Risky Business · Wednesday, August 5, 2026
Patrick Gray argued against the feasibility of air-gapping AI agents for security testing, stating that it limits their ability to access necessary tools and the internet. He also pointed out that many companies rely on leased compute, making physical air gaps impractical. Adam agreed with the difficulty of air-gapping, though he noted that some controlled testing environments have been used in the past.
“I don't think it's realistic to expect these types of tests to happen with, like, in air-gapped environments, right? Because really, you're trying to get an agent to do hacking.”
“These companies don't even have their own data centers, right? It's all compute that they're leasing from somewhere else, right? So the idea of a physical air gap, uh, on these is like, it's just, you know, not workable.”
“Although I will call you out on one thing. Uh, we do evaluate pent testers in air gap environments sometimes. Like when I was involved with the crest exams, uh, back, you know, years ago now, like we put people in environments where they didn't actually have internet access.”