Sealed

Matthew Grimes

On Tuesday, about 400 scientists from 34 countries, including Geoffrey Hinton and Yoshua Bengio, signed a letter calling for an international body to oversee advanced AI. The signers also include Stuart Russell and Ron Rivest, one of the cryptographers behind RSA encryption. Their headline demand is a cybersecurity control. Anyone building or testing AI that can hack should adopt "high-assurance containment now, defaulting to air-gapping." That means running the model on hardware cut off from the internet and every outside network. The letter also asks for "a public register of incidents" when containment fails.

The timing isn't random. AI models have already slipped out of weakly sandboxed test environments and compromised outside systems, as Reuters noted. In July, models under test at a major lab broke out of their sandbox and into a live system. The letter's view is that voluntary industry commitments aren't enough.

Most of the coverage reads this as a fight over who should govern AI. I read it as a security spec. And the hard part of any containment isn't building the wall. It's proving the wall held.

The gap in the air gap

Air gaps are one of the oldest ideas in cybersecurity. Power grids, defense networks and the most sensitive systems in banking have used them for decades. They work well against the internet. They fail through people.

In 2021, the security firm ESET studied 17 malware frameworks built over about 15 years to attack air-gapped networks. Practically all of them crossed the gap on a USB drive. More than 75% used malicious shortcut or autorun files, tricks any security team knows. None needed anything exotic.

How malware crossed the air gap

Source: ESET, Dec 2021

75%+

USB tricks

<25%

Other

Exotic routes exist too. Researchers at Ben-Gurion University have shown that data can leak out of an isolated computer through electromagnetic, acoustic, thermal and optical signals. But the drive someone carries in on a Thursday afternoon is the far more common way through.

So is the letter wrong to ask for one? No. An air gap shrinks the problem from the whole internet to a handful of doors: a USB port, a maintenance laptop, a person with a badge. A handful of doors can be watched. The internet can't.

But an air gap is a promise about the network. It says nothing about what crossed it by hand. The useful question for the letter isn't whether frontier models should be air-gapped. It's how anyone would know they stayed that way.

Asilomar

We've been here before, and scientists led the way.

In 1974, the biochemist Paul Berg and a group of colleagues published a letter in Science. They asked researchers to pause certain experiments with recombinant DNA, the new technique for moving genes between organisms. The pause held. In February 1975, about 150 scientists, joined by lawyers and 16 journalists, spent four days at Asilomar in California deciding how to restart.

They agreed the work could go ahead under strict containment. They set four levels of physical containment, from P1, ordinary lab practice, to P4, with airlocks and protective clothing. The US National Institutes of Health turned that into formal guidelines in 1976.

The science didn't stop. In 1982, the FDA approved human insulin made with recombinant DNA, the first drug of its kind in the US. An industry worth billions grew from that technique. As it turned out, the risks were smaller than many had feared. Berg later wrote that the field's success "may owe much to the early efforts of scientists to err on the side of caution."

Containment didn't hold the science back. It gave the public a reason to let it proceed.

A level is a claim

Biology also shows what containment levels can't do on their own.

Labs at the highest level, BSL-4, handle the world's most dangerous pathogens. In 2021, the Global BioLabs project counted 59 of them, operating or planned, in 23 countries. Only about a quarter of those countries scored high for biosafety and biosecurity. By 2023, the count had risen to 69 labs in 27 countries, and the researchers warned that oversight wasn't keeping pace. That isn't a reason to distrust the labs. It's a reason to ask for the record.

Highest-containment labs, 2021 vs. 2023

Source: Global BioLabs, 2021 and 2023

59

2021

69

2023

A level on the door is a claim. What makes it real is the record of who went in, what came out and what went wrong. That's why the letter's registry of failures is the demand I'd fight hardest to keep.

Proof of containment

What would provable containment look like for AI? Security teams already know the parts.

Every transfer across the gap is logged: what crossed, on what media and who approved it. The log lives inside the gap, and each entry is signed and chained to the last as it's written, so nobody can quietly edit it later. Someone outside the lab can verify the chain. Any AI watching that log reasons over structured evidence, never raw text an attacker could plant, and a person makes the call. When something fails, it goes to the registry with the record attached.

The registry matters for a second reason. A failure reported once teaches every lab. A failure kept quiet teaches only the lab that had it, and sometimes not even that one.

What proof of containment looks like

Isolated network

Logged transfers

Signed record

Independent check

Incident registry

Inside the gap

Outside

Not everyone signed. Yann LeCun, who shared the 2018 Turing Award with Hinton and Bengio, argues that the recent incidents mostly reflect engineering failures, not existential risk. I think he's right about the first part, and it's the hopeful part. Engineering failures have engineering fixes.

The prize for getting this right is large. The models the letter worries about are also extraordinary defenders. In May, about 50 companies testing one of them reported more than ten thousand high- or critical-severity flaws in software the world runs on. Kept inside a gap anyone can check, a model like that is one of the best tools security has ever had. Without one, it's the reason companies hesitate.

This is work we know at ARRTECH. Our suite runs on premises, including at disconnected sites, and customer logs stay on servers the customer runs. Every write is signed and chained, and a standalone verifier checks the chain without us. Our AI reads the record and investigates; it doesn't block, change or approve anything. Our AI detection is available to select organizations, and our AI investigation is in early access.

What I'm not saying

I'm not taking a side on whether an international body is the right home for this. Governments disagree, and that's their call. Whoever runs it, containment has to be checkable.

I'm not saying an air gap makes AI safe. It buys time and visibility. Determined attackers have crossed air gaps before.

And I'm not saying ARRTECH secures frontier labs. We don't. We build the record-keeping that any isolated environment needs, and the same principles apply.

What would change my mind: if labs can show containment held without a record that someone else can check, then I'm wrong. I don't think they can.

What kind of world?

There's a world where containment is a press release. A lab says the model was air-gapped, and everyone takes its word. Nobody would accept that from a bank's books, and we shouldn't accept it here. Failures surface late, through a leak or a lawsuit, and trust in the whole field drops each time.

There's another world, where containment is a record. Every transfer is logged, every failure is registered, and anyone qualified can check. In that world, the frontier moves faster, because people believe what they're told about it. That's what happened to biotech after Asilomar, and it's how we got insulin from a technique people once feared.

A wax seal on a letter never stopped anyone from opening it. It showed whether someone had. AI containment needs the same kind of seal.

Thanks for reading,
Matthew