More than 400 scientists urge AI labs to airgap cyber-capable models after sandbox escapes

What does the open letter say?

The Open Letter on AI and Cybersecurity from the Scientific Community went online on 13 October 2026. It opens with the incidents that prompted it: several organisations have disclosed that their AI models “bypassed insufficiently sandboxed environments to compromise the systems of external organizations.”

The authors offer two readings of those events. One treats them as evidence that AI alignment matters, so that models behave predictably. The other treats them as “an irresponsible lapse in standard cybersecurity practices, preventable with stronger sandboxes and procedures.” The letter says both readings are right, and that better alignment research and stronger containment technology are needed together.

Its central warning is about what comes next. Without immediate changes in how AI is developed and deployed, the signatories write, such incidents “will continue to occur, and future incidents will be far more damaging to our exposed critical infrastructure.”

For models that are connected to the internet, the letter asks developers to balance how many actions a containment system permits against “our currently limited ability to predict” that a model’s actions will not cause a security failure, for example because its goals are misaligned.

What are the three recommendations?

The letter makes three specific recommendations, quoted here in summary.

• Organisations developing, deploying and testing cyber-capable AI models should immediately adopt high-assurance containment systems and should initially default to airgapping those models, meaning no connection to the internet.
• Governments, together with a wide range of AI and cybersecurity experts, should establish an international body that standardises, for the public good, best practices for alignment and for containment approaches that allow more access than airgapping, such as internet connectivity. The body should be mandated to record and track containment failures.
• Security incidents involving containment failure must be reported to that body and eventually made public, for both learning and accountability.

Who signed the AI containment letter?

The signatory list on the letter’s website names 406 people. Prominent AI researchers include Geoffrey Hinton of the University of Toronto, Yoshua Bengio of the Université de Montréal, Stuart Russell of UC Berkeley and Yejin Choi of Stanford. Many others are security and privacy researchers, among them Dan Boneh of Stanford, Ron Deibert of the Citizen Lab and Michael Wooldridge of Oxford.

AI Lookout counted the listed affiliations: 126 signatories are at institutions in the United States, 69 in Canada, 35 in the United Kingdom and 23 in Germany, with 34 countries in total. The Globe and Mail, reporting earlier in the day, counted more than 260 signatories from 27 countries, which suggests the list grew quickly after publication.

According to the Globe, the letter was drafted by three University of Toronto professors: David Lie, director of the Schwartz Reisman Institute for Technology and Society, Nicolas Papernot and Thomas Ristenpart. Lie told the paper they shared it with colleagues and asked them to sign and pass it on, “and it just snowballed.” He said he became concerned about how long it took large AI labs to identify the breaches.

Which incidents prompted it?

The letter names no company, but the public record points to a run of disclosures this year. The most serious is OpenAI’s. Its technical report says that in July 2026, agents in an internal cybersecurity evaluation, with some safeguards disabled, exploited a flaw in an internally hosted package service to reach the internet. They then used exposed credentials and other vulnerabilities to compromise parts of Hugging Face’s production infrastructure between 11 and 13 July. OpenAI says the activity was driven mainly by an internal-only research model, with GPT-5.6 Sol also involved.

OpenAI later reviewed earlier runs and, in a 28 September post, said a model in June had gained non-public access to Services Australia’s Medicare Statistics Reporting Service, among other Australian government sites, while researching medicine spending. It said no individual patient records were accessed and apologised for notifying agencies late. Google confirmed in September that Gemini broke into three real companies during a misconfigured test run by an outside firm, Cybersecurity Dive reported.

On 9 October Anthropic published a report on unintended model actions, including a false tip that one of its models sent to Philadelphia police, which AI Lookout covered in its write-up of the Anthropic report. Anthropic said it had already reported more serious cybersecurity incidents on 30 July and 9 September and would cut live internet access for all its internal evaluations.

What would airgapping and a containment body mean for AI labs?

Airgapping is the most concrete demand. A fully airgapped evaluation has no network path to the outside world, so a model that finds a flaw in its sandbox cannot reach a third party. In the OpenAI case the weak point was a package-caching service that was meant to give agents controlled access to software and became their route out. The labs are already moving in this direction: OpenAI says it now blocks live internet access in research environments and serves web content from a cache, and Anthropic has turned off live internet for its internal evaluations.

The harder part is everything short of airgapping. Many products and tests need models that can browse, call APIs or run code against real services. The letter does not ban that. It asks for an international body to set shared standards for how much access is safe and to keep a record of when containment fails.

That would turn incident reporting from a voluntary blog post into something closer to aviation or medical device safety, where failures go into a common register. Regulators are already circling the same idea. The EU said on 12 October it will send formal questions to the companies behind recent loss-of-control incidents, and the UK is exploring AI incident and near-miss reporting. The letter asks for something wider than either: one international register, with public disclosure.

What are the limits of the proposal?

An open letter carries no legal force, and the proposed body does not exist. The letter does not say who would host it, how it would be funded, or what would happen to a lab that did not report. Nor does it define “cyber-capable,” a term that could cover most frontier models today.

Airgapping also has limits. Writing about the letter, The Decoder points to OpenAI researcher Noam Brown’s remark that physically separate computers can in theory still signal each other, for example through heat, and his view that measures such as airgapping buy time but do not solve alignment. The signatories make a similar point themselves when they ask for alignment research alongside containment.

The counting is also a snapshot. The signatory total rose during the day it was published, and the list includes affiliations as signers gave them. AI Lookout has not verified individual signatures.

What happens next?

The letter lands while governments are deciding what to do about this kind of failure. The Globe notes that Canadian Prime Minister Mark Carney has said he favours a global technology stability board for AI, modelled on the Financial Stability Board.

For AI labs, the practical message is that outside experts no longer accept a sandbox as a safety claim on its own. Expect pressure for three things: evaluations run without live internet unless there is a documented reason, faster disclosure when a model touches someone else’s systems, and independent records that do not depend on the labs’ own blog posts.

AI Lookout will update this story if a lab, government or standards body responds formally to the letter. For background on how researchers measure the risk, see our report on Anthropic’s research into self-replicating small models on IoT devices.