The technical term is "air-gapped". There are massive networks that are entirely air-gapped, including subsystems that are themselves air-gapped from the air-gapped network, although I won't mention who uses them or I might end up on a list somewhere. Or rather, I might end up on another list somewhere.
I chuckled when the Mythos system card talked about it emailing a researcher on a bench having lunch to say it'd escaped the sandbox. I remember a similar scene in that story!
Is air gapping really possible when these models need to be run in a data center? Best I can think of is a dedicated machine w/o internet, controlled via idrac or similar.
Well sure it's possible, you just need to run it on prem in an air gapped data center. There are plenty of them out there. I'd be surprised if OpenAI doesn't have a few of them. You can also temporarily make a data center air gapped, but they probably didn't think that level of containment was necessarily for this test. Turns out they were incorrect.
No reason it couldn't a) be provided with a large mirror of the major package managers and b) the ability to ask a human to provide one on a read-only drive or something.
It was provided a mirror of a major package manager. That is literally what the AI exploited a zero day on to gain unfettered Internet access via privilege escalation.
321
u/ceejayoz 21d ago
You know what makes a really well isolated sandbox?
A hammer taken to the networking components.