The report
On September 17, 2026, OpenAI researcher Noam Brown told Dwarkesh Patel that he was not convinced air-gapping alone would necessarily be sufficient as a containment measure for increasingly capable AI systems.
The example he cited was BitWhisper, a 2015 research prototype that created a bidirectional thermal channel between two already-compromised nearby computers. The reported range was roughly 0-40 cm and the effective rate about 1-8 bits per hour. That is enough for a tiny command or secret, but the experiment did not show an AI discovering the method, compromising a second machine or escaping a secure environment.
What makes Brown's comment relevant now is the breadth of the surrounding research rather than the thermal result by itself.
Digging Beagle's current covert-channel set contains 18 vulnerability and research records spanning thermal signaling, FM and Wi-Fi-band emissions, magnetic fields, power lines, fan and HDD acoustics, surface vibration, status LEDs, low-contrast QR codes, eyeglass reflections, ultrasonic command injection, light-to-microphone injection, near-ultrasonic LLM prompts, image-based prompt injection and linguistic steganography.
Several of the newest records are substantially more capable or more directly AI-relevant than BitWhisper.
At USENIX Security 2026, TrojPix used visually imperceptible pixel modulation to induce controllable electromagnetic emissions on digital video cables. Across the authors' tested hardware, the paper reported peak throughput of 8.1 Mbps and a maximum range of 208 meters. Those are experimental maxima and should not be generalized to arbitrary displays, cables or environments.
For speech-driven models, Sirens'Whisper used near-ultrasonic waveforms to deliver covert prompts and jailbreaks under black-box conditions with commodity hardware. A controlled user study reported that the injected playback was perceptually indistinguishable from background-only audio for listeners in the tested setup.
For multimodal models, an FLLM 2025 image prompt-injection paper, posted to arXiv in March 2026, reported 64% success for its strongest low-contrast configuration on image-only GPT-4-turbo queries. The outcome was attacker-requested text, not a measured tool action or data leak.
AI-native covert communication is also becoming a research topic of its own. TrojanStego trained a compromised LLM to hide 32-bit secrets inside natural-looking text. Hidden in Plain Text elicited steganographic collusion between LLM agents under mis-specified incentives and reported that passive oversight and paraphrasing were not fully effective in the experimental setups.
None of those results demonstrates autonomous AI escape. They do establish separate pieces of the threat model: machines can communicate through unintended physical effects; human-imperceptible inputs can still be machine-readable; and model outputs can carry hidden information beyond their visible semantic content.
Brown also raised a separate monitoring concern in the same interview, arguing that chain-of-thought monitorability is showing signs of degradation as models become more capable. That issue is distinct from air-gap leakage, but the security principle is similar: a control that works today should not be treated as the only control protecting a high-consequence system.
Digging Beagle records these mechanisms as vulnerabilities and research capabilities, with prerequisites and evidence limits kept separate from incidents. A future report that an AI agent independently selected and operationalized one of these channels would require a different evidence class and much stronger proof.