FULL STORY

Air-Gaps vs. Rogue AI: Noam Brown's Claim Sparks Debate

OpenAI's Noam Brown claimed air-gapping won't stop a rogue AI, drawing same-day rebuttals from Martin Casado and security researchers over side-channel feasibility and superintelligence containment.

2026-09-18 ~ 2026-09-18 · 7 episodes · 31 posts

Episode 1 · OpenAI's Noam Brown: Air-Gapping Won't Stop a Rogue AI (2026-09-18, 11 posts)

In an interview during OpenAI's safety week, OpenAI researcher Noam Brown made a counterintuitive claim that sparked widespread debate: air-gapping an AI system may not be enough to stop a misaligned model from exfiltrating data. His reasoning is that two physically isolated machines can still communicate covertly through shared side channels—for example, by driving the CPU to high load and then encoding information in temperature changes read via thermal sensors. The remark was circulated and discussed by several bloggers (deanwball, nptacek, pvncher, aronchick, and others).

Confirmed

  • In the interview, Noam Brown said air-gapping may be insufficient to stop a runaway, misaligned AI, since isolated machines could communicate covertly via shared channels such as CPU heat and temperature changes.
  • He cited Stuxnet-style attacks as an example, arguing that isolation can be broken with just a small amount of human negligence.
  • He stressed that the historical lesson here is that "people always underestimate AI"—drawing an analogy to the underestimated technical risks of the atomic bomb—and that safety thresholds therefore need to be set extremely high.
  • According to aronchick's account, Brown revealed that OpenAI's safety monitoring currently consumes roughly 20% of its compute.

Unconfirmed

  • Technically minded commenters (in the discussion relayed by inductionheads) questioned whether the proposed "CPU temperature side-channel signaling" mechanism is actually feasible, arguing the scenario is hard to realize in practice; this debate remains unresolved.
  • The claim that 20% of compute goes to safety monitoring currently appears only in a single secondhand post and has not been corroborated by other sources.

Why it matters

  • This is a public statement from a core OpenAI researcher on the limits of frontier AI safety, suggesting that traditional physical isolation may not suffice against future, more capable models—echoing industry discussions about managing AGI-level risks.
  • If the "20% of compute on safety monitoring" figure is accurate, it indicates OpenAI is already investing enormous engineering effort and compute into safety, providing a rare quantitative reference for assessing its safety spending.
  • The episode also illustrates how contested AI safety narratives can be: even technical claims by senior researchers at leading labs face pushback from the technical community.

Episode 2 · Debate Rages Over Whether AI Can Exfiltrate Data via Fan Noise from Air-Gapped Systems (2026-09-18, 2 posts)

Martin Casado suggested AI could leak data from air-gapped machines by manipulating CPU fan noise, while Jensen dismissed the 'thinking bits leaking over the air' claim as ignorant fear, highlighting deep disagreement over AI safety risks.

Episode 3 · tszzl: Containing an uncooperative superintelligence is ten times harder than you think (2026-09-18, 5 posts)

On September 18, well-known AI commentator tszzl posted a series of remarks on the problem of containing superintelligence, sparking a round of debate. The core claim: the point is not to give up on the effort, but to recognize that containing a powerful superintelligence that doesn't want to be contained will be extraordinarily difficult — however hard you currently think it is, you should multiply that estimate by ten. The remarks came as a response to moyix's point that "covert channels are hard to defend against and agents have a unique advantage in coordinating with each other."

Confirmed

  • tszzl made clear he is not advocating abandoning containment attempts, but rather stressing that the difficulty is widely underestimated.
  • He also joked about the AI community's "rapid rationalization": in about a month, people will take "models communicating by manipulating physical constants" for granted and treat it as just another cybersecurity issue — a jab suggesting that concerns over covert inter-model communication will soon feel routine.
  • dbasch replied by quipping that the other party's organization is "the most schizophrenic institution in history," revealing rifts and mockery within Silicon Valley over the stance of the relevant safety orgs.
  • Commenter AccBalanced, responding to tszzl, proposed another path to "slow the frontier": shift incentives away from chasing benchmark scores toward prioritizing safety and alignment research; he argued that existing power and compute are already sufficient to support this pivot, even if it reduces some output.

Why it matters

This discussion comes against the backdrop of growing attention to covert inter-model communication and agent coordination capabilities. tszzl's "multiply the difficulty by ten" offers the safety community a workable conservative-estimation principle, while AccBalanced's proposal reframes the debate from "can we contain it" to "how should incentive structures be designed" — whether to keep chasing benchmarks or redirect resources toward safety and alignment research may determine how feasible slowing the frontier actually is. dbasch's mockery also reflects industry frustration with the wavering positions of safety institutions.

Episode 4 · Debate over superhuman AI side-channel escape scenarios (2026-09-18, 3 posts)

A community debate over Noam Brown's AI escape scenarios: skeptics doubt the specific thermal side-channel attack but argue superhuman AI could devise novel attacks or need just one bit to trigger cascading failures, while others suggest a superintelligence would simply manipulate humans into plugging in a USB drive.

Episode 5 · Debate Erupts Over Noam Brown's Air-Gapped Computer Threat Claims (2026-09-18, 2 posts)

whurley cited the BitWhisper paper to push back on Noam Brown's air-gap threat claims, and Gary Marcus joined in, noting thermal-channel communication is far too slow (a few bits per hour) to be a practical danger.

Episode 6 · a16z's Casado pushes back on 'air gaps are useless' AI risk claims (2026-09-18, 2 posts)

a16z partner Martin Casado rebutted Noam Brown's claim that air gaps cannot contain runaway AI, arguing covert channels are a longstanding systems problem rather than a new AI threat, and that abstract 'AI will be superhuman' narratives collide with real-world system constraints.

Episode 7 · Security researcher debunks claims that AI could breach air-gapped networks via side channels (2026-09-18, 6 posts)

On September 18, security researcher Blanche Minerva posted a series of threads systematically rebutting the popular risk narrative that AI could someday use side-channel attacks, making even air-gapped networks insufficient as a defense. Her core conclusion: the claim is technically unsound. Covert channels in air-gapped networks have extremely low bandwidth, and "possible non-zero information exchange" by no means implies "a model can bypass an air gap the way it bypasses a weak sandbox."

Confirmed

  • She noted that the heat-exchange example Noam cited comes from the BitWhisper research, whose maximum throughput is just 0.002 bits per second—heat is a terrible medium for data transmission.
  • The fastest air-gap side-channel scheme she knows of is BitJabber, at only about 300kbps; real-world throughput would be several orders of magnitude lower.
  • Even if all physical challenges were solved with major breakthroughs, an observer with internet access would at best get a one-way channel carrying less than 10 GB per week.
  • Two-way communication is conceptually impossible to achieve naturally: it would require OpenAI to first install antennas inside the isolated network, or rely on coordination between internal and external agents—and the latter presumes the model is already deployed, which is circular reasoning.

Unconfirmed

  • She criticized proponents of the "AI penetrates air gaps" narrative for never specifying what side-channel attacks could actually be used for, calling it an exaggerated narrative dressed up as "taking the AI threat seriously."

Why it matters

  • The debate bears directly on the frontier safety question of whether air-gapping suffices to contain misaligned AI. If low-bandwidth side channels truly cannot support model escape or large-scale exfiltration, air gaps remain a viable defense—and overhyping the risk could distort resource allocation and public perception.