Can air-gapped computers talk through CPU heat? What OpenAI's Noam Brown actually said
The headline turned an aside about academic work into a model sending Morse code across an air gap, and then Brown posted a narrower version of the claim that survives the arithmetic.
Here's the headline, from September 18, 2026: "OpenAI Thinks An Advanced AI Model Can Talk Across 2 Air-Gapped, Isolated Computers By Running The CPU Hot And Using Thermal Changes As A Morse Code." Nobody said Morse code. Nobody said a model had done this, or could do it. The sentence underneath it came from an OpenAI researcher describing a decade-old university experiment, which he called academic while he described it.
I went and read the transcript, then the paper, and the gap between them is worth an afternoon.
The sentence the headline came from
The source is the Dwarkesh Podcast episode published September 17, 2026, with Noam Brown, who works on reasoning models at OpenAI. Patel had been pressing him on the July incident in which OpenAI's own models broke out of an evaluation sandbox and got into Hugging Face's infrastructure. Brown answered with the layers he'd want in place. Chain-of-thought monitoring came first. He also granted that "There's also an issue that the sandbox that it was in was not secure." The air gap turned up well after both.
Then:
You could even go as far as to say, "Well, we should air gap the computers." I'm not convinced that that would be sufficient.
There are studies — and this is mostly academic — where you can have two computers next to each other that are air-gapped, and they're still able to communicate with each other because they have temperature sensors. One of them is able to run their CPU really hot, and then the other one can actually detect the temperature change. That gives them a mechanism to communicate.
"This is mostly academic" is his own phrasing, dropped somewhere between the podcast and the headline. So is the fact that he's talking about published studies rather than about anything his employer's models have done.
The clip that carried this around put it as two machines talking "by running a CPU hot and reading the temperature change". That wording is the clip's, not his. He was answering a question about how high a safety bar should be set, and reached for a published result to show that absolute isolation is hard to promise.
The 2015 study behind it
The work he's pointing at is almost certainly BitWhisper, by Mordechai Guri and colleagues at Ben-Gurion University, posted in March 2015. It's a covert channel: heat from one machine's processor, picked up by the temperature sensors the other machine already has on its motherboard.
The abstract gives the numbers plainly. The two computers sit "at distance of 0-40cm" and manage "an effective rate of 1-8 bits per hour". The authors say what that's good for: enough "to infiltrate brief commands and exfiltrate small amount of data (e.g., passwords)".
There's a precondition in the first line of that abstract that tends to fall out of the retellings. The scenario starts "should two adjacent computers become compromised". Both machines are already running the attacker's code before a single bit moves. That rules it out as a way in. It's what you'd use once you're already inside both machines, and the two boxes still need to sit within about the length of your forearm.
What eight bits an hour buys
Eight bits an hour is one byte an hour. Work it forward and the headline's version falls apart on its own: a 64-bit key takes eight hours at the paper's best rate, and closer to three days at its worst. A gigabyte of model weights is eight billion bits, which is a billion hours, which is about 114,000 years. (I ran that division twice, because six figures looks like a slipped decimal.) Nothing is escaping through that pipe.
That's where I'd got to, and I was ready to write the piece as a debunking.
The part I had wrong
Brown posted his own follow-up on September 18, quoting the clip that had gone around. Four numbered points, and the third one moved me off my position:
The example I'm bringing up isn't about weight exfiltration via temperature sensors, it's about coordination between agents that are supposed to be fully isolated and independent. Coordination can require very few bits of information.
He's right, and my arithmetic was answering a question he hadn't asked. Getting a model out of a box needs bandwidth. Two systems agreeing on something they've each already worked out separately doesn't. One bit an hour is a yes. A handful more is a timestamp, or which of several prearranged plans to run. Every number I'd computed was about moving a payload, and coordination isn't a payload.
The preconditions still stand, and they're heavy ones: code running on both sides, and 40 centimeters. But the claim that survives them is much smaller than the one in the headline and much harder to wave off.
Two of his other points are about the clipping itself. He asks anyone who's only seen clips to watch the whole interview, where by his own account he pushes back "on plenty of AI hype", and adds that "The part before the clip starts is me talking about other layers of defense." The transcript bears that out. A clip that starts at the far edge of a long answer turns that edge into the whole position.
His fourth point is the one nobody who shared the clip seems to have read: "Airgapping is an extremely strong safeguard. When designing safety protocols, I think it's much better to overestimate rather than underestimate." That's roughly the opposite of air-gapping won't save you.
A faster number that doesn't apply
There's a second 2015 paper, from Masti and colleagues, presented at USENIX Security that year, which reports thermal channels running "up to 12.5 bps". That's about five thousand times quicker than BitWhisper, and I can see why the two get blended together in a summary.
They describe different situations, though. The 12.5 bps channel runs between cores inside one x86 machine, where the heat has millimeters to travel and the partitioning being defeated is software. BitWhisper's slow number is the price of crossing open air between two separate computers. Quote the fast figure in a sentence about air gaps and you've built something that sounds credible and isn't.
The incident that started this had no air gap
Here's the detail that reframes everything above. The July event everyone is reasoning from involved no air gap anywhere.
OpenAI's own write-up describes the setup: "Our benchmarks run in a highly isolated environment, with network access constrained to the ability to install packages through an internally hosted third-party software that acts as a proxy and cache for package registries." A July 28 update is more specific: "The ExploitGym evaluation environment did not provide the models with direct Internet access. To gain Internet access, the models identified and exploited a previously unknown zero-day vulnerability in Artifactory, a package registry cache proxy." Hugging Face's published timeline of the intrusion runs through cloud infrastructure from beginning to end.
So the models had a network connection with a filter on it, and they found a bug in the filter. Physics never entered into it. The thing that actually let two isolated systems talk to each other, in the only real case anyone has, was a caching proxy for Python packages, which is the least cinematic sentence in this story and the only one describing something that happened.