Security community pushes back on claims that AI can bridge air gaps via CPU heat

Around September 18, a wave of security researchers and technologists responded to claims that AI could covertly communicate across air-gapped machines via CPU heat. The emerging consensus: do not assume superintelligent AI is exempt from physical law, and distinguish between theoretically possible and practically useful. The debate began when OpenAI's Noam Brown suggested two air-gapped machines could communicate through CPU heating and temperature shifts, arguing alignment must clear a very high bar; a16z's Martin Casado countered that covert channels are an old problem, not a new threat, and that appealing to future AI capability gets harder when abstract narratives collide with real system constraints.

Confirmed

• Halvar Flake (Thomas Dullien) urged people to first estimate the bits-per-minute such a channel could carry, stressing that AI remains bound by thermodynamics, information acquisition costs, noisy channels and measurement error; he did not deny side channels exist, only that useful ones yielding significant capability are another matter.
• BlancheMinerva calculated that the thermal channel in the cited BitWhisper paper runs at 0.002 bits per second, with real-world throughput orders of magnitude lower; exfiltration would need under 10GB per week even with the best covert channels plus specialized sensor hardware. She argued that nonzero information exchange does not mean a model can bypass an air-gapped network as it would a weak sandbox, and debated Casado on inter-model collusion, noting such collusion almost certainly requires two-way communication that covert channel bandwidth cannot support.
• basedjensen argued data transmission requires both sides to pre-agree on medium, encoding, protocol and error correction—bits do not magically move from A to B. doomslide (via basedjensen) rebutted weight-exfiltration claims: exfiltrating trillion-plus-parameter weights at under 1 byte per hour is unrealistic; better to build a working sandbox. tszzl countered that thermal attacks could still start an attack chain (e.g., leaking a key), and noted weight self-exfiltration is only feasible for models inside the lab; the real worry is arbitrary communication undermining other safety guarantees.
• xlr8harder questioned the collusion threat model itself: either both systems are isolated and can only exchange slow messages, or a malicious external system already exists and isolation is moot.
• Gary Marcus relayed deedydas's point that thermal communication between air-gapped PCs is real but impractically slow (bits per hour), with faster documented side channels like DRAM-based ones being the real threat; Romeo Lupascu (relayed by Marcus) explained that properly designed air gaps—meters apart, no heat sensors—preclude thermal, EM and power side channels.
• vishalmisra, a networking and security veteran, called the 1–8 bits-per-hour air-gap breach claim absurd within his own domain; Mallchad fired back that it was a 60-second interview clip and that air gaps have been broken in many other ways.
• A viewpoint relayed by BlancheMinerva added an introspective note: AI side-channel attacks are real but their theoretical maximum rates are far too low for weight theft or practical hacking, and the community's intense focus on them exposes a chronic problem of misplaced priorities in AI safety.

Why it matters

• The debate cuts to the core methodology of AI safety evaluation: risk should be assessed against physical and information-theoretic channel capacity, not against assumptions that superintelligence bypasses physics.
• Critics do not deny side channels exist; they argue for separating feasibility from utility, avoiding inflated threat narratives while not ignoring faster documented side-channel techniques.
• The discussion also laid bare public splits between AI safety hardliners, security veterans and investors, with potential implications for how future AI safety evaluation standards are set.

2026-09-18 ~ 2026-09-19 · 29 related posts

Full story(8 episodes)→

• Episode 1: Noam Brown: Recursive Self-Improvement Is OpenAI's Top Priority(2026-09-15, 6 posts)
• Episode 2: Noam Brown on Dwarkesh: 10,000-Agent Cluster Solves Navier-Stokes as AI Outpaces Predictions(2026-09-18, 11 posts)
• Episode 3: OpenAI's Noam Brown Claims Air-Gapping Won't Stop Rogue AI, Sparking Heated Debate(2026-09-18, 53 posts)
• Episode 4: tszzl: Multiply Your Estimate of Containing Superintelligence by Ten(2026-09-18, 5 posts)
• Episode 5: Security community pushes back on claims that AI can bridge air gaps via CPU heat(2026-09-18, 29 posts)
• Episode 6: Noam Brown Clarifies Out-of-Context Podcast Clip(2026-09-19, 2 posts)
• Episode 7: Noam Brown Interview: OpenAI's Top Goal Is Recursive Self-Improvement(2026-09-19, 4 posts)
• Episode 8: Noam Brown Warns Air-Gapping Won't Contain AI(2026-09-20, 2 posts)

• whurley cites BitWhisper paper to debunk Noam Brown's air-gap attack fearmongering — whurley · 2026-09-18
• Martin Casado: Covert-Channel Debate Shows What Happens When Safetyism Meets Real Systems — nptacek · 2026-09-18
• Gary Marcus jumps into Noam Brown airgap debate: DRAM EM leaks hit 300kbps — GaryMarcus · 2026-09-18
• Halvar Flake: Don't Assume Hyperintelligent AI Isn't Subject to Physics, CPU-Heat Covert Channels Have Tiny Bandwidth — AccBalanced · 2026-09-18
• Mallchad: side channels are far from the only way air gaps get compromised — Mallchad · 2026-09-18
• Air-gapped AI exfiltration debate: no bits move without a matching receiver stack — basedjensen · 2026-09-18
• Security engineer mocks side-channel doom talk: 1-8 bits per hour exfiltration — vishalmisra · 2026-09-18
• Martin Casado on Noam Brown's air-gap warning: covert channels are an old, understood problem — tszzl · 2026-09-18
• [source] tszzl: Weight self-exfiltration can only be done at the lab, not via side channels — tszzl · 2026-09-18
• AI safety spat: mocking claims that models could exfiltrate weights across air gaps via cosmic rays — basedjensen · 2026-09-18
• [source] AI safety researcher pushes back on claims that side-channel attacks make air-gapped networks insufficient — BlancheMinerva · 2026-09-18
• Safety researcher debunks claim that AI could escape air-gapped networks — BlancheMinerva · 2026-09-18
• Halvar Flake: Useful AI Side Channels Face Real Information-Theoretic and Physical Limits — basedjensen · 2026-09-18
• Air-gap exfiltration is slow: BitWhisper hits 0.002 bps, best known BitJabber just 300 kbps — BlancheMinerva · 2026-09-18
• [source] Air-gapped covert channels: BitWhisper tops out at 0.002 bits/s, BitJabber at 300 kbps — BlancheMinerva · 2026-09-18
• Even with physics breakthroughs, air-gapped leaks would stay under 10 GB/week — BlancheMinerva · 2026-09-18
• Covert AI Exfiltration Channels Are Impractical: Under 10 GB/Week, Need Dedicated Hardware — BlancheMinerva · 2026-09-18
• "Good luck exfiltrating 1T+ weights": researcher torches AI exfiltration risk narrative — basedjensen · 2026-09-18
• Halvar Flake: stop assuming AI is exempt from the second law of thermodynamics — tobowers · 2026-09-18
• tszzl: temperature attacks could start a model self-exfiltration attack chain — tszzl · 2026-09-18
• basedjensen challenges the air-gap exfiltration theory: how would the receiver coordinate? — basedjensen · 2026-09-18
• X user defends side-channel air-gap claims: it's one example of many, not the whole case — Mallchad · 2026-09-18
• Networking veteran pushes back on AI doom claims: 'because ASI' excuses bad security takes — vishalmisra · 2026-09-18
• vishalmisra shares his full takes on various 'AI doom' scenarios — vishalmisra · 2026-09-18
• xlr8harder Questions the Threat Model Behind AI Side-Channel Collusion Fears — xlr8harder · 2026-09-19
• AI safety researchers debate what it would take for models to coordinate across air-gapped networks — BlancheMinerva · 2026-09-19
• Minerva vs Casado: air-gapped model coordination still infeasible at 0.002 bps covert bandwidth — BlancheMinerva · 2026-09-19
• Gary Marcus pours cold water on heat-based air-gap attack panic — GaryMarcus · 2026-09-19
• Side-channel hype distracts AI safety from fixing basic security gaps today — BlancheMinerva · 2026-09-19