Air-gapped labs
Isolated secure development environment. Frontier research on air-gapped or tightly isolated networks with physical security controls.
What it does
Frontier research moves onto isolated computer networks with tight physical security, much like classified government work.
Applies to: Frontier developers, for models above a capability threshold.
- Conduct frontier training and research inside isolated networks (RAND SL4 to SL5) with limited, controlled external connections and commensurate physical security.
- Restrict researcher access and remote work accordingly.
Where things stand
No lab operates this way. Anthropic's Frontier Safety Roadmap says its initial discussions leave it skeptical that isolated networks are feasible within one to two years, and it is running a small-scale mock secure research environment to measure the productivity impact.
Why it costs ~9 days
Isolation slows U.S. researchers, about 6 days of progress a year in. It also blocks theft and spying, slowing China by about 3 days. Net: about 3 days, and highly uncertain.
Biggest unknown: The productivity penalty on researchers. Anthropic is measuring it now and has not published a number.
Why it lowers p(doom) by ~0.15%
Cuts lab systems off from the internet so models and secrets can't leak or be stolen.
Isolating lab networks blocks most remote theft and makes it harder for a misbehaving model to get out.
The strongest case that it costs more
Every researcher who has worked in a SCIF says the same thing: it is slower. If the penalty is 30% and it compounds across a field where the frontier doubles every 105 days, the U.S. hands away a third of its own progress to protect against a threat it cannot quantify. Anthropic's own roadmap says the isolated-network version may not be feasible at all on the relevant timescale.
The debate
For
- Leopold Aschenbrenner called for fully air-gapped datacenters and research staff working in secure facilities, 2024.
- Sella Nevo, Institute for Progress proposed a government-led push to top-level security including air-gapped access, 2025.
- SL5 Standard authors defined security able to thwart the world's most capable cyber institutions, 2026.
Sources
- Anthropic Frontier Safety Roadmap updates (May 5, 2026): skeptical isolated networks are feasible in 1–2 years; mock secure research environment to measure productivity impact
- Anthropic Frontier Safety Roadmap
- RAND, Securing AI Model Weights: security levels SL1–SL5
Rough starting points, not precise forecasts. Lead costs assume China doesn't depend on U.S. models, the case least favorable to safety laws, and count 3 years. On the menu you can change every assumption and put in your own numbers. Last priced 2026-09-26.