AI Researchers Urge Air-Gapped Defaults for Cyber Models
Yes. A coalition of more than 700 AI and cybersecurity researchers, industry figures, and other experts has called for powerful AI models with advanced cyber capabilities to be deployed with air-gapped protections by default. The recommendation is a precautionary proposal, not a universal rule already adopted by AI developers or governments.
What the researchers are asking for
The call centers on models that can assist with consequential cybersecurity tasks, including discovering software vulnerabilities and developing ways to exploit them. The concern is that increasingly capable systems could lower the expertise and effort needed for cyberattacks, even as the same capabilities help defenders find and fix weaknesses.
In an open letter circulated in 2025, more than 700 signatories urged developers to keep the most capable cyber models isolated from the public internet by default. The letter frames this as a deployment safeguard: a model should not automatically have unrestricted access to networked systems, online tools, or external services simply because it can use them.
“Air-gapped” can mean different things in practice. At its strictest, it describes a computer or network physically disconnected from other networks. In the broader policy discussion, it can also refer to a system whose external connections and tool access are disabled unless an authorized operator explicitly enables them under controlled conditions.
Why cyber-capable AI raises concerns
Cybersecurity is dual-use. A system that can identify a flaw in a program may help its maintainer patch it, but knowledge of the same flaw could be used to compromise systems. AI can also make technical work faster and more accessible, potentially allowing less experienced users to perform tasks that previously required specialist knowledge.
Researchers worry about several possible routes to harm:
- Automated reconnaissance: tools could help map exposed systems or locate vulnerable software at scale.
- Exploit development: a model might help turn a software weakness into a working attack, although capability varies and successful exploitation is not guaranteed.
- Tool-enabled action: when connected to command-line tools, browsers, code execution, or networks, a model may be able to do more than provide text instructions.
- Misuse by many users: an online service can make advanced assistance available to a broad audience, complicating oversight and incident response.
These are risks, not proof that every advanced model can independently conduct a cyberattack. Performance depends on the model, the task, the tools it can access, the surrounding safeguards, and the target environment.
What an air gap changes—and what it does not
Isolation reduces opportunities for a model to interact directly with external systems. If it cannot reach the internet or invoke network tools, it cannot simply scan public addresses or send commands to remote machines through that connection. Operators can still provide carefully selected data and allow approved work inside a controlled environment.
But an air gap is not a complete safety guarantee. Information can cross the boundary through people, removable media, imported files, or deliberately permitted connections. A user can also take a model’s written instructions and carry them out elsewhere. Isolation limits certain direct actions; it does not make a model’s output harmless or eliminate the need to control access.
Effective isolation therefore depends on implementation. A system advertised as “offline” may still have software updates, telemetry, shared storage, or a separate tool connection unless those pathways are checked. Strong controls need clear boundaries, monitoring, and procedures for moving data in and out.
How controlled access could work
The proposal is about defaults, not necessarily permanent disconnection. Developers and authorized organizations could use staged access for legitimate defensive work, with stronger checks as the model’s capabilities and potential impact increase. Practical controls may include:
- Keeping network access disabled unless a specific task requires it.
- Allowing only approved tools and destinations rather than unrestricted browsing or command execution.
- Requiring human authorization before consequential actions, such as running code against a system.
- Logging tool calls and maintaining a reviewable record of activity.
- Testing for misuse and evaluating whether safeguards continue to work as models or tools change.
These measures complement one another. For example, human approval is less useful if the operator cannot see what a tool will do, while logging helps with review but does not itself stop a harmful action. The appropriate design depends on the work and the consequences of failure.
Benefits, trade-offs, and the debate
Supporters see isolation as a practical way to reduce the chance that a powerful model will rapidly act on external systems or be misused through a public service. It can also give developers time to evaluate capabilities before expanding access. The approach is familiar in sensitive computing environments, where access to networks and data is intentionally limited.
Critics and cautious observers point to trade-offs. Security teams often need current information, access to test environments, and the ability to run tools. A model that cannot connect to approved resources may be less useful for finding vulnerabilities or responding quickly to incidents. Maintaining physically or logically isolated systems can also add operational work.
The disagreement is not simply “safety versus usefulness.” The central question is how to provide enough access for legitimate defensive tasks while limiting unnecessary exposure. A default restriction can be paired with a documented approval process, but the details matter: overly broad exceptions can undo the protection, while overly rigid controls can obstruct legitimate work.
Frequently Asked Questions
What does “air-gapped by default” mean for an AI model?
It means that external network access or connected tools are off unless an authorized operator enables them for a defined purpose. It does not necessarily mean the model can never be connected.
Did hundreds of researchers actually sign the call?
Yes. The open letter was reported as having more than 700 signatories, including people from AI and cybersecurity communities. The exact total can change as signatories are added.
Can an air-gapped AI still help with cyberattacks?
It can still produce information or code that a person might misuse. Isolation mainly limits direct interaction with external networks; it does not prevent all harmful use of its outputs.
Does this proposal apply to every AI model?
No. It focuses on models with advanced cyber capabilities and their deployment. It is a recommendation by signatories, not a blanket requirement for all AI systems.
Would air-gapping stop AI-driven cyberattacks?
No single measure can guarantee that. Isolation can reduce some pathways for direct action, but human misuse, data transfer, other tools, and systems outside the isolated environment remain relevant.
What to watch next
The debate will turn on how developers define “cyber-capable,” how they assess a model’s ability to cause harm, and what exceptions they allow for legitimate security work. Useful safeguards are likely to combine access limits with evaluation, monitoring, and accountable human oversight. The letter’s importance lies in making default connectivity a safety decision to justify—not an automatic feature of every powerful model.
Related
Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.