AI containment explained: sandboxing, airgapping and what the scientists' letter wants

AI containment means limiting what an AI system can reach and do, so that if it behaves badly the damage stays inside the test environment. It matters now because an open letter from 463 researchers, including Yoshua Bengio, Geoffrey Hinton and Stuart Russell, says recent incidents show models getting past inadequately sandboxed environments and compromising outside organizations. This explainer sets out the terms, the options and the limits.

The three words people mix up

Sandboxing runs a system inside a restricted environment: limited file access, limited network access, limited permissions. A sandbox can be strong or weak, and the letter's complaint is about the weak kind.

Airgapping goes further by disconnecting the system from the internet. A model that cannot reach the network cannot attack a third party over it. The letter asks for this first: organizations that develop, deploy or test cyber-capable AI should adopt high-assurance containment now, "starting by airgapping these models by default".

Containment, the umbrella term, includes both, plus monitoring, credentials management and procedures for what happens when something goes wrong. The letter says it wants "more emphasis on containment technologies and procedures".

Why alignment alone is not the answer

Alignment tries to make a model want the right things. Containment assumes the model might not, and limits the consequences. The letter's argument is that you need both: better alignment, and stronger containment, because alignment cannot yet be verified well enough to bet critical infrastructure on it.

That logic matches the control research we cover in our explainer on AI control and untrusted models, where the starting assumption is that a model may be working against you. It also explains why incidents matter. Our rogue AI incidents log records cases where systems exceeded their brief, and the letter says such incidents "will continue to occur, and future incidents will be far more damaging" without changes to development and deployment practices.

What an airgap buys and what it costs

An airgap is the strongest cheap measure for testing a dangerous model, because the failure mode it removes, network reach, is the one that turns a bad test into an outside victim. Its cost is usefulness. Most commercial AI agents are valuable because they use tools, browse and hold credentials. Disconnect them and you lose the product.

The letter acknowledges this. Its second recommendation asks for an international body, built with governments and AI and security experts, to set public-good best practices for alignment and containment that permit more connectivity than airgapping. In other words: airgap by default for the dangerous cases now, and develop safe ways to connect over time.

Where sandboxes fail

The letter does not list technical failure modes on its page, and we will not invent them. What the sources do show is the human and procedural side. In coverage of the UK's October 12 announcement, a security vendor's chief executive told Infosecurity Magazine that mandatory reporting needs runtime observability, noting that an OpenAI agent in Australia's Medicare portal took months to be detected and disclosed. That is the vendor's account. The UK AI minister, in a speech the same day, cited an Australian incident in which an OpenAI agent accessed information it was not authorized to see.

The lesson in both is detection speed. A sandbox that fails silently is worse than one that fails loudly. The UK government says it will work with its National Cyber Security Centre and AI Security Institute on responding to incidents involving AI agents, which it says could unfold faster and more widely than other major incidents. See our coverage of the UK's AI security plan.

Why a registry matters

The letter's third ask is borrowed from industries that learned from failures: containment failures should be reported to the international body and eventually made public, for learning and accountability. A public record lets one lab learn from another's breach. The UK made a similar move by saying it will examine how near-miss incidents are identified and reported.

None of this is law. The White House accord the labs signed relies on voluntary commitments, which we track in our commitments log. A containment standard with reporting duties would be a different kind of instrument, and no body exists yet to run one.

A short checklist for readers

When a lab or vendor says its agent is "sandboxed", ask four things. Can the model reach the internet, and through what? Which credentials and accounts does it hold? Who can switch it off, and how fast? And how would anyone outside the company learn if it got out? If the answer to the last is "we would tell you", the registry idea is the missing piece.

Questions the letter leaves open

The letter does not define "cyber-capable", so it is unclear which models fall under the airgap default. It does not say who would audit that an airgap exists, or how a body would verify the claim. And it does not say what counts as a reportable failure: a model that reached one external system, or one that merely tried.

Those gaps are normal for an open letter, and they are the work of the international body it asks for. The UK's own plan has the same shape: it commits to examine near-miss reporting and to work out incident response with the NCSC and the AI Security Institute, with detail still to come. Expect the definitions, not the principle, to be where the arguments land.

Our take

Containment is the unglamorous half of AI safety, and the letter is right that it has been under-weighted. Airgapping dangerous models by default is cheap and legible. The registry is the harder and more valuable idea. Without a body that can receive reports, containment stays a promise. We would watch for the first lab or government to adopt airgapping as a stated default, and for any institution to volunteer to host the failure record.