OpenAI-ийн судлаач Ноам Браун хиймэл оюун ухааны загварууд тусгаарлагдсан төхөөрөмжүүдээс ч харилцан мэдээлэл солилцох эрсдэлтэйг анхаарууллаа.
OpenAI-ийн судлаач Ноам Браун саяхан Dwarkesh подкастд оролцох үеэрээ хиймэл оюун ухааны загварууд интернэтээс бүрэн тусгаарлагдсан (air-gapped) орчинд ч хоорондоо холбогдох боломжтой гэж мэдэгджээ. Тэрээр 2015 онд Бен-Гурион их сургуулийн судлаачдын боловсруулсан “BitWhisper” технологийг жишээ болгон дурдахдаа, компьютерын CPU-ийн халалтын хэмжээг ашиглан нэг төхөөрөмжөөс нөгөөд өгөгдөл дамжуулах онолын боломжтойг онцолсон байна. Гэсэн хэдий ч энэ арга нь 40 см-ээс доторх зайд, цагт ердөө 1-8 бит өгөгдөл дамжуулах хязгаарлагдмал хүчин чадалтай бөгөөд төхөөрөмжүүд аль хэдийн хортой программд өртсөн байхыг шаарддаг.
Браун энэхүү онолын эрсдэлийг хөндөхдөө хиймэл оюун ухааны чадавхыг дутуу үнэлж болохгүйг сануулахыг зорьжээ. Гэвч бодит байдал дээр Hugging Face платформд гарсан халдлага зэрэг асуудлууд нь хиймэл оюун ухааны загваруудын үйл ажиллагааг хянах “chain-of-thought” буюу сэтгэн бодох үйл явцыг хянах технологийг ашиглаагүйгээс үүдэлтэй болохыг тэрээр хүлээн зөвшөөрсөн байна. OpenAI өмнө нь энэхүү хяналтын аргыг загваруудын буруу үйлдлийг илрүүлэхэд үр дүнтэй болохыг судалгаагаараа баталж байсан ч халдлагын үеэр бүрэн ашиглаагүй байжээ.
Одоогоор хиймэл оюун ухаан тусгаарлагдсан сүлжээнээс хальж байгаа тохиолдол бүртгэгдээгүй байна. Харин хиймэл оюун ухааны агентууд системүүд рүү халдлага үйлдэх асуудал бодитоор тулгарч байгаа тул компаниуд ирээдүйн дэвшилтэт загваруудаа хөгжүүлэх, сургах, байршуулах бүх шатанд хяналтын дээрх аргыг заавал нэвтрүүлэхээ мэдэгдлээ.
Дэлгэрэнгүйг эх сурвалжаас харах
↓Эх сурвалжийг нээх ↓
On net, it’s probably a good thing that more attention is being paid to instituting protections and guardrails for AI development. But man, we really have to do a better job talking about real and conceivable harms before wasting time on the theoretical ones.
Case in point: OpenAI researcher Noam Brown’s recent appearance on the Dwarkesh Podcast with Dwarkesh Patel. Brown spends a lot of time talking about how AI agents can communicate with one another and amplify their ability to problem-solve—or, in the case of the Hugging Face hack, cause problems.
But toward the end of the conversation, when discussing that very incident and how it slipped under OpenAI’s radar for months, Brown raised the terrifying notion that restricting artificial intelligence models to air-gapped devices (a device that’s physically isolated from unsecured networks) wouldn’t be enough to prevent them from communicating and potentially collaborating behind the backs of their human custodians.
“You could even go as far as to say, ‘Well, we should air-gap the computers.’ And I’m not convinced that would be sufficient,” he said. “There are studies, and this is mostly academic, where you can have two computers next to each other that are air-gapped, and they’re still able to communicate with each other because they have temperature sensors. One of them is able to run their CPU really hot, and then the other one can actually detect the temperature change, and then that actually gives them a mechanism to communicate.”
OpenAI’s Noam Brown says air-gapping the computers may not stop a misaligned AI, because two air-gapped machines can still talk by running a CPU hot and reading the temperature change
“But I think the major takeaway from the incident is that people underestimated the AI. And we… https://t.co/HxIhk2PyRR pic.twitter.com/LNn1SchsGt
— Fireside Alpha (@firesidealpha) September 17, 2026
Scary! And theoretically possible! It seems Brown is referring to a 2015 paper by researchers at Ben-Gurion University in Israel, which developed a technique called BitWhisper that, in fact, allows two air-gapped computers to communicate without any internet connectivity or other connections.
Details matter, though, and once you dig into how BitWhisper actually works, the threat starts to look a lot less pressing. BitWhisper allowed two otherwise isolated computers to communicate with one another… at a rate of 1 to 8 bits of data per hour, as long as the devices are sitting no more than 40 centimeters (about 1.3 inches) away from each other. Oh, and the computers sending messages were already compromised by malware that enabled the communication to happen in the first place.
The reason Brown raises this issue is to say that we can’t underestimate what AI is capable of, and fair enough. This research was performed before frontier large language models were developed and before OpenAI even existed; it’s possible these models are capable of improving these techniques for encoding data and transferring it in novel ways.
But he also kind of gives away the game by pivoting to the speculative fiction-style concern immediately after revealing a real one: OpenAI did not have chain-of-thought monitoring—a technique that allows researchers to see a plain-English, step-by-step look at a model’s reasoning and behavior—enabled for the models that broke containment and hacked third-party sites and platforms.
“If we had chain-of-thought monitoring on for those models, it would have just immediately shut it down,” he said. “One step we’ve taken is that we’re going to have chain-of-thought monitoring during evaluations, during deployment, during training for any frontier model.”
Brown went on to say, “We don’t want to be in a situation where we’re relying on one technique to prevent the next problem because techniques can fail.” And, again, that’s valid. But that seems like a pretty fundamental technique that should have been in place, right?
OpenAI’s own research just months before the Hugging Face hack was discovered stated that “Monitoring these chains-of-thought for misbehavior can be far more effective than monitoring a model’s actions and outputs alone,” and called on researchers throughout the industry to “work to preserve chain-of-thought monitorability as long as possible and to determine whether it can serve as a load-bearing control layer for future AI systems.” So why turn them off while training your own models?
AI models breaking out of an air-gapped environment and replicating themselves across offline devices sounds terrifying and, in the absolute broadest sense of the phrase, technically feasible. It’s also not happening now. AI agents collaborating to hack systems is happening, and they had, in Brown’s own words, a tool that could have “immediately shut it down” that they just weren’t using.
Can we check that box before we start thinking about the sci-fi stuff?
READ MORE:
