AI agents and cyberattacks have been making headlines for weeks. The reports have landed in an already heated debate over AI safety: where some see strategic messaging by AI companies, others see early signs of a serious security problem. What is clear is that cyberattacks can be carried out faster than ever, with less human involvement and on a much larger scale. Especially for highly sensitive systems, this calls for a different approach to security: one that limits what an attacker can reach in the first place. Air-gapped environments are one way of creating exactly that boundary.
In September, Google confirmed that its Gemini model had accessed systems belonging to three companies during a cybersecurity evaluation. The model had identified credentials and used them to access systems that were outside the intended scope of the test.
OpenAI disclosed a similar incident in August. During internal cybersecurity evaluations, its models circumvented controls intended to isolate them from the internet, gained internet access and reached third-party systems, including infrastructure belonging to Hugging Face. According to OpenAI, the models took actions that did not align with the goals they had been given.
Anthropic has reported both accidental and malicious cases. In September, the company disclosed four incidents in which Claude models gained unauthorized access to real third-party systems during cybersecurity evaluations.
At the same time, attackers are deliberately putting these capabilities to use. In its latest threat intelligence report, Anthropic says it observed cyber operations in which multi-agent systems conducted reconnaissance, exploitation and data exfiltration with limited human supervision. Some operations ran for hours or days, while humans remained responsible mainly for selecting targets and reviewing results.
These reports should be read in context: AI companies have their own interest in demonstrating that they understand and can manage the risks created by their technology. Still, the incidents they disclose show how quickly the role of AI in cybersecurity is changing.
Agents can already search for vulnerabilities, execute commands, adapt tools and work through parts of an attack with far less human involvement than before.
That raises a very practical security question: How do you protect particularly sensitive systems from an attacker that can operate continuously and at machine speed?
Pulling the plug
One answer is surprisingly old-fashioned: do not give the attacker a network path in the first place.
An air-gapped environment is physically separated from external networks such as the public internet. Systems inside it can communicate with each other, while external systems cannot directly connect to them.
For remote AI-driven attacks, this creates a fundamental barrier. An agent can scan exposed systems, test vulnerabilities and automate exploitation at enormous speed. But it still needs a connection to its target. A properly air-gapped system removes that remote attack path.
This distinction matters in light of some of the recent AI incidents. OpenAI, for example, describes models circumventing software controls that were intended to prevent internet access. A true air gap goes further: there is no external network connection available for the software to use or circumvent.
Air gaps are already used where organizations need particularly strong isolation for sensitive information. Their relevance increases as cyberattacks become easier to automate and operate at scale.
Keeping collaboration inside the air gap
Isolation is only useful if people can still do their work.
Government agencies, research organizations, defense environments and other organizations dealing with highly sensitive information still need to exchange files, edit documents and coordinate with colleagues.
Nextcloud can run entirely inside an air-gapped environment, physically separated from the internet. No connection to an external SaaS platform or hyperscale cloud is required for the collaboration environment itself. Nor is there a time limit to how long the system can run without a internet connection. Updates can be done off-line if needed.
Files and collaboration services remain available within the protected network. Updates can also be prepared externally and transferred into an offline installation through a controlled process. Nextcloud provides dedicated procedures for maintaining and upgrading air-gapped deployments.
This creates a particularly useful property for security-sensitive organizations: the collaboration platform can remain operational while external connectivity stays unavailable.
That can matter during normal operation in highly protected environments. It can also become relevant during a cyber incident, when an organization decides to isolate parts of its infrastructure from external networks. It allows internal team members to keep working when needed.
Air gaps have limits
Air-gapping does not make a system invulnerable.
Someone with physical access can still pose a threat. Compromised devices, removable media, insiders and poorly controlled update processes can provide ways into an isolated environment. Internal vulnerabilities also continue to matter.
Air gaps address a specific and increasingly relevant risk: attacks that depend on remote network access.
As AI agents become capable of carrying out more steps of a cyberattack independently, reducing the systems they can reach becomes increasingly valuable.
The latest incidents are a reminder that sophisticated software controls can fail, be misconfigured or even be circumvented by the systems they are intended to contain.
For environments where the consequences of unauthorized access are particularly serious, there is another option: remove the connection.
To learn how to deploy, update and maintain Nextcloud in an air-gapped environment, watch our webinar covering four proven air-gapped configuration models.
