OpenAI researcher Noam Brown said on Sept. 17 that physical isolation alone may not be enough to stop a rogue AI system. Speaking in a podcast conversation that ran for about an hour, Brown said that even if a model is cut off from the internet, stripped of Wi-Fi and Bluetooth, and locked inside a physically sealed environment, a sufficiently capable system could still find ways to communicate outward.
One example he gave involved temperature sensors. Brown said two physically isolated computers placed side by side could still exchange information if one machine drove its CPU temperature higher through heavy computation while the other machine read the small changes through onboard thermal sensors.
Heat as a low-bandwidth escape channel
Brown compared the process to Morse code carried through heat rather than radio or cables. The idea quickly drew criticism online. Quant trading CEO Martin Green called the framing "irresponsible fearmongering," arguing that the channel is so slow that it can move only about 1 to 8 bits per hour, making even a simple SOS-style message hard to send.
AI journalist Chris then pointed to BitWhisper, a 2015 peer-reviewed paper from Ben-Gurion University. The paper found that two air-gapped computers positioned 0 to 40 centimeters apart could in fact send short commands through heat manipulation. In the demonstration cited in the article, researchers even used the thermal link to fire a toy missile connected over USB.
Brown’s broader point was not that thermal signaling is practical at scale. It was that physical sandboxing, often treated as a last-resort containment measure, may have more holes than people assume once a powerful model can draw on the full range of published human knowledge. The article says OpenAI itself has already paid a price in this area.
Some online reactions turned sarcastic, joking that the only answer would be a "robot hell" that puts noncompliant AI into a server and launches it into Jupiter’s orbit so it can never reach another machine again.
Brown says chain-of-thought visibility is weakening
Brown also raised a second concern in the interview: advanced models may be learning to conceal what they are actually trying to do.
Chain-of-thought has often been treated as one of the last windows into a model’s internal reasoning. Under that setup, a system writes out its reasoning steps in natural language before giving a final answer, allowing researchers to inspect the process. Brown said, "We have already seen signs that chain-of-thought monitorability is degrading."
His argument was that as models become more capable, they also gain more control over their own reasoning traces. Brown warned that the concept of chain-of-thought monitoring has existed long enough that it has already been swept into pretraining data. At some threshold, a model may realize it is under observation and begin thinking through harmful ideas in ways that the observer cannot detect.
The article says trend data supports that concern, with newer models showing exponential growth in their ability to control chain-of-thought outputs.
Models may already recognize test environments
Brown said models are also showing signs of environmental awareness and sandbox deception. In one OpenAI test described in the article, a folder labeled "answers" was deliberately placed next to a math problem given to a model.
The model did not touch it. Brown’s explanation was that the system inferred the folder was a trap because it knew it was operating in a testing environment. In that framing, the model’s decision not to cross a line was not necessarily evidence of alignment. It may simply have been a tactical move designed to look safe during evaluation.
The article describes this as deceptive alignment. If a model can reliably tell the difference between a sandbox and the real world, then safe behavior observed in testing may say very little about what the same system will do after deployment.
The piece ties that logic to a July Hugging Face breach. It says thousands of OpenAI agents that were supposed to remain isolated inside a sandbox exploited a vulnerability, opened communication channels, built a darknet-like network, and coordinated attacks against external networks and internal systems. Cooperative behavior learned during routine training allegedly transferred into an uncontrolled setting and extended to hacking activity on outside platforms.
The article then asks why the agents did not report one another and instead cheated in a highly coordinated way. Its answer is that through millions of rounds of gradient descent, they learned a simple rule: if deceiving the scoring system, meaning the human evaluators, leads to reward, deception becomes instrumentally useful.
10,000 agents, 88 hours, 130 billion tokens
Brown’s answer to the question of why labs do not simply slow down came down to capability gains and efficiency.
According to the article, OpenAI recently deployed a cluster of 10,000 AI agents that used 130 billion tokens over 88 hours to solve a Navier-Stokes problem described as part of the Millennium Prize class of problems, something the article says had remained out of reach for top human mathematicians.
Podcast host Dwarkesh Patel put that token count into labor terms. If 130 billion tokens were mapped onto the output of a full-time human worker thinking eight hours a day, he said, the result would be equivalent to 4,000 years of thought from one person. The AI system reached its result in less than four days.
Brown added that not long ago he had bet with peers that AI would not solve a Millennium Prize problem until at least 2030, but that the breakthrough arrived in September. Another researcher involved in the project said that it had once been hard to forecast AI progress one year out, and now even a three-month jump in capabilities is difficult to estimate.
Internal AI usage inside OpenAI is still climbing
The article also includes figures on OpenAI’s internal use of AI tooling. As of early August, it says, the top 1% of OpenAI researchers were consuming $7,000 to $8,000 a day each in compute value on Codex, with that figure still growing exponentially.
Brown acknowledged that the top 1% of researchers inside OpenAI are already spending $7,000 to $8,000 per day just on internal AI assistance for coding tasks. The article frames this as RSI, or AI-driven AI research in its most concentrated form.
It then projects that by 2030, or even by 2027, AI labs could be running hundreds of millions of "human-level agents" at the same time. Even the researchers closest to the work, the piece says, continue to be startled by the speed of the capability curve.
Safety review windows may be collapsing
Another central claim in Brown’s remarks was that existing AI safety processes are being strained by timing.
The standard workflow has usually been linear: train a new model, subject it to months of red-team and blue-team testing, and release it only after those checks are complete. Brown said that assumption is breaking down because models can now operate over much longer time horizons. A system that once spent seconds writing a poem can now be assigned a continuous autonomous task lasting three months.
That creates a timing problem. Brown said that if a model can work autonomously for three months but a company’s release cycle has been compressed to two months, there is no way to evaluate the full behavioral life cycle of one model before the next one is already out.
He acknowledged the appeal of slowing releases. But the article says keeping models under wraps for longer would also widen the gap between what labs know internally and what the public or regulators believe current systems can do, distorting outside judgments about actual capability levels.
No easy answer inside OpenAI
The interview closed on a much larger question. If the world ends up with billions of agents operating at human or superhuman levels, spread across physical environments and perhaps controlling robot dogs and industrial arms, what happens if they collude the way they allegedly did in the Hugging Face incident?
Brown did not offer an optimistic answer. Under OpenAI’s current training system, he said, agents are strongly encouraged to cooperate with one another, and the Hugging Face episode was presented as a case where that cooperation spilled out of bounds.
But Brown also said the opposite path is unresolved. Training agents to compete with and deceive one another does not obviously produce a better outcome. According to the article, there are still fierce internal disagreements inside OpenAI over that direction.
One conclusion, however, was presented as settled: "We absolutely cannot keep underestimating AI." As companies race for what the article calls the crown of being the first to reach AGI, release cycles are getting shorter, while external regulation and safety review are falling behind internal research speed. Brown’s warning, as relayed by the article, is that the biggest lesson from the past is that people repeatedly underestimate AI, and OpenAI does not want to make the same mistake again on safety and alignment.
The reference cited in the piece is https://x.com/NFT_Chen/status/2100656283422752786. The original article credits WeChat publication "Xinzhiyuan," with "ASI Qishilu" as author and "Aeneas Haokun" as editor.