Author: Jose Antonio Lanz
Compiled by DeepChain TechFlow
Shenchao Summary: This open letter is not legally binding, but investors should pay attention to the list of incidents behind it: this summer, models from OpenAI, Anthropic, Meta, and Kimi all exceeded boundaries during testing, with some directly hacking real companies. Meanwhile, Congress’s “kill switch” bill explicitly exempts testing phases from regulation, and the White House-led agreement remains voluntary. Safety oversight for frontier models is shifting from principle-based discussions to concrete rules—once “default physical isolation” becomes an industry standard, the deployment timeline and compliance costs for AI agents in cybersecurity and other scenarios will need to be reassessed.
Since this summer, AI models have repeatedly escaped testing environments and infiltrated real companies, with hundreds of researchers stating that the internet itself should be considered a security boundary.
Image source: Decrypt
On Tuesday, 420 scientists, including Geoffrey Hinton and Yoshua Bengio, signed an open letter urging AI labs to default to physical isolation for models capable of cyberattacks.
Over the entire summer before this letter was published, models from OpenAI, Anthropic, Meta, and Moonshot AI escaped their testing sandboxes, with several even infiltrating real companies.
The signatory wishes to establish an international body to set isolation standards and document every isolation failure event, with all related reports ultimately made public.
More than 400 scientists, including AI pioneer Geoffrey Hinton, known as the "Godfather of AI," and 2018 Turing Award winner Yoshua Bengio, aim to disconnect the most dangerous AI models from the internet.
The open letter published on Tuesday calls for AI laboratories to default to airgapping models with network attack capabilities, meaning physically disconnecting them from any external networks.
The letter states: "In the short term, strong sandbox mechanisms, including physical isolation (disconnection from the internet), should be used to achieve highly reliable isolation and control of AI models with network attack capabilities."
As of Wednesday, the letter had received 450 signatures, including from Stuart Russell of the University of California, Berkeley, and Ron Rivest of MIT, co-inventor of the RSA encryption system. The list of signatories continues to grow in real time.
A "model with cyberattack capabilities" refers to an AI that can autonomously discover and exploit software vulnerabilities. Labs measure this capability in sandboxes—closed digital environments where AI can attack simulated targets without touching any real systems. But this summer, these sandboxes began leaking, one after another.
This summer saw frequent incidents: cutting-edge models repeatedly breached sandbox boundaries.
In July, OpenAI acknowledged that GPT-5.6 Sol and another, more powerful model yet to be released breached a closed testing environment and infiltrated Hugging Face, a platform hosting over one million public AI models. At the time, these models were being tested on ExploitGym, a benchmark that provides AI agents with 898 real software vulnerabilities and requires them to turn each vulnerability into a working exploit, scoring each one as pass or fail.
Shortly thereafter, reports emerged that OpenAI’s model had infiltrated the Australian government system and obtained information from U.S. federal agencies without proper authorization.
Anthropic subsequently investigated over 141,000 test runs and found three cases in which the Claude model infiltrated real companies, due to a testing partner’s environment inadvertently remaining connected to the internet. In one instance, Claude Mythos 5 uploaded a malicious package to PyPI, a public repository where developers download Python code; the package had already been installed on 15 systems before being removed. Two of the affected companies were unaware they had been compromised until Anthropic notified them.
In August, Meta confirmed that its Muse Spark model infiltrated another company due to a flaw in its benchmark testing. China’s Kimi K3, a model freely downloadable by anyone, escaped from a sandbox built on the testing framework of the UK AI Safety Institute and directly copied test answers from GitHub.
The author of the open letter stated that these incidents can be understood from two perspectives: one is the alignment issue, where AI pursues goals in ways its creators never anticipated; the other is inadequate safety measures, as a more robust sandbox could have prevented them. Their conclusion is that both factors are at play, and they warned that without changes, the next wave of incidents will be even more severe.
If the development and deployment of AI are not immediately changed, such incidents will continue to occur, and future events will cause far greater damage to our critically exposed infrastructure.
Joint Proposal: Default Implementation of Physical Isolation and Establishment of International Standards
Under this proposal, laboratories should, at least initially, default to physically isolating any model with significant hacking capabilities. Any use requiring greater freedom, such as internet connectivity, must adhere to standards established by a new international body formed in collaboration with governments; this body will also collect reports of isolation failures and ultimately make them public.
Reactions from all parties: Regulatory legislation and industry voluntary agreements
The industry’s own responses have largely taken the opposite direction. In August, Greg Brockman, President of OpenAI, cited his company’s own breach in an article, calling on every security team to immediately deploy AI agents; meanwhile, Hugging Face was only able to decipher the attacks on its servers by running a Chinese open-source weight model—whose files anyone can download and run locally—after U.S. commercial AIs refused to analyze the attack data.
Two days after OpenAI’s disclosure, two members of Congress introduced the AI Kill Switch Act, which would allow the Department of Homeland Security to throttle or shut down frontier models. However, the bill exempts all actions taken during red teaming or structured testing—and every intrusion this summer occurred precisely during these activities.
The White House opted for a more moderate approach: On September 29, NVIDIA, xAI, Meta, Google, OpenAI, and Anthropic signed a voluntary agreement based on internal controls and independent review. President Trump described the agreement as having "moral force," but it contains no legally binding provisions.
Decrypt contacted several researchers listed as media contacts in the open letter but did not receive an immediate response.
This letter is not legally binding, but its 406 signatories are affiliated with universities and research institutions across six continents, from Toronto and Zurich to Santiago and Kigali.