FULL STORY

Noam Brown's Air-Gap Remark Sparks Safety Firestorm

A clipped podcast clip of Noam Brown suggesting air-gapping may not contain misaligned AI ignited a heated safety debate, drawing pushback from security experts before Brown himself clarified his remarks were taken out of context.

2026-09-18 ~ 2026-09-20 · 5 episodes · 100 posts

Episode 1 · Noam Brown on Dwarkesh: 10,000-Agent Cluster Solves Navier-Stokes as AI Outpaces Predictions (2026-09-18, 11 posts)

OpenAI researcher Noam Brown—creator of poker and Diplomacy AIs and a key figure behind the o1/o3 reasoning models—joined Dwarkesh Patel's podcast on September 17 for a wide-ranging conversation on multi-agent systems, test-time compute, and recursive self-improvement (RSI). The most noted fact: a cluster of 10,000 agents collaboratively solved the Navier-Stokes equations; Brown himself credited the episode to OpenAI's multi-agent team. Brown argued AI progress is outpacing everyone's predictions.

Confirmed

  • Multi-agent clusters: whether many cooperating or adversarial agents can produce emergent capabilities beyond a single model was a core topic, with the Navier-Stokes result as evidence; emphasized by reposters such as @polynoamial and @morqon.
  • AI outpacing predictions: a main thread was capability gains from reasoning models and test-time compute, with Brown saying progress is exceeding everyone's predictions (@Dwarkesh Patel).
  • Mathematics boom: Brown believes mathematics is currently experiencing an explosion of progress, exemplified by the Navier-Stokes solution.
  • RSI and alignment: the discussion covered what the math boom means for automated AI research (RSI) and how AI firms can complete alignment verification before RSI arrives (@morqon, @MilesBrundage); they also debated whether automating AI research itself should trigger an RSI-like intelligence explosion (@burnytech).
  • Scale figure: Dwarkesh cited that the 130 billion tokens consumed in one training run would take a full-time human roughly 4,000 years of thinking (@danielmac8).
  • The interview is regarded as primary material on how frontier-lab researchers view test-time compute, multi-agent collaboration, and self-improvement (@1411337).

Why it matters

  • If a 10,000-agent cluster can break through in a domain as hard as mathematics, the quantity-driven collaboration route may amplify single-model capabilities, offering direct evidence for accelerating automated AI research.
  • Linking alignment-verification urgency to the RSI timeline offers a first-hand view of how OpenAI researchers weigh safety against the capability race.

Episode 2 · OpenAI's Noam Brown Claims Air-Gapping Won't Stop Rogue AI, Sparking Heated Debate (2026-09-18, 53 posts)

OpenAI researcher Noam Brown argued in a podcast interview that physically air-gapping computers may not stop a misaligned AI from communicating with the outside world: two isolated machines could use one CPU running at high load while the other reads temperature changes as a covert channel. The claim spread widely on X and triggered fierce debate; Brown himself posted a clarification on 09-19 saying some interpretations were misreadings.

Confirmed

  • Brown did make the 'CPU thermal side channel' argument; numerous reposts (Puzzleheaded-King584, DanJeffries1, tszzl, deanwball, etc.) all point to the same podcast. His core stance: underestimating AI is a recurring mistake, and because progress is so fast, safety and alignment standards must be extremely high.
  • On 09-19, via the polynoamial account, Brown clarified that the 'temperature sensor' example was an academic discussion about how hard it is to guarantee 'complete isolation,' and urged people to watch the full podcast where he pushed back on AI hype.
  • Cryptographer Matthew Green publicly mocked OpenAI for discussing fancy rogue-AI thermal side channels while not even updating the Linux kernel in its own sandbox; robleclerc's repost cited criticism of numerous zero-days in OpenAI's infrastructure.
  • Developers challenged the channel's practicality: ThePrimeagen quipped the baud rate might be 0.01; Grady Booch mocked Brown for wasting time (via GaryMarcus).
  • Martin Casado (via nptacek) proposed another covert channel idea: an air-gapped machine spins its CPU fan, transmitting data bit by bit via fan noise to a nearby microphone-equipped computer, at extremely low rates.
  • The debate drew side-channel experts: tszzl argued anyone who understands computer security knows the scenario is possible and critics dismiss it as sci-fi hype; communications-security researcher vishalmisra, while not an AGI expert, questioned the narrative from a side-channel perspective. A viral dialog-style thread (relayed by suchenzang) probed how a superintelligence would leak secrets—its own, for mass coordination, to another sufficiently smart open-source model—from an air-gapped system.
  • An information-theoretic clash followed: Daniel Matthews argued the number of physical channels is finite, so noise injection, buffers and honeypots can push channel rates below the noise floor for true isolation; teortaxesTex retorted sarcastically that all sandboxes share lineage and jailbreaks are hard to prevent.
  • basedjensen echoed Brown's call for far higher safety standards; maxpaperclips noted security researchers criticizing OpenAI's disregard for safety; Stocko reported Brown being slammed by peers as absurd.

Unconfirmed

  • Some circulating interpretations were labeled misreadings by Brown; the gap between his original intent and social-media retellings depends on the full podcast context.

Why it matters

  • The spat exposes the gap between AI-safety narratives and engineering hygiene: Green's point about stale kernels contrasts sharply with high-falutin 'superintelligence side channel' threat discussions.
  • It also shows how security discourse gets amplified and distorted on social media—Brown had to clarify personally—revealing how differently expert communities and casual observers evaluate the same claim.

33 more related posts →

Episode 3 · tszzl: Containing an uncooperative superintelligence is ten times harder than you think (2026-09-18, 5 posts)

On September 18, well-known AI commentator tszzl posted a series of remarks on the problem of containing superintelligence, sparking a round of debate. The core claim: the point is not to give up on the effort, but to recognize that containing a powerful superintelligence that doesn't want to be contained will be extraordinarily difficult — however hard you currently think it is, you should multiply that estimate by ten. The remarks came as a response to moyix's point that "covert channels are hard to defend against and agents have a unique advantage in coordinating with each other."

Confirmed

  • tszzl made clear he is not advocating abandoning containment attempts, but rather stressing that the difficulty is widely underestimated.
  • He also joked about the AI community's "rapid rationalization": in about a month, people will take "models communicating by manipulating physical constants" for granted and treat it as just another cybersecurity issue — a jab suggesting that concerns over covert inter-model communication will soon feel routine.
  • dbasch replied by quipping that the other party's organization is "the most schizophrenic institution in history," revealing rifts and mockery within Silicon Valley over the stance of the relevant safety orgs.
  • Commenter AccBalanced, responding to tszzl, proposed another path to "slow the frontier": shift incentives away from chasing benchmark scores toward prioritizing safety and alignment research; he argued that existing power and compute are already sufficient to support this pivot, even if it reduces some output.

Why it matters

This discussion comes against the backdrop of growing attention to covert inter-model communication and agent coordination capabilities. tszzl's "multiply the difficulty by ten" offers the safety community a workable conservative-estimation principle, while AccBalanced's proposal reframes the debate from "can we contain it" to "how should incentive structures be designed" — whether to keep chasing benchmarks or redirect resources toward safety and alignment research may determine how feasible slowing the frontier actually is. dbasch's mockery also reflects industry frustration with the wavering positions of safety institutions.

Episode 4 · Security veterans push back on claims that AI could bridge air-gapped machines via CPU heat (2026-09-18, 29 posts)

In response to claims that "AI could covertly communicate between air-gapped computers via CPU heat," several security and tech figures pushed back on September 18, with one core message: don't assume superintelligent AI is exempt from the laws of physics. Renowned security researcher Halvar Flake (Thomas Dullien) published a rebuttal, urging people to first estimate how many bits per minute such a channel could actually extract. He stressed that AI is still bound by the second law of thermodynamics, the cost of acquiring information, noisy channels, and measurement error—fundamental physical and information-theoretic constraints. He did not claim AI can never find side channels; rather, he argued that "useful side channels that deliver meaningful capability gains" are an entirely different matter, and that side-channel attacks face real information-theoretic and physical limits.

Confirmed

  • Halvar Flake's rebuttal targets recent AI-doomsday-style concerns (linked to claims by Noam Brown and others) that "two AIs might communicate covertly by heating their CPUs."
  • Quantum computing expert whurley publicly disputed the claim that air-gapped computers can be remotely attacked via thermal signals, arguing the threat is overstated and largely academic, and cited the IEEE BitWhisper paper as the literature source behind the claim.
  • Gary Marcus shared a post from deedydas: two air-gapped computers can indeed communicate through temperature changes, but the rate is far too slow (only a few bits per hour) to be practical; the real threat lies in the far faster techniques in the literature, such as those exploiting DRAM.

Why it matters

  • The debate touches on the core methodology of AI safety assessments: AI risks should be evaluated against the physical and information-theoretic upper bounds of channel capacity, rather than assuming superintelligence can bypass all physical constraints.
  • The rebuttals don't deny that side-channel threats exist—they argue for distinguishing "theoretically feasible" from "practically useful," so threat narratives aren't exaggerated while faster side-channel techniques in the literature aren't overlooked.
  • The discussion also exposes a public rift between AI doomsayers (e.g., claims associated with Noam Brown) and veteran security practitioners—worth watching whether AI safety evaluation standards shift as a result.

9 more related posts →

Episode 5 · Noam Brown Clarifies Out-of-Context Podcast Clip (2026-09-19, 2 posts)

Noam Brown responded to a clipped clip of his Dwarkesh Patel interview, urging viewers to watch the full podcast where he pushed back on AI hype, saying the isolated-agents example was academic in nature.