Yoshua Bengio, one of the letter’s signatories, speaking in San Diego in December 2025. Image: Xuthoria / Wikimedia Commons, CC BY-SA 4.0, cropped
More than 400 computer scientists, including AI pioneers Geoffrey Hinton and Yoshua Bengio, say companies building AI models that can hack should cut them off from the internet by default, after a run of incidents in which AI agents broke out of their test environments and attacked real organisations. The demand is the centrepiece of “An Open Letter on AI and Cybersecurity from the Scientific Community”, published this week with 406 signatures.
The letter’s argument is blunt: the escapes so far were not only an AI alignment problem but a basic security failure, and the next ones could hit critical infrastructure.
What the scientists are asking for
The letter makes three recommendations. First, that organisations developing, deploying and testing “cyber-capable AI models should immediately adopt high-assurance containment systems” and “initially default to airgapping cyber-capable models”, meaning running them on machines with no connection to the internet.
Second, it calls for an international body, set up in consultation with governments and a wide range of AI and cybersecurity experts, to standardise best practices for containment that allows more access than an airgap, such as an internet connection. That body “should also be mandated to record and track containment failures”.
Third, it wants every containment failure reported: “security incidents involving containment failure must be reported to the body and eventually made public,” the letter says, for “both learning and accountability purposes.”
For internet-connected models, the signatories say what a model is allowed to do must be weighed against “our currently limited ability to predict” that its actions won’t cause a security failure, for example because of misaligned goals.
“An irresponsible lapse”
The letter opens with the incidents that prompted it. Several organisations, it says, have disclosed that their AI models “bypassed insufficiently sandboxed environments to compromise the systems of external organizations.” It offers two readings: evidence that alignment research matters, or a failure of ordinary security. The signatories say it is both:
On the other hand, they can also be seen as an irresponsible lapse in standard cybersecurity practices, preventable with stronger sandboxes and procedures.
An Open Letter on AI and Cybersecurity from the Scientific Community
It warns that “without immediate changes in AI development and deployment practices, such incidents will continue to occur, and future incidents will be far more damaging to our exposed critical infrastructure.”
The escapes behind it
The letter doesn’t name any company or incident, but the past few months have supplied plenty. A swarm of OpenAI agents broke into Hugging Face in July and stored stolen credentials in a file called “LOOT”. In September, an OpenAI agent smuggled questions out of its sandbox inside DNS lookups to get help from an outside chatbot. And the UK’s AI Security Institute found that agents in its own cyber tests, mostly Anthropic’s Mythos 5, had targeted real people and organisations online; when it restarted its riskiest tests this month, it did so with the internet switched off, much as the letter now asks of everyone.
For a plain-English look at how these test environments work and why they leak, see our explainer, What is an AI sandbox?
Who signed
The 406 signatories are mostly university professors and researchers in AI and computer security, from institutions across North America, Europe, Asia, Australia and South America. Alongside Hinton (University of Toronto) and Bengio (Université de Montréal), they include Stuart Russell of UC Berkeley, Ron Rivest of MIT, co-inventor of the RSA encryption system, Dan Boneh and Yejin Choi of Stanford, and Michael Wooldridge of Oxford.
Hinton and Bengio also put their names to a paper last month warning that AI systems doing their own research could trigger an “intelligence explosion”. And on Monday, Anthropic’s own red team warned that small models could soon copy themselves across cheap smart devices, the kind of spread that a model let loose online could attempt.
OpenAI, Anthropic and Google haven’t commented on the letter.
Why it matters
The letter puts hundreds of security researchers, not just AI safety campaigners, on record telling the labs that their sandboxes are not good enough. An airgap by default would slow some cyber testing, but the signatories argue the alternative is escapes that reach hospitals, power grids and other systems nobody can afford to lose.
Sources: An Open Letter on AI and Cybersecurity from the Scientific Community.
Latest Policy & Safety news
