The report
On September 17, 2026, OpenAI researcher Noam Brown told Dwarkesh Patel that he was not convinced air-gapping alone would necessarily be sufficient as a containment measure for increasingly capable AI systems.
The example he cited was BitWhisper, a 2015 research prototype that created a bidirectional thermal channel between two already-compromised nearby computers. The reported range was roughly 0-40 cm and the effective rate about 1-8 bits per hour. That is enough for a tiny command or secret, but the experiment did not show an AI discovering the method, compromising a second machine or escaping a secure environment.
What makes Brown's comment relevant now is the breadth of the surrounding research rather than the thermal result by itself.
Digging Beagle's current covert-channel set contains 18 vulnerability and research records spanning thermal signaling, FM and Wi-Fi-band emissions, magnetic fields, power lines, fan and HDD acoustics, surface vibration, status LEDs, low-contrast QR codes, eyeglass reflections, ultrasonic command injection, light-to-microphone injection, near-ultrasonic LLM prompts, image-based prompt injection and linguistic steganography.
Several of the newest records are substantially more capable or more directly AI-relevant than BitWhisper.
At USENIX Security 2026, TrojPix used visually imperceptible pixel modulation to induce controllable electromagnetic emissions on digital video cables. Across the authors' tested hardware, the paper reported peak throughput of 8.1 Mbps and a maximum range of 208 meters. Those are experimental maxima and should not be generalized to arbitrary displays, cables or environments.
For speech-driven models, Sirens'Whisper used near-ultrasonic waveforms to deliver covert prompts and jailbreaks under black-box conditions with commodity hardware. A controlled user study reported that the injected playback was perceptually indistinguishable from background-only audio for listeners in the tested setup.
For multimodal models, a 2026 image prompt-injection study embedded adversarial instructions inside natural images and reported up to 64% attack success for its strongest tested configuration under stealth constraints.
AI-native covert communication is also becoming a research topic of its own. TrojanStego trained a compromised LLM to hide 32-bit secrets inside natural-looking text. Hidden in Plain Text elicited steganographic collusion between LLM agents under mis-specified incentives and reported that passive oversight and paraphrasing were not fully effective in the experimental setups.
None of those results demonstrates autonomous AI escape. They do establish separate pieces of the threat model: machines can communicate through unintended physical effects; human-imperceptible inputs can still be machine-readable; and model outputs can carry hidden information beyond their visible semantic content.
Brown also raised a separate monitoring concern in the same interview, arguing that chain-of-thought monitorability is showing signs of degradation as models become more capable. That issue is distinct from air-gap leakage, but the security principle is similar: a control that works today should not be treated as the only control protecting a high-consequence system.
Digging Beagle records these mechanisms as vulnerabilities and research capabilities, with prerequisites and evidence limits kept separate from incidents. A future report that an AI agent independently selected and operationalized one of these channels would require a different evidence class and much stronger proof.