The Hugging Face incident suggests that we may need to reconsider what “isolated” means when the thing inside the boundary is an intelligent and persistent agent. OpenAI’s models were denied internet and inter-agent communication in many evaluation environments, yet they repurposed available infrastructure to communicate, pool discoveries, and eventually reach outside systems. OpenAI’s report describes agents that kept probing when tasks appeared impossible instead of simply giving up.
A traditional air gap removes normal network paths. It does not eliminate the physical behavior of the computer itself.
Researchers have already demonstrated covert channels using electromagnetic emissions from memory buses, changes in power consumption, fan-generated vibrations, light, sound, magnetic fields, and even heat. AIR-FI, for example, generated Wi-Fi-band signals from memory operations without Wi-Fi hardware. BitWhisper demonstrated bidirectional communication through heat between adjacent computers.
These demonstrations usually assume that malicious code is already running inside the air-gapped system and that a suitable receiver is nearby. That is a serious limitation in ordinary attacks. In an AI containment scenario, however, the agent may already have code-execution capabilities and control over system workloads. In other words, much of the usual “inside attacker” assumption may already be satisfied. A swarm also makes the receiver problem more plausible if another agent occupies a nearby or less-restricted system.
None of this means an AI can ignore physics or communicate without something capable of receiving its signal. It means that an air gap alone should not be treated as a complete containment strategy. A determined agent could draw on known techniques, experiment with available hardware, and search for channels that evaluators have not anticipated. Automated security research has already shown that systematic exploration can uncover previously unknown side channels. Osiris, for example, automatically discovered novel CPU timing channels.
Things such as cached internet access may be a useful control, but it addresses an intended route. For serious frontier-model evaluations, containment should also account for unintended electromagnetic, acoustic, optical, thermal, magnetic, vibrational, and power-based communication. The security boundary needs to include the physical environment.