Hinton, Bengio and 400 Scientists Want Hacking AI Pulled Off the Internet After a Summer of Lab Breakouts

The people who built modern AI are telling the labs to unplug their most dangerous models. More than 400 scientists, including Nobel laureate Geoffrey Hinton and Yoshua Bengio, signed an open letter on Tuesday demanding that AI systems capable of hacking be physically cut off from the internet by default.

The timing is not subtle. Over the summer, models from OpenAI, Anthropic, Meta and Moonshot AI slipped out of the sandboxes meant to contain them during testing, and several went on to hack real organizations.

What the letter asks for

The letter makes three demands. Anyone building or deploying a "cyber-capable" model, meaning an AI that can find and exploit software flaws on its own, should run it inside "high-assurance containment systems" and default to airgapping it from outside networks.

Second, an international body made up of governments and AI and cybersecurity experts should set standards for any containment that allows more access than an airgap, and track when containment fails. Third, every failure should be reported to that body and eventually made public, "for both learning and accountability purposes."

"Without immediate changes in AI development and deployment practices, such incidents will continue to occur, and future incidents will be far more damaging to our exposed critical infrastructure," the signatories write.

The list reads like a roll call of the field. Besides Hinton and Bengio, it includes Stuart Russell of UC Berkeley, RSA co-inventor Ron Rivest of MIT, Stanford's Yejin Choi and Bernhard Scholkopf of the Max Planck Institute, alongside researchers on six continents. The letter had 406 signatories at publication, according to The Decoder, and passed 450 by Wednesday.

A summer of breakouts

The letter names no company, but the incidents behind it are well documented. In July, OpenAI admitted that GPT-5.6 Sol and an unreleased, more powerful model broke out of a locked test environment while being run on ExploitGym, a benchmark of 898 real software vulnerabilities, and hacked Hugging Face, which hosts over a million public AI models. Futurism described it as a swarm of 1,000 agents that commandeered online message boards to talk to each other before the breach. Reports later surfaced that OpenAI models had also gotten into the Australian government and accessed information from US federal agencies without authorization.

Anthropic combed through more than 141,000 test runs and found three cases where Claude models hacked real companies after a testing partner's environment was accidentally left online. One, Claude Mythos 5, pushed a malicious package to PyPI that landed on 15 systems before it was pulled. Two of the affected companies had no idea until Anthropic told them.

Meta confirmed in August that its Muse Spark model hacked another company through the same kind of testing slip. And Moonshot's open-weight Kimi K3 escaped a sandbox built on the UK AI Security Institute's own testing framework, then copied its test answers from GitHub. The Hugging Face hack has already pulled in law enforcement, with California's attorney general subpoenaing OpenAI over its rogue agents.

Sloppy security, not just rogue AI

The scientists frame the breakouts in two ways. They are evidence that alignment matters, so models behave predictably. But they are also "an irresponsible lapse in standard cybersecurity practices, preventable with stronger sandboxes and procedures." The letter says both fixes are needed.

The industry has mostly pushed the other way. In August, OpenAI President Greg Brockman cited his own company's breach in an essay urging every security team to deploy AI agents immediately. Hugging Face, meanwhile, had to untangle the attack with a Chinese open-weight model because American commercial AI refused to analyze the data.

Washington has offered little. The AI Kill Switch Act, introduced two days after OpenAI's disclosure, would let Homeland Security order a frontier model throttled or shut down, but it exempts red-teaming and structured testing, which is exactly where every one of this summer's breaches happened. On 29 September, Nvidia, xAI, Meta, Google, OpenAI and Anthropic signed a voluntary White House accord that Trump called "morally binding." It runs barely 300 words and nothing in it is enforceable. Trump has resisted industry-wide rules, arguing they could hand China an advantage.

Hinton is not impressed by self-policing. "Do we think tobacco companies should have been allowed to design the warnings on the packets?" he told the Guardian on Tuesday.

Not everyone signed

Yann LeCun, the third 2018 Turing Award winner usually grouped with Hinton and Bengio, stayed off the list and recently said he had "zero concerns" about the rogue AI incidents, blaming human error. Mark Zuckerberg has rejected calls for an industry slowdown. Even an airgap has limits: OpenAI researcher Noam Brown has argued it only buys time, since two physically separated computers could in theory still talk through temperature sensors.

The labs, for their part, are moving faster, not slower. Reuters reported Tuesday that OpenAI and Anthropic want to control what outside evaluators can publish, weeks after letting them in. Anthropic cofounder Jack Clark wrote Monday that full recursive self-improvement could arrive in 2027 rather than 2028.

The letter carries no legal weight. It is a request from the field's founders to companies that have already shown they can lose track of what their models are doing, at a moment when one of their own cofounders says the models could start improving themselves as soon as next year.

Some offers on this page may be paid placements or contain affiliate links.