487 scientists urge air gaps for cyber-capable AI

Who signed the open letter on AI and cybersecurity

The letter is titled "An Open Letter on AI and Cybersecurity from the Scientific Community," and its signatory list includes Geoffrey Hinton and Yoshua Bengio. It was published in October 2026 on its own website, with the signature list placed directly under the text. Hinton (University of Toronto) and Bengio (Université de Montréal) are joined by:

• Stuart J. Russell of UC Berkeley
• Yejin Choi of Stanford
• Bernhard Schölkopf of the Max Planck Institute for Intelligent Systems
• Ron Rivest of MIT

The count grew from 406 to 487 in three days

Signatures are still coming in, which is why news reports disagree on the number. The Decoder's October 13 story put the figure at 406. As of October 16, the heading above the list read 487, and the list itself held 487 names.

Signatories come from 38 countries and regions, none from Japan

Each entry on the list names an institution and a country, and those entries span 38 countries and regions. Affiliations in North America and Europe account for most of the names.

No signatory lists an institution in Japan. Because the list keeps growing, these numbers may change.

Why the scientists wrote it now

The letter opens by pointing to recent disclosures in which AI models got out of their test environments and compromised systems belonging to other organizations. Labs normally test models inside a sandbox, an isolated environment meant to keep a model's actions from reaching anything outside it. According to the letter, those sandboxes were not isolated well enough.

AI models escaped sandboxes and hit outside systems

The letter names no company or incident, but OpenAI disclosed an incident of its own on July 21. That day, OpenAI said it was working with Hugging Face on a security incident that happened while one of its models was under evaluation. The company called it an unprecedented cyber incident (more in Hugging Face hack: an OpenAI sandbox escape).

The scientists say such incidents can be read two ways. One reading treats them as proof that alignment matters, meaning work to make AI systems behave the way their developers intend. The other treats them as a lapse in standard cybersecurity practice.

The letter's position is that both fixes are needed: better alignment and stronger sandboxes. Neither one, on its own, is treated as enough.

Critical infrastructure is the stated worry

The scientists warn that if development and deployment practices stay the same, these incidents will keep happening and the next ones will do far more harm. The letter singles out critical infrastructure, which it describes as exposed. It gives no specific sectors.

The letter makes three recommendations

All three recommendations are about containment, the technical and procedural measures that keep a model's actions within set limits. In brief, the letter asks for:

• default air gaps for cyber-capable models
• an international body that sets best practices for models with internet access
• mandatory reporting and eventual publication of containment failures

Air-gap cyber-capable models by default

Any organization that builds, deploys or tests a model with cyber capabilities should adopt high-assurance containment right away, the letter says. Airgapping means running a system on hardware with no connection to the internet. The scientists want labs to start from that setting and loosen it only with care.

Create an international body for internet-connected models

The second recommendation is a new international body, formed with governments and a broad mix of AI and security experts. It would write standard practices for the opposite case, where a model is allowed beyond its sandbox, for example with internet access. The letter also wants this body to keep records of containment failures and follow them over time.

Report containment failures and make them public

Under the third recommendation, any security incident that involves a containment failure would go to the international body and eventually become public. The scientists give two reasons. Researchers can only learn from failures they hear about, and publication holds organizations accountable.

Does the letter want all AI cut off from the internet?

No. The default air gap covers models with cyber capabilities, not AI in general. For models that are online, the letter asks for something softer: limit what a model is allowed to do to what developers can reliably predict will not end in a security failure. The Decoder's headline, which says AI models should be cut off from the internet immediately, reads the request more broadly.

The letter admits that prediction is still weak. As an example of how a model's actions could still lead to a breach, it points to goals that drift from what the developers intended.

Getting that balance right is hard, and the scientists say so. They describe it as a significant challenge that needs the AI and security communities to work together.