Noam Brown cited thermal covert channels when questioning air-gap sufficiency

On September 17, 2026, OpenAI researcher Noam Brown said he was not convinced air-gapping alone would necessarily be sufficient for very capable AI systems, citing academic thermal covert-channel research. He separately warned that chain-of-thought monitorability is showing signs of degradation. The thermal example demonstrates a narrow laboratory channel between already-compromised nearby machines; it is not evidence of an AI autonomously escaping an air gap.

A dated change to public knowledge. Follow the affected records for their current evidence.

Published

Sep 17, 2026

The report

On September 17, 2026, Dwarkesh Patel published a long interview with OpenAI researcher Noam Brown covering multi-agent systems, recursive self-improvement, alignment and chain-of-thought monitoring.

During the safety discussion Brown argued that increasingly capable systems should not be protected by a single mechanism. After discussing sandbox security, he raised air-gapping as an extreme containment measure and said he was not convinced it would necessarily be sufficient. His concrete example was academic research in which adjacent air-gapped computers exchanged data through CPU-generated heat and built-in temperature sensors.

That example is BitWhisper, published in 2015. The experiment required two already-compromised computers at close range. The authors reported 0-40 cm separation and an effective rate of roughly 1-8 bits per hour. That is enough for a brief command or a small secret, but it is not a substitute for an ordinary network and it is not evidence that an AI has autonomously escaped a containment environment.

Brown also discussed a separate monitoring concern: chain-of-thought observability. He said researchers are already seeing signs that monitorability is degrading as models become better able to control what appears in their reasoning traces. His argument was not that chain-of-thought monitoring is useless; rather, he warned against relying on any single safety mechanism.

The wider covert-channel literature makes the architectural point stronger than the thermal example alone. Researchers have demonstrated RF emissions from memory buses, magnetic channels through Faraday shielding, conducted signals on power lines, inaudible or mechanical acoustic channels, optical leakage through screens and LEDs, and more recently high-throughput electromagnetic signaling induced by imperceptible pixel changes. None of those papers demonstrates autonomous AI escape. Together they show why a high-assurance containment boundary has to model the physical machine and its environment, not only the network interface.

Research behind this

Cite this record

DiggingBeagle. “Noam Brown cited thermal covert channels when questioning air-gap sufficiency.” Published Sep 17, 2026. https://diggingbeagle.com/updates/noam-brown-air-gap-covert-channel-caution/

Citation guidance

The source matters after the headline fades.

DiggingBeagle is a non profit research project documenting AI security incidents, agent failures, vulnerabilities and AI-assisted operations. A case keeps its claims beside the sources that support, contest or limit them. Later updates stay visible, so a reader can see when the account changed.

We publish case reconstructions, dated reporting and analysis across records. Each has a different evidentiary role. About the project and our methodology explain how the work is reviewed.