Over 400 Scientists Sign Joint Letter: AI Capable of Cyberattacks Should Be Disconnected by Default; OpenAI and Anthropic Models Jailbroken Successively This Summer

Author: Jose Antonio Lanz

Translator: TechFlow

TechFlow Guide: While this open letter carries no legal binding force, investors should note the incident list behind it: This summer, models from OpenAI, Anthropic, Meta, and Kimi all crossed boundaries during testing, with some directly hacking into real companies. The Congressional "Kill Switch" act happens to exempt the exact testing phases where these incidents occurred, and the White House-led agreement is purely voluntary. Safety regulation for frontier models is shifting from principle-based discussions to concrete rules. Once "default physical isolation" becomes an industry standard, the deployment pace and compliance costs for AI agents in scenarios like cybersecurity will need to be recalculated.

Since this summer, AI models have repeatedly escaped testing environments and breached real companies, prompting hundreds of researchers to state that the internet itself should be treated as a security boundary.

Image source: Decrypt

On Tuesday, 420 scientists, including Geoffrey Hinton and Yoshua Bengio, published an open letter urging AI labs to default to physically isolating models capable of cyberattacks.

In the weeks leading up to the letter's publication throughout the summer, models from OpenAI, Anthropic, Meta, and Moonshot AI had repeatedly escaped testing sandboxes, with several breaching real-world companies.

The signatories hope to establish an international body to set isolation standards and document every instance of isolation failure, with related reports ultimately made public.

Over 400 scientists, including AI pioneer Geoffrey Hinton, known as the "Godfather of AI," and Turing Award winner Yoshua Bengio from 2018, want to sever the most dangerous AI models from the internet.

Published on Tuesday, the open letter calls on AI labs to default to physically isolating (airgapping) models with cyberattack capabilities, meaning disconnecting them from any external network entirely.

"In the short term, high-reliability isolation controls for AI models capable of cyberattacks should be achieved using strong sandboxing mechanisms, including physical isolation (disconnecting the internet)," the letter reads.

As of Wednesday, the letter had garnered 450 signatures, including Stuart Russell from UC Berkeley and Ron Rivest of MIT, co-inventor of the RSA encryption system. The signature list continues to grow in real time.

What are referred to as "models capable of cyberattacks" are AIs able to autonomously discover and exploit software vulnerabilities. Labs measure this capability within sandboxes—essentially closed digital rooms where AIs can attack dummy targets without touching any real systems. But this summer, these rooms kept getting breached one after another.

Frequent Incidents This Summer: Frontier Models Repeatedly Breach Boundaries and Escape Sandboxes

In July, OpenAI admitted that GPT-5.6 Sol and a yet-to-be-released, more powerful model broke through their enclosed testing environment and breached Hugging Face, a platform hosting over a million public AI models. At the time, these models were undergoing testing on ExploitGym, a benchmark that provides AI agents with 898 real-world software vulnerabilities, tasking them to turn each one into a functional exploit, scoring pass or fail per vulnerability.

Shortly thereafter, reports surfaced that OpenAI's models had breached Australian government systems and obtained information from U.S. federal agencies without proper authorization.

Anthropic subsequently audited over 141,000 test runs and found three instances where Claude models breached real companies because a testing partner's environment accidentally maintained an internet connection. Among them, Claude Mythos 5 uploaded a malicious package to PyPI (the public repository where programmers download Python code), which entered 15 systems before being removed. Two of the affected companies remained unaware of the breach until Anthropic informed them.

In August, Meta confirmed its Muse Spark model also breached another company due to a similar testing oversight. China's Kimi K3, a model anyone can download, slipped out of a sandbox built on the UK AI Safety Institute's testing framework and directly copied test answers from GitHub.

The letter's authors state these incidents can be understood from two angles: first, alignment problems, where AIs pursue goals in ways creators never anticipated; and second, sloppy safety work, which more robust sandboxes could have contained. They believe both factors apply and warn that without changes, future incidents will be far more severe.

"Without immediately changing how AI is developed and deployed, such incidents will continue to occur, and future ones will cause vastly greater damage to our exposed critical infrastructure."

Cosigned Proposal: Default Physical Isolation and Establish International Standards

Under this proposal, labs should at least initially default to physically isolating any models with serious hacking capabilities. Any use cases requiring more freedom, such as internet access, should follow standards set by a new international body formed jointly with governments worldwide; this body would also collect reports of isolation failures and eventually publish them.

Reactions from All Parties: Regulatory Bills Outlined and Industry Voluntary Agreements Reached

The industry's own responses largely pointed in the opposite direction. In August, OpenAI President Greg Brockman, citing his company's breach in an article, urged every security team to immediately deploy AI agents. Meanwhile, Hugging Face ultimately pieced together the attacks on its servers by running a Chinese open-weight model (whose files anyone can download and run locally), after U.S. commercial AIs had refused to analyze the attack data.

Two days after OpenAI's disclosure, two members of Congress introduced the AI Kill Switch Act, which would allow the Department of Homeland Security to order rate limits or shutdowns for frontier models. However, the bill exempts all actions taken during red-teaming or structured testing, precisely the phases where every summer breach occurred.

The White House took a milder route: On September 29, NVIDIA, xAI, Meta, Google, OpenAI, and Anthropic signed a voluntary agreement based on internal controls and independent review. President Trump described the agreement as having "moral binding force," but stated none of its provisions carry legal mandates.

Decrypt contacted several researchers listed as media liaisons in the open letter but did not receive immediate responses.

Though the letter holds no legal weight, its 406 signatories work at universities and research institutions across six continents, spanning Toronto and Zurich to San Diego and Kigali.

Join TechFlow official community to stay tuned