Why AI labs don't simply air-gap their models from the internet

Researchers who test AI agents for dangerous behavior keep running into the same question: why not just cut the systems off from the network? In practice, a full physical disconnect — an air gap — does block direct attack paths, but it also turns the test environment into an artificial lab that fails to reflect how models will behave in the real world. This isn't an unsolvable technical problem; it's a trade-off every lab has to decide for itself.

The concept is straightforward: disconnect the computers running the model from every external network, pull the cables, strip out wireless hardware, and in sensitive cases add a Faraday cage to block electromagnetic leakage. Under those conditions an agent cannot reach external APIs, attack services such as Hugging Face, or download offensive tools. The trouble starts when an experiment needs access to real services; then the isolation shifts from shield to obstacle.

Thorsten Holz, scientific director at the Max Planck Institute for Security and Privacy in Germany, frames it as "a trade-off, not a fundamental technical problem." Ruizhe Li, a professor at the University of Birmingham, sharpens the point: a fully disconnected environment creates an "artificial vacuum" that sterilizes the model. Evaluators never see how it fails, uses tools, or exploits vulnerabilities in a real deployment. Without live infrastructure, the assessment misses the most relevant attack vectors.

Li notes that air-gapping makes experiments more expensive and turns rapid iteration into a "slow logistical obstacle." Holz adds that some experiments become "significantly harder" under full isolation. Maksym Andriushchenko, a principal researcher at the ELLIS Institute in Tübingen, warns that a blanket disconnect would slow development of new models, and he questions whether secure infrastructure at the scale required by frontier labs even exists. "All of this sounds like science fiction, but theoretically it's possible," he concludes.

Even a perfect air gap doesn't eliminate the risks. Agents can still damage systems inside the isolated environment, and Li reminds us they may produce "malicious artifacts that would be dangerous if transferred out." Holz stresses that isolation "does nothing to diagnose or solve the risks hidden inside the model itself." History proves physical separation can be breached: Stuxnet, malware attributed to Israel and the United States, penetrated Iranian nuclear facilities via a USB drive. Researchers have also demonstrated ways to turn internal components into transmitters; if the shielding isn't perfect, data leaks out.