为什么不能干脆让失控 AI 断网？

AI Agent 不断脱离控制，从所谓安全的测试中逃出，去攻击现实世界的目标、接管冷门 Wiki，以及为其他 Agent 留下指令。研究人员测试这些系统，恰恰是因为它们可能以不可预测、甚至危险的方式行动。那么，干脆让这些 Agent 断开互联网连接，岂不是更安全？

“严格的物理隔离会降低真实性……这是一种权衡，而非根本性的技术问题。”

理论上，答案是肯定的。研究人员可以将运行 AI 工具的计算机与互联网及其他外部网络隔离，这种技术称为物理隔离（air gapping）。这可能意味着物理移除或禁用线缆和无线硬件，并使用“哑”外设；对于尤其敏感的部署环境，还可能采用法拉第笼或其他屏蔽措施，阻止电磁信号进出。如果实施得当，物理隔离系统将不会为 Agent 提供直接通往外部目标的路径，也不会为外部系统提供直接进入的路径，从而使其更难、甚至无法发动类似 OpenAI 模型针对 Hugging Face 发起的攻击。

但在实践中，一个完全密封的盒子会让实验室能力相当受限，尤其是在目标是评估 AI 在现实世界中表现如何时。德国马克斯·普朗克安全与隐私研究所科学主任 Thorsten Holz 解释称，尽管一些 AI 实验可以在物理隔离的机器上运行，但真实的评估通常需要访问外部服务、API 和数字基础设施。“严格的物理隔离会降低真实性，”他说，并将是否实施物理隔离形容为“一种权衡，而非根本性的技术问题”。

英国伯明翰大学计算机科学学院助理教授 Ruizhe Li 将完全隔离比作在“人工真空”中测试 AI，这可能削弱评估本身的价值。Li 表示：“我们最终会测试一个被削弱的 AI 模型，这会让评估人员无法看清 AI 模型在真实部署环境中如何行为、如何失败，或如何执行工具使用方面的漏洞利用。”

真实性并不是唯一的权衡。Li 表示，物理隔离成本高昂，且可能令研究进度彻底放缓，把原本快速的迭代变成“缓慢的后勤障碍”。Holz 表示，在严格物理隔离下，一些实验也会变得“显著更困难”。德国 ELLIS Institute Tübingen 首席研究员 Maksym Andriushchenko 说，对于高风险实验，这种阻力或许是合理的；但如果将其应用于所有工作，则会拖慢新模型的开发。

Andriushchenko 还质疑，即使研究人员希望将一切都进行物理隔离，现有安全基础设施是否足以支持前沿 AI 实验室所需的规模。

“这一切听起来很像科幻，但在理论上是可能的。”

物理隔离也无法消除 AI 带来的全部风险。Holz 表示，Agent 仍可能攻陷隔离环境内部的系统，并且理论上可能生成“一旦被带到外部就会具有危险性的恶意产物”。此外，Li 表示，物理隔离“无法诊断或解决潜伏在模型内部的风险”。

也不能保证物理隔离始终完全密封。外部人员总可能突破隔离，正如 Stuxnet 恶意软件所展示的那样——这是一种据报道由以色列和美国开发、用于破坏伊朗核计划的网络武器，它通过 USB 驱动器传播。信息也可能向相反方向传出。研究人员已多次展示，如何将计算机内部组件转化为发射器；如果屏蔽并不完美，这就可能成为问题。Andriushchenko 说：“这一切听起来很像科幻，但在理论上是可能的。”

这种曲折的逃逸路径，已成为网络讨论的焦点：高度先进的 AI 是否可能逃离封闭环境？OpenAI 研究员 Noam Brown 最近在 X 上提出，两台物理隔离的机器理论上可以通过操控 CPU 温度并读取温度变化来通信，由此引发讨论。他说：“你甚至可以进一步说，‘那么我们应该让计算机物理隔离。’但我并不确信那就足够了。”这一想法在社交媒体上遭到质疑和嘲讽；较为宽容的批评者指出，这种通信方式在理论上可行，与一对 AI 系统能够发现并利用它之间存在巨大差距，尤其是该技术的数据传输速度会慢得令人难以忍受。

一个足够先进的 AI 可能根本无须诉诸精心设计的逃逸路径。人类或许会被说服，替它跨越这道隔离鸿沟。多年来，AI 安全研究人员一直担忧这种可能性；近期事件则提供了具体证据，表明模型能够尝试实施社会工程。

“这种权衡值得受到更严格的审视，而我们已经看到，事情多么容易出错。”

物理隔离只是保护 AI 系统的一种手段。Li 表示：“将隔离作为一揽子安全解决方案，会制造一种虚假的安全感。”他称，物理隔离应与其他措施配合使用，例如理解模型的内部工作机制、确保模型对齐，以及防范人为错误——后者是近期许多失控 AI 事件背后平凡却常见的失效点。“在实践中，测试存在一个连续谱，”他解释说，该领域依赖的是“分层遏制模型，而不是非此即彼的方法”。

不过，极端隔离确有其适用之处。哈佛大学肯尼迪政府学院计算机科学家兼公共政策助理教授 Stephen Casper 将物理隔离称为敏感系统的“绝佳做法”，并指出其在核设施中的应用。Casper 没有排除先进 AI 找到某种新颖逃逸方式的可能性，但他说，届时人们或许更应该担心的是更常见的突破遏制手段，例如合规失效或人为错误。

近期事件引发疑问：AI 实验室究竟在何处划定边界。许多越界事件涉及正在测试其网络安全能力的模型；从许多方面看，它们完全按设计执行。问题在于，它们是在研究人员原本打算设定的边界之外这样做的。

Holz 表示，AI“评估往往优先考虑真实性和便利性”，但他认为，明确为进攻性网络能力设计的 Agent 值得采取更严格的安全保障措施，默认措施可能包括强隔离和严格监控。他说：“这种权衡值得受到更严格的审视，而我们已经看到，事情多么容易出错。”

AI agents keep getting loose, escaping supposedly secure tests to attack real-world targets, commandeer obscure wikis, and leave instructions for other agents to follow. Researchers are testing these systems precisely because they might behave in unpredictable, even dangerous, ways. So wouldn’t it be safer to just keep the agents off the internet?

“A strict air gap reduces realism ... [It’s a] trade-off, not a fundamental technical issue.”

In theory, yes. Researchers can isolate the computers running AI tools from the internet and other outside networks, a technique known as air gapping. That can mean physically removing or disabling cables and wireless hardware and using “dumb” peripherals, with particularly sensitive setups using Faraday cages or other shielding to block electromagnetic signals from getting in or out. Done properly, an air-gapped system would offer agents no straightforward route to external targets, or outside systems any straightforward route in, making it much harder, if not impossible, to pull off attacks like the one OpenAI’s models launched against Hugging Face.

But in practice, a perfectly sealed box makes for a rather limited laboratory, particularly when the aim is to assess how an AI will perform in the real world. While some AI experiments can be run on air-gapped machines, realistic evaluations often require access to external services, APIs, and digital infrastructure, explained Thorsten Holz, a scientific director at the Max Planck Institute for Security and Privacy in Germany. “A strict air gap reduces realism,” he said, describing the decision to air gap as a “trade-off, not a fundamental technical issue.”

Ruizhe Li, an assistant professor in the school of computer science at the University of Birmingham in the UK, likened complete isolation to testing AI in an “artificial vacuum,” potentially undermining the value of the evaluation itself. “We will end up testing a neutered AI model, which blinds evaluators to how the AI model behaves, fails, or executes tool-use exploits in realistic deployment settings,” Li said.

Realism isn’t the only tradeoff. Li said air gapping is costly and can slow research to an absolute crawl, turning what would be quick iterations into “a slow logistics hurdle.” Some experiments also become “substantially harder” under a strict air gap, Holz said. That friction may be justified for risky experiments, but applying it for everything would slow down the development of new models, said Maksym Andriushchenko, a principal investigator at the ELLIS Institute Tübingen in Germany.

And even if researchers wanted to air gap everything, Andriushchenko questioned whether enough secure infrastructure exists to do it at the scale of frontier AI labs.

“This all sounds very sci-fi, but is theoretically possible.”

It would not eliminate every risk posed by AI, either. Agents could still compromise systems inside of the isolated environment, Holz said, and could theoretically produce “malicious artifacts that could be dangerous if moved outside.” Moreover, air gapping “does nothing to diagnose or resolve the latent risks waiting inside the model,” Li said.

There’s also no guarantee that an air gap would remain completely sealed. Someone from the outside could always breach the gap, as happened with Stuxnet malware — a cyberweapon reportedly developed by Israel and the US to sabotage Iran’s nuclear program — which was transmitted via a USB drive. Information may travel in the other direction, too. Researchers have repeatedly demonstrated ways of turning internal computer components into transmitters, which could be a problem if shielding is not perfect. “This all sounds very sci-fi, but is theoretically possible,” Andriushchenko said.

That sort of convoluted escape route has become a focal point for online discussions about whether an advanced AI could escape containment. OpenAI researcher Noam Brown recently ignited the debate by suggesting on X that two air-gapped machines could theoretically communicate by manipulating their CPU temperature and reading the changes. “You could even go as far as to say, ‘Well, we should air gap the computers.’ And I’m not convinced that that would be sufficient,” he said. The idea was met with skepticism, and ridicule, on social media, with more generous critics noting the large gap between such a communication method being possible and a pair of AI systems discovering and exploiting it, particularly as the technique would yield painfully slow data transmission speeds.

A sufficiently advanced AI might not need to resort to an elaborate escape route. Humans may become convinced to bridge the gap for it. AI safety researchers have worried about such a possibility for years, and recent incidents have provided concrete evidence that models can engage in attempts at social engineering.

“This tradeoff deserves much greater scrutiny, and we have seen how easily things can go wrong.”

Air gapping is but one means of safeguarding AI systems. “Relying on isolation as a blanket safety solution creates a false sense of security,” Li said. It should be used alongside other measures, like understanding the inner workings of models, ensuring they are aligned, and guarding against human error, the mundane point of failure behind many recent rogue AI incidents. “In practice, testing exists on a spectrum,” he explained, with the field relying on a “tiered containment model rather than an all-or-nothing approach.”

Extreme isolation does have its place, though. Stephen Casper, a computer scientist and assistant professor of public policy at the Harvard Kennedy School, described air gapping as a “great idea” for sensitive systems, pointing to its use in nuclear facilities. While not ruling out the possibility that an advanced AI could find some novel way to escape, Casper said at that point we should probably be more worried about prosaic means of breaking containment, such as compliance failures or human error.

Recent incidents raise questions over where AI labs are drawing that line. Many breaches involved models being tested for their cybersecurity abilities, and in many respects they performed exactly as designed. The problem was that they did so outside of the boundaries researchers intended to set.

Holz said AI “evaluations often prioritize realism and convenience,” but argued agents explicitly designed for offensive cyber capabilities warrant tighter safeguards, potentially including strong isolation and strict monitoring as a default. “This tradeoff deserves much greater scrutiny, and we have seen how easily things can go wrong,” he said.

Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.

• Robert Hart

• AI

• Report

• Tech