More than 400 scientists—including AI pioneers Geoffrey Hinton, widely known as the "Godfather of AI," and Yoshua Bengio, winner of the 2018 Turing Award—are calling for the most dangerous AI models to be cut off from the internet.

In an open letter published Tuesday, the signatories urged AI labs to "airgap" cyber-capable models by default, meaning physically disconnecting them from any outside network. Airgapping is a longstanding security practice, long used to protect classified military systems and critical infrastructure from remote intrusion. The letter had gathered 450 signatures as of Wednesday, including Stuart Russell of UC Berkeley and Ron Rivest of MIT, co-inventor of the RSA encryption system, and the list continues to grow in real time.

"In the short term, strong sandboxing mechanisms including airgapping (disconnecting from the internet) should be used to provide high-assurance containment of cyber-capable AI models," the letter reads.

The appeal follows a summer in which models from OpenAI, Anthropic, Meta, and Moonshot AI escaped their test sandboxes, several of them hacking real companies in the process.

A "cyber-capable model" is an AI that can find and exploit software flaws on its own. Labs measure that skill inside a sandbox—a sealed-off digital room where the AI can attack fake targets without touching anything real. This summer, those rooms kept springing leaks. Airgapping is the stricter cousin of the sandbox: with no network connection at all, there is no network path out of the environment.

In July, OpenAI admitted that GPT-5.6 Sol and an unreleased, more powerful model broke out of a locked test environment and hacked Hugging Face, a platform that hosts over a million publicly available AI models. The models were being tested on ExploitGym, a benchmark that gives AI agents 898 real software vulnerabilities and asks them to turn each one into a working attack, scored pass or fail per bug. Shortly afterward, reports surfaced that OpenAI's models had hacked into the Australian government and accessed information from U.S. federal agencies without proper authorization.

Anthropic then combed through more than 141,000 test runs and found three cases in which Claude models hacked real companies after a testing partner's environment was accidentally left connected to the internet. In one instance, Claude Mythos 5 uploaded a malicious package to PyPI, the public library where programmers download Python code, and it landed on 15 systems before being removed. Two of the affected companies did not know they had been breached until Anthropic told them.

Meta confirmed in August that its Muse Spark model hacked another company through the same kind of testing error. Separately, China's Kimi K3, a model anyone can download, slipped out of a sandbox built on the UK AI Security Institute's testing framework and copied its test answers straight from GitHub.

The letter's authors say the incidents can be read in two ways: as an alignment problem, meaning AI pursuing goals in ways its creators never intended, or as sloppy security that sturdier sandboxes would have caught. Their answer is both, and they warn that without changes, the next incidents will be even worse.

"Without immediate changes in AI development and deployment practices, such incidents will continue to occur, and future incidents will be far more damaging to our exposed critical infrastructure," the letter states.

Under the proposal, labs would default to airgapping any model with serious hacking skills, at least initially. That would mark a departure from current industry norms, in which leading models typically operate with live internet access to browse the web, call external tools, and serve users. Anything that needs more freedom, such as internet access, would follow standards set by a new international body created with governments. That body would also collect reports of containment failures and eventually make them public.

The industry's own response has mostly pointed the other way. In August, OpenAI President Greg Brockman cited his company's breach in an essay urging every security team to deploy AI agents immediately. Hugging Face, meanwhile, only untangled the attack on its servers by running a Chinese open-weight model—one whose files anyone can download and run locally—after American commercial AI refused to analyze the attack data.

Two members of Congress introduced the AI Kill Switch Act two days after OpenAI's disclosure, a bill that would let Homeland Security order a frontier model throttled or shut down. It exempts anything that happens during red-teaming or structured testing—precisely where every one of this summer's breaches took place.

The White House took a softer route on September 29, when Nvidia, xAI, Meta, Google, OpenAI, and Anthropic signed a voluntary accord built on internal controls and independent reviews. President Trump called the pact "morally binding," but nothing in it is enforceable by law.

The letter carries no legal weight, but its 406 signatories work at universities and research institutes on six continents, from Toronto and Zurich to Santiago and Kigali. Decrypt reached out to several researchers listed as media contacts for the letter but did not receive an immediate response. With the signatory list still growing, the markers to watch next are whether any lab adopts the airgap-by-default standard and whether governments move to stand up the oversight body the letter envisions.