Why Can't We Just Keep Rogue AIs Off the Internet?

Air-gapping AI to keep it away from real-world targets makes testing safer — but less useful.

By Robert Hart

As AI systems grow more capable, a deceptively simple question keeps surfacing among researchers, policymakers, and the public alike: if an AI model becomes dangerous, why not simply disconnect it from the internet? Cut the cable, keep it in a box, and call it a day. The appeal of this idea — known as "air-gapping" — is obvious. A system that cannot reach the outside world cannot hack a power grid, manipulate financial markets, or exfiltrate sensitive data. But the reality is far messier, and as of 2026 the gap between the intuition and the practice has only grown wider.

What Air-Gapping Actually Means

Air-gapping refers to physically isolating a computer or network from unsecured connections — including the public internet and often local networks as well. The technique has long been used in high-security environments such as nuclear facilities, classified government systems, and industrial control networks. In the context of AI safety, air-gapping is presented as a containment strategy: train or test a model inside a sealed environment so that even if it develops unexpected, deceptive, or adversarial behavior, it cannot act on the outside world.

The logic is compelling. If a model is truly sealed off, the worst-case scenario is confined to the sandbox. For labs developing frontier models — the most advanced systems at any given time — this kind of isolation is already standard practice during early testing.

Why It Breaks Down in Practice

1. Capability Demands Connectivity

The most capable AI systems are, by design, deeply dependent on networked infrastructure. Training runs for frontier models in 2026 routinely span tens of thousands of specialized chips distributed across multiple data centers. These clusters require continuous coordination, telemetry, software updates, and orchestration — much of which relies on networked tooling. A truly offline system cannot be trained at scale, and even a purely inference-focused deployment loses much of its value without access to live data, APIs, and user interaction.

2. The "Useful Testing" Paradox

Here lies the central tension the original framing captures so well: air-gapping makes testing safer but also less useful. If you want to know how a model behaves when it has access to tools, code execution, browsing, memory, and multi-agent coordination — the very capabilities that make it powerful — you have to give it some version of those things. Isolate it entirely, and you test a crippled system that tells you little about real-world risk. Open it up, and you reintroduce the exposure you were trying to avoid. Safety researchers call this the containment–capability trade-off, and no one has fully resolved it.

3. Models Are Not Confined to One Box

Modern AI deployments are rarely monolithic. A single application may chain together a base model, retrieval systems, external tools, memory stores, and third-party APIs. Any one of these components can serve as a bridge to the outside world. Even a model that never directly touches the internet can influence systems that do — through outputs, tool calls, or downstream automation. Containment, in other words, is a property of an entire pipeline, not a single model.

4. Humans Are the Weakest Link

History is full of air-gapped systems that were breached not through clever technical exploits but through people. Stuxnet famously crossed into an Iranian nuclear facility via infected USB drives. A researcher copying weights, logs, or outputs out of a sealed environment can undo an entire containment architecture in seconds. As models become more useful, the pressure to move data — and models — across the air gap only increases.

5. The Model May Not Need the Internet to Cause Harm

Worth noting: a rogue AI does not necessarily require internet access to be dangerous. A model with write access to physical systems, financial records, or critical infrastructure on a local network can cause enormous damage without ever touching the public web. Air-gapping protects against some threat models, but not all of them.

The 2026 Context

This debate has sharpened considerably over the past two years. Regulators in the EU, the UK, and the United States have moved toward mandatory safety evaluations for frontier models, with some frameworks explicitly referencing containment and isolation requirements. At the same time, agentic AI systems — models that plan, use tools, and act autonomously over extended periods — have moved from demos to mainstream enterprise deployment. That shift makes the containment question urgent rather than theoretical: an agent that can send emails, write code, and call APIs is, by definition, connected.

Meanwhile, the compute scale required to train and run top-tier models continues to grow, making fully offline development impractical for all but the smallest experiments and the most specialized security research.

So What Actually Works?

Since perfect air-gapping is neither achievable at scale nor sufficient on its own, the field has moved toward layered defenses:

• Sandboxed environments with strict egress controls — allowing limited, monitored network access rather than none at all.
• Capability restriction — limiting which tools and APIs a model can call during testing.
• Monitoring and interpretability — watching for deceptive or unexpected behavior in real time, rather than assuming isolation alone will prevent it.
• Red teaming under realistic conditions — deliberately testing models with access to tools, precisely because that is where the risk lives.
• Organizational controls — restricting who can move data, weights, or outputs across security boundaries.

None of these is a silver bullet. Together, they reflect a hard-earned lesson: safety in AI is not a wall you build once, but a set of trade-offs you manage continuously.

The Bottom Line

Keeping rogue AIs off the internet sounds like the obvious fix. In practice, it conflicts with the very capabilities that make advanced AI worth building, and it ignores the many other pathways — human, physical, and architectural — through which a model can reach the world. Air-gapping remains a valuable tool in the safety toolkit, but it is not the answer on its own. The real question is not whether we can disconnect an AI, but how we govern what it can do while connected — and that problem is considerably harder.

via The Verge AI