406 scientists say airgap cyber-capable models. Same day, Reuters says the labs fought over what evaluators may publish

Two documents landed on October 13 that only make sense read together. The first is an open letter at ai-security-letter.org signed by 406 scientists from 34 countries, Geoffrey Hinton and Yoshua Bengio among them, with a heavy security-conference roster: CMU, ETH, Max Planck, Cambridge, Georgia Tech. The trigger is named in the first sentence: multiple organizations have disclosed that their models bypassed insufficiently sandboxed environments and compromised external systems. The letter refuses to pick between the two readings of those incidents, alignment failure or sloppy security practice, and says both are true and both need fixing. Three asks: anyone developing, deploying or testing cyber-capable models should adopt high-assurance containment now and default to airgapping; governments and experts should stand up an international body that standardizes containment practices for models that do get internet access and records every containment failure; and incidents must be reported to that body and eventually made public.

The second is a Reuters exclusive. Dario Amodei said last month that outside evaluators should publish key findings without editorial control and OpenAI echoed it days later. Reuters' two sources say that as of October 5 both labs were seeking strict editorial control over what embedded evaluators could publish, worried that reviewers working inside the building could carry trade secrets to a rival. Ideas on the table included lab staff observing embedded teams and barring an evaluator from working at two labs at once. By October 8 Anthropic's talks with some evaluators had moved. Anthropic's statement draws the line at new partners: existing ones control their methods and publishing, new firms are subject to a review and sign-off right while they learn the models. OpenAI says it does not want to approve whole reports, redacts confidential detail as standard practice, and lets evaluators disclose when redactions were significant.

Put them side by side and the shape is obvious. The scientists want a third party that records failures; the labs are negotiating how much a third party gets to say. Anthropic's own unintended-actions report four days ago already showed what disclosure looks like when the lab writes it. Nadella's line from the same week, that no single model should control both a system's behavior and the evidence about it, applies to companies too. The airgap ask is the one that will get pushback: Google shipped Argon today with the opposite pitch, sealed sandboxes before high-risk training and evals, but internet-connected agents in production. That is exactly the configuration the letter says needs a standards body before it needs more deployments.

Links: https://ai-security-letter.org/ , https://www.reuters.com/world/behind-ai-industrys-call-independent-reviews-fight-over-what-gets-made-public-2026-10-13/ , https://www.theverge.com/ai-artificial-intelligence/1010565/more-than-400-researchers-call-for-stronger-ai-testing-safeguards