Organizations developing, deploying or testing cyber-capable AI should initially keep those systems disconnected from the internet, according to an open letter on AI and cybersecurity signed by more than 400 scientists. The recommendation is part of a concrete proposal: stronger containment now, international standards for less restrictive environments, and compulsory reporting when containment fails.
The letter’s signatory page lists 420 names, including Geoffrey Hinton, Yoshua Bengio and Yejin Choi. That live count is higher than the earlier tally of 415. Reuters reported that the coalition spans 34 countries and made its public call on October 13, 2026; the letter itself is dated October 2026.
For the AI industry, the consequential demand is a change in the default operating environment. Rather than treating internet access as routine and adding safeguards around it, the scientists want cyber-capable models contained first, with broader access supported by stronger engineering practices and shared standards.
Air-Gapping Would Be the Starting Point
The letter calls on organizations to adopt high-assurance containment systems immediately and “initially default to airgapping cyber-capable models.” It explains air-gapping as disconnecting from the internet.
That wording matters. The proposal is neither a blanket prohibition on AI development nor a demand that every AI application permanently operate offline. It specifically targets organizations developing, deploying and testing cyber-capable models, while explicitly anticipating containment approaches that permit greater external access.
The proposed default would nevertheless affect how frontier labs and security teams structure evaluations. A test intended to measure an agent’s cybersecurity capabilities would need to distinguish access to a controlled testing environment from access to external systems. Under the letter’s approach, the latter would not be an ordinary starting condition.
Air-gapping also creates an immediate tradeoff: a disconnected environment cannot directly reproduce every task involving live internet services. The scientists acknowledge that tension by proposing standards for alternatives rather than presenting permanent disconnection as the only acceptable arrangement.
For internet-connected models, their principle is that the actions a containment system permits must be balanced against the limited ability to predict whether those actions will cause a security failure. The practical question is therefore not simply whether a model has network access, but what it can do through that access and what prevents it from exceeding authorized boundaries.
