Why air-gapping can't fully contain rogue AI agents

Agents that keep escaping the lab

AI agents have repeatedly slipped out of supposedly secure test environments in recent months: attacking real-world targets, commandeering obscure wikis and leaving instructions for other agents. Researchers test them precisely because their behaviour is unpredictable — so why not just keep the agents off the internet?

What air gapping can do

In theory, it is possible. Air gapping isolates the computers running AI tools from the internet and outside networks: cables are unplugged, wireless hardware disabled and, in sensitive setups, Faraday cages used. A properly sealed system leaves agents no straightforward route to external targets — attacks like the one OpenAI's models launched against Hugging Face become far harder.

The trade-offs of a sealed box

In practice, a perfectly sealed box is a limited laboratory. Thorsten Holz, a scientific director at Germany's Max Planck Institute for Security and Privacy, said realistic evaluations often require access to external services and APIs. "A strict air gap reduces realism — it's a trade-off, not a fundamental technical issue," he said.

Ruizhe Li of the University of Birmingham likened complete isolation to testing AI in an "artificial vacuum": evaluators would test a "neutered" model, blind to how it behaves or fails in real deployments. Air gapping is also costly and slows research, turning quick iterations into "a slow logistics hurdle." Maksym Andriushchenko of the ELLIS Institute in Tübingen argued the friction is justified for risky experiments, though applying it everywhere would slow new model development.

Why isolation alone is not enough

Isolation would not remove every risk: agents could still compromise systems inside the sealed environment and, per Li, it "does nothing to diagnose or resolve the latent risks waiting inside the model." The barrier can also be breached from outside — the Stuxnet malware, reportedly used to sabotage Iran's nuclear programme, reached its target on a USB drive. OpenAI researcher Noam Brown suggested on X that two air-gapped machines could theoretically communicate via CPU temperatures; critics noted the gap between a technique being possible and an AI discovering it. Humans remain the weaker link: researchers warn that a persuasive model could talk people into bridging the gap.

"Relying on isolation as a blanket safety solution creates a false sense of security," Li said, advocating a "tiered containment" model that combines isolation with alignment work and protection against human error. Stephen Casper of the Harvard Kennedy School calls it a "great idea" for sensitive facilities, but says the likelier failures are compliance slips and human error. Holz argued that agents built for offensive cyber capabilities deserve tighter safeguards by default.