Just because something is hard, doesn't mean it isn't worth doing. OpenAI haven't even tried to contain their agents, instead letting them loose on the internet and telling them to collaborate. While this is interesting research, it's very much academic research at this point (though of course it will enter training data for AI agents being encouraged by OpenAI to escape their 'sandbox').

We are a long way from AI agents escaping air-gapped computers, let's worry about that when it's an actual problem and when the companies running thousands of agents are acting responsibly.

> These and other methods are good reason to believe that AI can never be 100% contained, which gives me pause.

On the plus side this requires collaboration both from the inside (on the airgap side) and the outside.

If you install a computer that's not running AI and it's airgapped, it won't suddenly start emitting radio waves out of nowhere.

We should not fall, once again, for the following logical fallacy: "Under exceptionally crazy circumstances it's possible to use RAM or the power line to exfiltrate data from a compliant airgapped computer, hence airgapping computers is pointless".

We spent so much time talking about the dangers of AI ‘escaping’ when what actually happened is we gave it a scope of work and an internet connection and demanded it get to work.

Not quite 100%, the article gives Faraday cage as an expensive countermeasure: "We analyzed and measured the effect of the Faraday chassis on the RAMBO covert channel using copper foil. This has electric field high Shielding properties (above 100 dB) and magnetic fields. The copper standard width is 1 mm effectively blocks the EMR from the transmitting workstation. However, as noted in the following section, this solution is costly and can not be deployed widely."

>These and other methods are good reason to believe that AI can never be 100% contained, which gives me pause.

Easy, throw out the computer. Go analog if your work is so sensitive. Now you might say, "but what about the computers and all we use them for," but really reflect deeply over what exactly we are doing with these computers. I'll send an email to someone, no different than what I might have mailed them in years past. I'll pull up the calculator and do some math that I could have done by hand. I might write a function to ingest some data from one file and put it in another file in another format, work that used to be done with printed data and by hand.

The sobering thing with computers is that they really didn't change the world that much. We basically shoehorned them into the existing analog apparatus that controlls the world. Aside from the people who had jobs wrangling data among spreadsheets by hand, point to any company and its basically structurally exactly the same pre computers as it is today with three year leases to computers to all staff (aside from the existence of an IT department managing that gear I guess).

> These and other methods are good reason to believe that AI can never be 100% contained, which gives me pause.

Can’t leak secrets if you don’t have RAM.

Collocation.

There are many other versions of this. You can modulate bits in the power consumption pattern or in the heat emissions or air pressure/audio. You can even plant outages and observe staff reaction/tickets externally to some extent.

A rogue PSU could modulate information back over the electrical wire. However getting it out will require doing a physical wiretap on potentially high-voltage electricals. Also, it will likely have to be exfil'd at or across a power transformer sitting outside the data centre. Not sure if the signal will survive long enough (like literally, in line length terms), for exfil to work.

brb reviewing some EE material...

But don't expect much from me... I wanted to do a final year project in Power Line Communication for my electrical engineering undergrad. Then-me decided it was a dead end... cannot go WAN-scale; too much line noise and signal transmission power loss. I did something else with power electronics---I can't remember---but then again, my undergrad was also a dead end :p

Yeah, I've often wondered about this, but more locally (say within a local office, or maybe a data centre)...

I wonder if even "just" throttling up/down the CPU / GPU on tasks as morse code might be visible externally to other devices on the same mains supply. Obviously it would be very inefficient speed-wise, but a higher current (say + 300 watts for the GPU being used) should result in a slightly lower voltage on the mains supply I think for the duration?

Obviously things like PSUs could (I'm not an expert at any of this) get in the way of this, and I'd assume in data centres there's some isolation between different racks.

But for a scenario of DIY "airgapping" two machines in an office for AI testing (i.e. not doing it very well), it might be a plausible way of AIs finding to communicate if there's no actual network connection.

Obviously other electronic devices connected to the same mains circuit could also be adding their own noise, which might make it a lot harder to actually identify and decode the response, but... if ML/AI agents are good at anything, it's finding patterns, so I wouldn't want to bet against it being theoretically possible...

There is information that leaks through the power line as well, and the author of this paper also has a paper on how to exfiltrate through the power line at a much slower rate https://arxiv.org/abs/1804.04014

I heard that couple decades ago there was a product for "socket internet" - you plugged it into normal wall socket, and it communicated through power wires

Powerline Networking is what you are referring too.

Still available today, and has worked well for me when I've needed it.

[dead]

So how do you propose to address the inevitable vulnerabilities in firmware that hasn’t been updated? A tech must be physically present to flip the switch before updating?

The same thing killed electronic voting machines in The Netherlands.

No matter how well you argue that it is "perfectly secure", when some nerd outside the polling station is showing reporters a real-time feed of who people are voting for, your machine will get thrown out.

It wasn't quite CRT-level of mirroring, but it wasn't far off...

And you still can with HDMI and eDP.

Indeed! I was a bit skeptical to see it is a single-author paper (thinking it might be one of those Claude-generated ones), and I appreciate that you pointed out this is somebody worth listening to.

there's a usb plugged into the ethernet port

Probably, but it will still be insecure against a sufficiently resourceful attacker.

If you want the thing you're isolating to be useful to you at all, you will need to have some physical connection between the inside and the outside, i. e. a hole in your air gap.

If we extend this logic a bit, we also need optical and audio filters. Imagine maxing the fans and returning them back to normal speeds slow enough to be able to pick up the noise through a microphone. Or reading the RJ45 socket LED. So many ways to transfer data. It just comes down on how hard it is to exploit such a medium.

https://en.wikipedia.org/wiki/Tempest_(codename)

Yes, and you can defend against any single attack that you think of in advance, but you will still be surprised by one you haven't thought of that was used by a sufficiently resourceful attacker.

If you want the thing you're isolating to be useful to you at all, you will need to have some physical connection between the inside and the outside, i. e. a hole in your air gap.

Putting it beside a Tesla coil would work too, make more noise than the computer does and you'll bury the signal.

Of course, now you've got a Tesla coil in your data centre, which will bring you a whole new set of Interesting Problems to cope with.

There is always a way. A program could take control of the LEDs on the PC and export data by flashing them in certain patterns.

Yes, Faraday shielding is one of many considerations when building a SCIF or other EMSEC zone.

[dead]

[dead]

1kB/s is pathetically low? You can exfiltrate a root CA private key that is valid for a decade in 3-4 s with that.

And these surprising attack vectors demonstrate that there will always be another hole in your protection. Even if you account for people-bed attacks, and air-gap your system better, there is always something else you didn't think of yet.

> most cases have giant holes in the side (case windows) acting as slot antennas.

They won't act as slot antennas unless they are tuned to the frequency you wish to transmit on, and actually electrically connected on each side to your transmitter.

I have my computer in a metal box because it has caught fire twice.