Calm down. · Both
Calm down: read the letter, not the headline
The headline: "Scientists call for international body to oversee advanced AI." It sounds like a doomer petition. Calm down.
The letter itself is titled "An Open Letter on AI and Cybersecurity from the Scientific Community." It has 453 signatories. Hinton and Bengio are on it, and so is a long list of security researchers: Dan Boneh, Ron Rivest, Thorsten Holz, Carmela Troncoso, Florian Tramer, Nicolas Papernot. The incidents it describes are AI models that "bypassed insufficiently sandboxed environments to compromise the systems of external organizations." One reading, per the letter, is "an irresponsible lapse in standard cybersecurity practices, preventable with stronger sandboxes and procedures." Nothing escaped. Somebody shipped a bad sandbox.
My take is three questions.
Should labs do better security? Yes, but airgapping isn't the answer. The letter says labs building, deploying, or testing cyber-capable models should "immediately adopt high-assurance containment systems." Agreed. It also says they should "initially default to airgapping." That's where I disagree. An airgap means physically disconnecting the system. It's a blunt tool, and it's impractical for systems that have to be built, tested, and used. A firewall rule is not an airgap. Real containment is default-deny egress, network segmentation, allowlisted destinations, least privilege, and monitoring. That's what we already do for any risky workload. Nobody needs a new international body to configure that.
Will failures happen anyway? Yes. The letter says that without changes "such incidents will continue to occur." I'd go further: they'll keep happening even with changes. That's why incident response exists. When a model breaks out and hits someone else's network, it's a security incident. Treat it like one, with responders, forensics, the disclosure rules we already have, and the laws for unauthorized access we already have.
Does that mean a new international body? No. Here's what the letter proposes. Working "in consultation with governments and a wide range of both AI and cybersecurity experts," set up an international body. It would standardize best practices for containment approaches that allow more access than airgapping, such as internet connectivity, and "record and track containment failures." Failures "must be reported to the body and eventually made public."
The letter doesn't spell out how that would be enforced. My opinion: anything along those lines becomes regulatory capture. Compliance costs money. The big labs can afford it. A five-person startup can't. A standards body the incumbents help design becomes a moat the incumbents get to fill. The labs whose sandboxes failed come out of it as the only ones allowed to build. That's a strange prize for failing.
For context, Reuters notes the EU says its AI Act is already sufficient. Yann LeCun didn't sign and has argued the incidents mostly reflect engineering failures. Per Reuters, the big labs also signed a voluntary White House accord a month ago with no enforcement mechanism. Weak promises are a fair complaint. I'd fix that with existing law, not a new gatekeeper.
Do these people know you can just enforce the rules you already have?
What to do: If you run agents, give each one its own segmented sandbox with default-deny egress, an allowlist of destinations it actually needs, no standing credentials, and least-privilege tools. Log every tool call somewhere the agent can't write to. When containment fails, treat it as a security incident: preserve the logs, bring in IR, and check your breach-notification obligations.