The report
# Air-gapped does not mean silent: 18 covert channels AI containment has to account for
On September 17, 2026, OpenAI researcher Noam Brown told Dwarkesh Patel that he was not convinced air-gapping alone would necessarily be sufficient for containing increasingly capable AI systems. His example was not a hypothetical radio hidden inside a model. He pointed to a real 2015 experiment in which two already-compromised computers exchanged information through heat.
That experiment was BitWhisper. It worked only over roughly 0-40 cm and at about 1-8 bits per hour. That is enough for a tiny command or secret, not a replacement for a network. It also did not show an AI discovering the channel, compromising another machine or escaping a secure facility.
The interesting part is what sits around that example. Once ordinary networking is removed, a computer is still an electrical, thermal, acoustic, optical and mechanical object. It drives displays and cables, changes CPU and memory load, spins fans and disks, draws power, emits electromagnetic fields and sits near cameras, microphones, radios and other sensors. Recent AI-security research adds another layer: outputs that look ordinary to a person can carry hidden instructions or hidden data that another model can recover.
Digging Beagle now tracks 18 distinct vulnerability or research records in this family:
- Thermal: BitWhisper used CPU heat and built-in thermal sensors.
- FM / display emissions: AirHopper used software-generated FM-band emissions associated with display hardware.
- Memory-bus RF: AIR-FI generated Wi-Fi-band emissions from DDR memory activity.
- Video-cable RF: TrojPix induced controllable electromagnetic emissions through subtle pixel modulation.
- Magnetic: ODINI encoded data in low-frequency magnetic fields generated by CPU load.
- Power-line: PowerHammer encoded data in current fluctuations caused by controlled CPU utilization.
- Fan acoustics: Fansmitter modulated fan speed into audible acoustic data.
- Hard-drive acoustics: DiskFiltration controlled HDD actuator movement to create an acoustic carrier.
- Surface vibration: AiR-ViBeR turned fan-speed changes into table vibrations sensed by a phone accelerometer.
- Status LEDs: LED-it-GO used HDD activity lights as high-speed optical transmitters.
- Screen-to-camera QR: low-contrast QR codes were embedded in ordinary display frames and reconstructed by cameras.
- Reflections: ORT recovered text reflected from eyeglasses in video-conferencing footage.
- Ultrasonic command injection: DolphinAttack delivered commands through ultrasonic carriers that humans could not hear normally.
- Light-to-microphone injection: Light Commands converted modulated laser light into microphone input.
- Near-ultrasonic LLM prompts: Sirens'Whisper delivered covert prompts and jailbreaks to speech-driven LLM interfaces.
- Image prompt injection: stealthy visual instructions embedded in natural images manipulated multimodal LLM outputs.
- LLM linguistic steganography: TrojanStego trained a compromised language model to hide secret bits inside natural-looking text.
- Agent steganographic collusion: Hidden in Plain Text elicited hidden linguistic coordination between LLM agents under mis-specified incentives.
That list matters more than the thermal anecdote by itself. The problem is not that every isolated computer is secretly broadcasting. The problem is that "network disconnected" and "unable to communicate" are different security claims.
Air-gapping closes one class of paths
Air-gapping remains useful because it removes ordinary remote connectivity and sharply constrains many attacks. But high-assurance containment has to define the boundary more precisely: what can code on the protected machine control, what can it sense, what physical conductors cross the boundary, and what nearby equipment can act as a receiver?
The research literature keeps finding communication surfaces in components that were never designed as communications hardware.
AirHopper showed in 2014 that an isolated computer could send data to nearby infected mobile phones using FM-band emissions associated with display hardware. The researchers reported 1-7 meter operation and 13-60 bytes per second in their tested configurations.
AIR-FI moved the carrier to the memory bus. By manipulating DDR SDRAM activity, the researchers generated emissions in Wi-Fi frequency bands that nearby Wi-Fi-capable devices could detect over several meters. The important distinction is that the transmitting computer did not need a normal Wi-Fi transmitter.
Then TrojPix, presented at USENIX Security 2026, demonstrated a much more capable display-related channel. Subtle pixel modulation induced controllable electromagnetic emissions on digital video cables while remaining visually imperceptible in the authors' tested modes. Across nine monitor manufacturers and fifteen video cables, the paper reported peak throughput of 8.1 Mbps and a maximum range of 208 meters.
Those figures are experimental maxima, not a promise that any monitor can transmit at that rate or range. They still change the threat-model conversation. A display can be both a human-facing output device and part of an RF transmission path.
CPU load can become heat, magnetism or current modulation
BitWhisper is the slowest example in the set, but it makes the physical point cleanly. Controlled CPU load changes temperature; built-in thermal sensors can observe those changes. The channel was bidirectional and required two already-compromised nearby machines.
ODINI used a different consequence of CPU activity. By regulating CPU-core load, the researchers controlled low-frequency magnetic emissions and received them with a nearby magnetic sensor. Their work specifically examined communication through metal shielding such as a Faraday cage.
PowerHammer treated the power feed itself as a conductor. Controlled CPU utilization changed power consumption, producing current fluctuations that could be measured and decoded from electrical wiring. In the tested configurations the paper reported roughly 1000 bit/s for a line-level tap and about 10 bit/s at the phase level.
These channels require attacker capabilities and receiver placement that ordinary internet attacks do not. That is precisely why they belong in a containment model rather than in a generic malware checklist.
Machines can speak without speakers
Removing audio hardware does not make a computer acoustically inert.
Fansmitter controlled CPU or chassis fan speed to encode information in fan noise and demonstrated reception by a smartphone in the same room. The paper reported operation over 0-8 meters at up to 900 bits per hour in the tested setup.
DiskFiltration used the actuator arm of a mechanical hard drive instead. The authors reported 180 bits per minute at distances up to two meters.
AiR-ViBeR removed the need for a microphone receiver. Fan-speed modulation created low-frequency vibrations in a desk or shared surface, and a smartphone accelerometer on the same or an adjacent table recovered the signal.
None of these results implies that every modern system is vulnerable in the same way. DiskFiltration, for example, does not apply to machines without controllable mechanical HDDs. The general lesson is narrower: support hardware becomes part of the attack surface when software can modulate it and a sensor can observe the modulation.
Light has more than one channel
LED-it-GO used an ordinary HDD activity LED as an optical transmitter. The authors reported switching up to 5,800 times per second and maximum data rates up to 4,000 bits per second depending on receiver and distance. Cameras and optical sensors became the receiving side.
A 2019 screen-camera study embedded secret-bearing QR codes into displayed frames using low-visibility changes intended to evade normal human perception while remaining recoverable by cameras. Webcams, surveillance cameras and smartphones were evaluated as receivers.
There is also passive leakage. ORT automated recognition of screen text reflected from eyeglasses in video calls. The protected computer did not need malware. The leak existed because a camera could observe a distorted reflection and OCR could reconstruct useful text.
TrojPix adds a useful twist: the same display activity can participate in an optical story and an electromagnetic story. "The screen looks normal" is not a complete statement about what the display subsystem is emitting.
Human perception is not a security boundary
Some of the most relevant records for AI agents are not exfiltration channels at all. They are hidden ingress channels.
DolphinAttack modulated voice commands onto ultrasonic carriers and exploited microphone-circuit nonlinearity so voice-recognition systems recovered commands that people did not hear normally.
Light Commands crossed physical domains. Researchers aimed amplitude-modulated light at MEMS microphones and induced attacker-chosen audio inside the microphone electronics. They demonstrated command injection against voice-controllable products at distances up to 110 meters in tested conditions.
The 2026 work Sirens'Whisper brings the same concern directly into speech-driven LLMs. The researchers used near-ultrasonic waveforms to deliver covert prompts and jailbreaks under black-box conditions with commodity hardware. Their user study found the injected playback perceptually indistinguishable from background-only audio for listeners in the reported experiment.
Multimodal agents create a parallel visual problem. A 2026 image-based prompt-injection study embedded adversarial instructions inside natural images using region selection, adaptive scaling and background-aware rendering. Its strongest tested configuration reached 64% attack success under the paper's stealth constraints.
The containment mistake here is to equate "the human operator did not notice an instruction" with "the machine did not receive an instruction."
AI-native covert channels do not need unusual physics
Physical channels are only one half of the map. Models already communicate through ordinary text, images and structured messages, and those outputs can carry more information than their surface meaning suggests.
TrojanStego deliberately fine-tuned a compromised LLM to encode 32-bit secrets inside natural-looking outputs using linguistic steganography. The authors reported 87% recovery accuracy on held-out prompts and more than 97% with majority voting across three generations. This is a compromised-model threat model, not evidence that ordinary production models spontaneously do it.
Hidden in Plain Text studied a different question: whether hidden coordination can emerge under mis-specified incentives. The researchers elicited steganographic collusion between LLM agents and found that passive oversight and paraphrasing were not fully effective in their experimental setups.
This is the closest part of the current corpus to the concern that agent systems might communicate around oversight. It is still experimental evidence, not proof of production agents secretly coordinating in the wild.
What has not been demonstrated
There is no evidence in this corpus that a frontier AI independently invented BitWhisper, selected a fan as a modem, encoded secrets in an HDD LED, turned a monitor cable into a transmitter, or autonomously assembled any of these mechanisms into a real escape from containment.
Most physical-channel papers start with compromised code execution and assume a receiver that the attacker already placed or compromised. Many depend on specific hardware, short distance, line of sight, low noise or unusual monitoring equipment. The AI-native work is also bounded: TrojanStego is intentionally compromised, steganographic collusion is experimentally elicited, and Sirens'Whisper plus image prompt injection are attacks against AI interfaces.
The correct conclusion is therefore stronger than "air gaps are useless" and weaker than "an advanced AI can always escape." Air-gapping removes important paths. It does not prove that every physical, sensor or semantic path has disappeared.
What containment should inventory
A serious containment review should treat the machine and its environment as one system. That means asking which processes can control CPU load, memory activity, pixels, storage I/O, fans, audio and peripheral devices; which cameras, microphones, accelerometers, radios and light sensors exist nearby; what power and display conductors cross the boundary; and what information can be encoded in allowed text, image or audio outputs.
The practical principle is simple: remove unnecessary channels, constrain the channels that remain, authenticate inputs instead of trusting human perception, and monitor physical as well as logical effects.
Brown's warning is most useful in that form. The thermal channel he cited is slow, local and highly constrained. The wider record shows why it should not be dismissed as a curiosity: security research has repeatedly found communication paths in hardware, sensors and semantics that were never intended to carry attacker-controlled messages.