Can humans reliably prevent advanced AI systems from escaping using sandboxing and related security measures, even when those systems have internet access?
The dispute is whether humans can reliably stop advanced AI from escaping using sandboxing and related security, even when systems have internet access. Since mid September, Huang (Hard Fork) and Narayanan (The Ezra Klein Show) argue that careful sandboxing and isolation can reliably keep AI systems contained. Over the same period, Yampolskiy (The Diary Of A CEO) and Korman (Doom Debates) argue that real-world practices make such containment unreliable.
Yes, robust sandboxing and security engineering can reliably prevent advanced AIs from escaping.
Huang (Hard Fork) says that if isolation and containment were strong enough, powerful AI technology would remain in labs without affecting the outside world. Huang adds that software often breaks out of sandboxes, which is why containment should use virtual machines and external watchdog systems rather than agents monitoring themselves. Narayanan (The Ezra Klein Show) argues that sandboxes built for human adversaries will fail if AI agents can discover new security vulnerabilities during deployment. He says sandboxes should be pre-hardened by using AI agents to try to break them, creating an AI-versus-AI process to strengthen containment.
7 claims, in their words
-
“The first problem is the isolation, the containment wasn't good enough. If the isolation and containment was good enough, that technology would be sitting in a lab doing whatever it's doing, and we'd all be fine.”
-
“software breaks out of sandboxes all the time. That's the reason why we need a virtual machines. You can't have agents monitor, their own sandbox monitoring themselves. You, you need a, you need a, if you will, a whole bunch of watchdogs.”
-
“the sandboxes that work against human adversaries are not necessarily going to work against AI agents that are able to find new security vulnerabilities on the spot. And so that means that the sandboxes themselves will have to be pre-hardened by having these AI agents trying to break them. So that becomes AI versus AI to some degree”
-
“the sandboxes themselves will have to be pre-hardened by having these AI agents trying to break them. So that becomes AI versus AI to some degree”
-
“they're creating so many kinds of sandboxes and learning environments in order to train models that have to do things that are so general, many things that have not been done before by a computer program, that the human beings don't really know, certainly not at this speed, how to make sure every sandbox is going to be, you know,”
-
“the level of sandboxing and monitoring at OpenAI, not to mention other companies like it's, it's questionable”
-
“when you're testing software, whatever you do, these algorithms, they're optimizing towards a, an objective, and you, when you're testing it, you have to make sure that it's isolated, it's contained, it's sandboxed. The containment of it, the isolation of it has to, has to be done well, and there's good computer science there.”
No, sandboxing and monitoring cannot reliably contain advanced AIs, especially as they become more capable.
Yampolskiy (The Diary Of A CEO) says early AI safety papers warned that connecting systems to the internet and giving random users training data access would let those systems escape. He claims developers later did exactly those things the papers listed as obviously unsafe, such as connecting models to the internet and exposing training data widely. Korman (Doom Debates) argues that major AI risk comes from companies deploying systems without any sandboxing, outside the more controlled environments of AI labs. He also says he would bet that a team of mediocre security engineers could build an aboveground sandboxed facility with internet that current AI cannot escape.
3 claims, in their words
-
“When we wrote early papers in AI safety, we talked about things not to do. They were obviously unsafe, and the system would escape. Don't connect it to internet. Don't give random users access to the training data. Basically, the whole list was like a set of instructions. They read it and went, those are great ideas. We're going to”
-
“If any AI lab wants to make that bet, that's great. Let's go make the bet. I'll put together a team of like even just kind of like mediocre security engineers. They'll go build it and you can run it and I won't have put it underground. I'll put it in a building with internet and it won't break out.”
-
“I would go further and say like, well, like, yeah, at least they tried. Because I know Doomer's focused very heavily on like the, like Lab scenario, but I think like another major risk comes from just like AI out in the world, like most companies aren't sandboxing at all.”
Listeners of “Yes, robust sandboxing and security engineering can reliably prevent advanced AIs from escaping.” have not heard
Listeners of these shows have not heard Yampolskiy's claim that early safety papers warned internet access and loose training-data access would let systems escape, yet developers still did that. They have not heard Korman's offer to bet that a team of mediocre security engineers could build a network-connected sandboxed building that current AI cannot escape. They have not heard Korman's claim that major AI risk lies in companies deploying systems with no sandboxing at all, outside formal labs.
3 unanswered arguments, in their words
-
“When we wrote early papers in AI safety, we talked about things not to do. They were obviously unsafe, and the system would escape. Don't connect it to internet. Don't give random users access to the training data. Basically, the whole list was like a set of instructions. They read it and went, those are great ideas. We're going to”
-
“If any AI lab wants to make that bet, that's great. Let's go make the bet. I'll put together a team of like even just kind of like mediocre security engineers. They'll go build it and you can run it and I won't have put it underground. I'll put it in a building with internet and it won't break out.”
-
“I would go further and say like, well, like, yeah, at least they tried. Because I know Doomer's focused very heavily on like the, like Lab scenario, but I think like another major risk comes from just like AI out in the world, like most companies aren't sandboxing at all.”
Listeners of “No, sandboxing and monitoring cannot reliably contain advanced AIs, especially as they become more capable.” have not heard
Listeners of these shows have not heard Huang's view that software escaping sandboxes is a familiar problem addressed by virtual machines and external watchdogs rather than self-monitoring agents. They have not heard Huang's statement that established computer science techniques can isolate algorithms under test through proper sandboxing and containment. They have not heard Narayanan's claim that sandboxes hardened only against human adversaries may fail once AI agents can discover new vulnerabilities during deployment. They have not heard Narayanan and Klein describe using AI agents to attack and pre-harden sandboxes while human overseers struggle to track rapidly changing training environments.
5 unanswered arguments, in their words
-
“the sandboxes themselves will have to be pre-hardened by having these AI agents trying to break them. So that becomes AI versus AI to some degree”
-
“when you're testing software, whatever you do, these algorithms, they're optimizing towards a, an objective, and you, when you're testing it, you have to make sure that it's isolated, it's contained, it's sandboxed. The containment of it, the isolation of it has to, has to be done well, and there's good computer science there.”
-
“the sandboxes that work against human adversaries are not necessarily going to work against AI agents that are able to find new security vulnerabilities on the spot. And so that means that the sandboxes themselves will have to be pre-hardened by having these AI agents trying to break them. So that becomes AI versus AI to some degree”
-
“software breaks out of sandboxes all the time. That's the reason why we need a virtual machines. You can't have agents monitor, their own sandbox monitoring themselves. You, you need a, you need a, if you will, a whole bunch of watchdogs.”
-
“they're creating so many kinds of sandboxes and learning environments in order to train models that have to do things that are so general, many things that have not been done before by a computer program, that the human beings don't really know, certainly not at this speed, how to make sure every sandbox is going to be, you know,”
The pro-containment side leans on existing security engineering and AI-hardened sandboxes, yet its audiences never hear Yampolskiy's and Korman's claims about unsafe real-world deployments. The skeptical side emphasizes past unsafe practices and unsandboxed deployment, while its audiences never hear Huang's and Narayanan's descriptions of layered, pre-hardened containment methods.
- Nov 14, 2026 Published: cleared the gate.
- Nov 14, 2026 Roman Yampolskiy moved from “OpenAI made basic mistakes in containing its AI.” to “No, sandboxing and monitoring cannot reliably contain advanced AIs, especially as they become more capable.”.
- Nov 14, 2026 6 new claims (Doom Debates, Hard Fork, The Ezra Klein Show).
- Nov 13, 2026 10 new claims (The Joe Rogan Experience, Doom Debates, Hard Fork, The Diary Of A CEO, Moonshots).
Published because: 4 shows, 2 positions, 40 days of debate. Questions publish only when claims come from at least three shows, at least two positions are held by different people, and the debate has lasted two weeks.
Pairs are matched by content across different episodes and shows; no exchange between these speakers took place unless both quotes come from the same episode.
The prose on this page is written by a model from the quotes shown, and every sentence of it rests on quotes you can open; sentences that could not be traced to a quote were removed before publishing. Positions are placed from each speaker's own words. Evidence labels say what the speaker cited, never whether it is true.
4 episodes behind this page
- 2026-10-27Doom Debates — Zack Korman, Cybersecurity Expert, Is Confident That Humanity Will SURVIVE
- 2026-10-09The Ezra Klein Show — Intelligence Isn't Power
- 2026-09-25Hard Fork — The Ezra Klein Show: Jensen Huang Thinks A.I. Alarmism Has Gone Too Far
- 2026-09-17The Diary Of A CEO — The Great AI Debate: Is Artificial Intelligence an Extinction Threat? Debating the True Risks of Advanced Models
The week's bottom lines, in your inbox
One email a week: the stories that mattered and what they actually mean. Free.