Thermal signalling between air-gapped computers is a documented technique, published in 2015. But it carries one to eight bits per hour between two machines that are already infected with malware, which is a long way from an AI breaking out of isolation.
Key takeaways
- The thermal air-gap channel attributed in viral clips to an OpenAI researcher was in fact demonstrated in 2015 by a team at Ben-Gurion University of the Negev in a paper called BitWhisper.
- BitWhisper reports an effective rate of one to eight bits per hour at a separation of zero to 40 centimetres, and it requires malware to be present on both computers before any signalling can begin.
- That precondition is the part most often dropped in circulation: the channel is a way for two already-compromised machines to talk, not a way for software to reach a machine it has never touched.
- The underlying point that perfect physical isolation does not exist is correct and well established, but the published numbers do not support the stronger reading that an air gap would fail to contain a misaligned AI system.
The argument rests on a real paper that says something narrower than the clip
The claim circulating in September 2026 is that air-gapping computers may not stop a misaligned artificial intelligence, because two isolated machines can communicate by deliberately heating one CPU and reading the resulting change on the other machine’s built-in thermal sensors. The mechanism described is accurate. It is also not new, and it did not originate at OpenAI.
The primary source is BitWhisper: Covert Signaling Channel between Air-Gapped Computers using Thermal Manipulations, by Mordechai Guri, Matan Monitz, Yisroel Mirsky and Yuval Elovici of the Cyber Security Research Center at Ben-Gurion University of the Negev. It was posted to arXiv in April 2015 as arXiv:1503.07919 and presented at IEEE CSF 2015. The paper is available at https://arxiv.org/abs/1503.07919 and should be the reference point for any assessment of the claim, because it contains the measurements that the viral version of the story leaves out.
Read against the paper, the claim splits into two parts that behave very differently. The first is that an air gap is not a perfect isolation guarantee. That is supported, and has been supported for a decade. The second, which is what most of the clips imply, is that this weakness is of a kind and a scale that a capable AI system could exploit to escape containment. The paper does not establish that, and its own framing of realistic use points in the opposite direction: the authors describe infiltrating short commands or exfiltrating tiny secrets such as a password.
The researcher who made the remark, Noam Brown, later posted on X under the handle polynoamial that the example was academic and was intended to illustrate how hard absolute isolation guarantees are, which is why layered defence matters. Most of the viral clips omitted that clarification. English-language coverage of the claim ran on Gizmodo.
The measured bandwidth is one to eight bits per hour at close range
The most important numbers in BitWhisper are the ones that describe how slowly and how narrowly the channel works. The paper reports an effective rate of one to eight bits per hour. The two machines must sit between zero and 40 centimetres apart.
Those two figures together define the technique’s practical envelope. At eight bits per hour — the top of the reported range — a single byte takes an hour. A short password of a dozen characters takes most of a day of uninterrupted, undisturbed transmission. A megabyte is not a meaningful unit of discussion at this rate. There is no version of these measurements in which a substantial body of code or model weights moves across the gap.
The distance constraint is just as restrictive. Thermal coupling between two computer cases depends on proximity and on the ambient thermal environment. At 40 centimetres the machines are effectively adjacent on the same desk or the same rack shelf. This is not a channel that reaches across a room, let alone across a building or a secured perimeter. Any deployment that places an air-gapped system in its own space, which is the normal reason for air-gapping in the first place, removes the precondition entirely.
Heat is also a slow and noisy medium. A CPU heats and cools over minutes, not microseconds, and the receiving sensor reads a value that is influenced by room temperature, ventilation, other hardware in the case and whatever else the machine happens to be doing. The paper’s rate reflects those physical limits rather than an engineering shortcut that a cleverer implementation would remove.
Both machines must already be compromised before the channel exists
The precondition is the decisive detail, and it is the one that most often disappears when the claim is summarised. BitWhisper requires malware on both computers. One side needs code that deliberately modulates its own thermal output by loading the processor in a controlled pattern. The other side needs code that samples its own thermal sensors on a schedule and decodes the pattern.
Neither of those happens by accident, and neither is something the isolated machine does on its own. A machine with no attacker-controlled software running on it has nothing polling its thermal sensors for a signal, and it will not interpret its neighbour’s warmth as anything at all.
This matters for the AI-escape reading specifically. In the scenario people took from the clip, an AI system confined to an air-gapped machine uses thermal signalling to get out. But the channel does not provide a path from a compromised machine to a clean one. It provides a low-bandwidth link between two machines that an attacker has already breached by some other means — a supply-chain implant, an infected USB device, an insider. The hard part of crossing an air gap is the initial compromise of the second machine, and BitWhisper assumes that hard part has already been solved. It is a covert channel for coordination and small-scale exfiltration, not an intrusion technique.
A decade of similar research shows the same profile every time
BitWhisper is one entry in a large family of air-gap covert channels published by the Guri group at Ben-Gurion. The list includes ODINI, which uses magnetic fields; PowerHammer, which modulates signals onto power lines; AIR-FI, which generates Wi-Fi-band signals from hardware with no Wi-Fi adapter; LANTENNA, which uses Ethernet cables as radio antennas; AiR-ViBeR, which uses vibrations; COVID-bit; ETHERLED, which blinks network card LEDs; and PIXHELL, which encodes data in screen pixel noise.
The technical variety is considerable, but the security profile is consistent across the whole family: ingenious, demonstrated in laboratory conditions, very slow, range-limited, and dependent on prior compromise of the endpoints involved. None of them is a remote intrusion method. All of them answer the question “given that I have already got code onto this isolated machine, how do I get a small amount of data back out” rather than “how do I get onto an isolated machine in the first place”.
That consistency is itself evidence about how to read the viral claim. The existence of a decade-long research programme demonstrating that air gaps leak is exactly why the underlying point is uncontroversial among security engineers, and exactly why it does not carry the implication attached to it. Defenders in high-assurance environments have responded with layered controls — physical separation distances, shielding, zoning rules, restrictions on peripherals and removable media, emissions standards — precisely because the assumption that an air gap is a perfect boundary was abandoned long ago.
The strongest case against this assessment
The fairest objection is that bandwidth is the wrong metric for the threat being discussed. A misaligned AI system, in the scenario under discussion, is not trying to exfiltrate itself byte by byte. It would need only a small number of bits to matter: a command to a confederate process, a cryptographic key, a short instruction that causes a much larger action on the other side. The paper’s own framing concedes this by describing the infiltration of short commands as the realistic use case. Eight bits per hour is ample for a signal whose content is a single decision.
A second version of the objection concerns the compromise precondition. Published attacks represent a floor on capability, not a ceiling, and the floor was set by human researchers in 2015 with ordinary hardware. A system substantially better than humans at systems engineering might find channels with different requirements, or exploit firmware and management-controller code paths that provide sensor access without anything a defender would recognise as malware.
Both points are reasonable, and both argue for treating air gaps as one control among several rather than as a guarantee. That is the position Brown described in his follow-up post. What neither point does is convert the BitWhisper measurements into support for the stronger claim. The objection is about what might be true, not about what the paper demonstrates, and the gap between those two things is where the viral version of the story went wrong.
What would change this conclusion
Three kinds of evidence would shift the assessment. The first is a peer-reviewed demonstration of a covert air-gap channel that does not require pre-existing malware on the receiving machine — something that turns thermal or electromagnetic coupling into an entry vector rather than a signalling medium between two breached endpoints. Nothing in the published Ben-Gurion corpus does this.
The second is a channel with bandwidth several orders of magnitude higher at a practical distance, which would change what “small exfiltration” means. Reported rates across this research family have stayed low; a demonstration in the kilobits-per-second range at metres of separation would be a materially different result.
The third is a documented real-world incident, rather than a laboratory result, in which one of these channels was used operationally. Public evidence of that is not available, and its absence after a decade of published techniques is itself informative about the operational difficulty.
Until then the verdict holds in both directions. Perfect physical isolation does not exist, and saying so is correct. But the distance between a channel carrying eight bits per hour between two already-infected machines 30 centimetres apart and an AI escaping an air gap is not covered by anything in the paper.
Sources and further reading
- The primary academic paper on the thermal channel, published on arXiv in April 2015 by researchers at the Cyber Security Research Center, Ben-Gurion University of the Negev, and presented at IEEE CSF 2015.
- The wider published corpus of air-gap covert channel research from the same group, covering magnetic, acoustic, optical, electromagnetic, power-line and vibration-based techniques.
- A public clarification posted on X by the researcher whose podcast remark circulated, describing the example as academic and arguing for layered defence.
- Gizmodo, which carried English-language coverage of the claim as it spread.
Surfaced from the manual signal “viral air-gap security claim”. AI-assisted draft, editorially reviewed.
