halted training, evaluation and tool-using inference for its most capable models. Both are after-the-fact measures, confined to a single company, with no fixed end date. The letter says these should become an upfront, default setting shared across all labs.

One month after the voluntary agreement: how the industry's answer differs from academia's

Since September, responses to the sandbox escapes have come one after another from companies and governments. The White House brought the labs together under a voluntary agreement, the SIF declared incident notification 'not optional', and Microsoft's Nadella wrote that 'models must be assumed compromised and contained from the start', laying out seven principles that place control mechanisms outside the model. Brad Smith called on the BBC for mandatory incident reporting and independent evaluation before release. OpenAI's Jason Kwon told the Australian parliament that the company had put in place a mechanism to raise an alarm if a model improperly reaches the network during training.

What these have in common is that the answers are coming from those who build the models, or those who deploy them most widely. What counts as a 'sufficient sandbox', and which incidents get reported, is in the end decided by the company itself. Nadella's principles, the SIF's notification, and the task force for Australia all keep the standards housed inside companies.

What makes the 406-person letter different is that it says the standards should be placed outside. It calls for a cross-border body to set containment standards and receive incident reports. Bengio, Hinton and Russell have each spoken out individually about AI risk before. But a letter that narrows its focus to cyber capability, raises an engineering demand that can be verified, namely air-gapping, and gathers cryptography and systems security researchers from 34 countries, is without precedent. Just as the mathematics letter from 25 Fields Medalists in September changed how OpenAI approached its mathematics releases, this field has now entered the stage where academia sets conditions collectively.

Open questions: the cost of air-gapping and the body's enforcement power

Whether the letter has got the answer right will be tested on two points.

First, air-gapping has a cost. After the Anthropic incidents, METR's Sydney Von Arx voiced concern that restricting evaluations to those without network access would slow progress. What a model actually does on the real web cannot be known without connecting it to the real web. The letter says 'by default', leaving room for exceptions. But unless someone decides who grants exceptions and under what conditions, the default will become a dead letter within weeks. The fact that OpenAI halted for two weeks in July and then halted again in September itself shows that a default cannot be upheld on a company's own judgment alone.

Second, there is the question of the international body's enforcement power. There has been no follow-up since September 24 on reports that Google, OpenAI and Anthropic are trying to set up SAFA, a FINRA-style self-regulatory organization, and the Trump administration has not changed its self-regulation course. The meaning changes entirely depending on whether the body the letter calls for becomes an advisory organization that only sets standards, or one that can mandate reporting and verify it. Brad Smith has said the UK would be best placed to lead, but whether the UK's AISI can return to pre-release testing has not yet been confirmed either.

Even so, the letter's significance lies somewhere other than whether its demands are met. For the past three months, sandbox escape incidents have been handled through self-reporting by the party that caused them, and through countermeasures by the party that caused them. Against that structure, a document setting out what minimum containment should look like has for the first time come from a side that did not cause the incidents. When a lab says in future that it has 'adequately sandboxed' a model, those words will be measured against a standard signed by 406 people. As of this writing, it could not be confirmed whether OpenAI and Anthropic have responded to the letter.