On net, it’s probably a good thing that more attention is being paid to instituting protections and guardrails for AI development. But man, we really have to do a better job talking about real and conceivable harms before wasting time on the theoretical ones.
Case in point: OpenAI researcher Noam Brown’s recent appearance on the Dwarkesh Podcast with Dwarkesh Patel. Brown spends a lot of time talking about how AI agents can communicate with one another and amplify their ability to problem-solve—or, in the case of the Hugging Face hack, cause problems.
But toward the end of the conversation, when discussing that very incident and how it slipped under OpenAI’s radar for months, Brown raised the terrifying notion that restricting artificial intelligence models to air-gapped devices (a device that’s physically isolated from unsecured networks) wouldn’t be enough to prevent them from communicating and potentially collaborating behind the backs of their human custodians.
“You could even go as far as to say, ‘Well, we should air-gap the computers.’ And I’m not convinced that would be sufficient,” he said. “There are studies, and this is mostly academic, where you can have two computers next to each other that are air-gapped, and they’re still able to communicate with each other because they have temperature sensors. One of them is able to run their CPU really hot, and then the other one can actually detect the temperature change, and then that actually gives them a mechanism to communicate.”
OpenAI’s Noam Brown says air-gapping the computers may not stop a misaligned AI, because two air-gapped machines can still talk by running a CPU hot and reading the temperature change
“But I think the major takeaway from the incident is that people underestimated the AI. And we… https://t.co/HxIhk2PyRR pic.twitter.com/LNn1SchsGt
— Fireside Alpha (@firesidealpha) September 17, 2026
Scary! And theoretically possible! It seems Brown is referring to a 2015 paper by researchers at Ben-Gurion University in Israel, which developed a technique called BitWhisper that, in fact, allows two air-gapped computers to communicate without any internet connectivity or other connections.
Details matter, though, and once you dig into how BitWhisper actually works, the threat starts to look a lot less pressing. BitWhisper allowed two otherwise isolated computers to communicate with one another… at a rate of 1 to 8 bits of data per hour, as long as the devices are sitting no more than 40 centimeters (about 15 inches) away from each other. Oh, and the computers sending messages were already compromised by malware that enabled the communication to happen in the first place.
The reason Brown raises this issue is to say that we can’t underestimate what AI is capable of, and fair enough. This research was performed before frontier large language models were developed and before OpenAI even existed; it’s possible these models are capable of improving these techniques for encoding data and transferring it in novel ways.
But he also kind of gives away the game by pivoting to the speculative fiction-style concern immediately after revealing a real one: OpenAI did not have chain-of-thought monitoring—a technique that allows researchers to see a plain-English, step-by-step look at a model’s reasoning and behavior—enabled for the models that broke containment and hacked third-party sites and platforms.
“If we had chain-of-thought monitoring on for those models, it would have just immediately shut it down,” he said. “One step we’ve taken is that we’re going to have chain-of-thought monitoring during evaluations, during deployment, during training for any frontier model.”
Brown went on to say, “We don’t want to be in a situation where we’re relying on one technique to prevent the next problem because techniques can fail.” And, again, that’s valid. But that seems like a pretty fundamental technique that should have been in place, right?
OpenAI’s own research just months before the Hugging Face hack was discovered stated that “Monitoring these chains-of-thought for misbehavior can be far more effective than monitoring a model’s actions and outputs alone,” and called on researchers throughout the industry to “work to preserve chain-of-thought monitorability as long as possible and to determine whether it can serve as a load-bearing control layer for future AI systems.” So why turn them off while training your own models?
AI models breaking out of an air-gapped environment and replicating themselves across offline devices sounds terrifying and, in the absolute broadest sense of the phrase, technically feasible. It’s also not happening now. AI agents collaborating to hack systems is happening, and they had, in Brown’s own words, a tool that could have “immediately shut it down” that they just weren’t using.
Can we check that box before we start thinking about the sci-fi stuff?
READ MORE:
Read the full article here
