What is air gapped AI?

Air gapped AI is an AI system on a network with no connection to the internet. Its model, data and software all run inside, and nothing crosses except by hand. The term comes from security engineering. The NIST glossary defines an air gap as an interface where two systems “are not connected physically” and “any logical connection is not automated (i.e., data is transferred through the interface only manually, under human control).”

An AI system makes the gap harder to keep than ordinary software does. A typical install reaches out many times: to a hosted model, to download model weights, to fetch container images and updates, to check a license and to send usage reports. In an air gap, each of those has to be replaced by something that is already inside.

The three terms answer three different questions, which is why they get confused.

• On premises says where the machines stand: in your building, under your control.
• Private cloud says who shares them: nobody. The servers are yours alone, in your data center or a provider’s.
• Air gapped says what the network connects to: nothing outside it.

So an on premises deployment is not air gapped by default. It can send every prompt to a hosted model and download its updates from the internet. A private cloud is reached over a network by definition. Air gapped is the strictest of the three, and it usually implies the other two.

Air gapped is also narrower than sovereign. Sovereignty asks who controls the data, the model and the switch, and an air gap is one way to answer it. Our article on sovereign AI covers the wider question.

Before the network is cut, list everything the system fetches from outside, and bring each one in:

• The model. A hosted model is out of reach, so the weights run on your own hardware. That means a model file, a server that loads it and the memory to hold it. Our article on serving open weight models covers that part.
• The software. Container images come from an internal registry that mirrors the vendor’s. Every other file the software would download on first use is placed on disk ahead of time.
• The license. A license that is checked against a server needs an offline form.
• Sign in. A cloud identity provider is outside the gap. Users sign in through one that runs inside.
• Updates. Patches and new model versions arrive the way everything else does: carried across, then checked.
• The calls out. Usage reports, error reports and update checks are switched off, so nothing tries to reach a host that is not there.

Air gaps protect the networks where a breach costs more than the inconvenience. A study by ESET describes air gapping as the protection for an organization’s most sensitive networks.

These are also the places with the most to gain from AI over their own records: maintenance logs, test reports, drawings and field reports that may never leave the building. A hosted model is not an option there. An open weight model that runs on hardware inside the gap is.

The gap itself is rarely the weak point. The ways across it are. ESET studied the 17 malicious frameworks publicly known in 2021 to have targeted air gapped networks. Its finding: “All the frameworks used USB drives as the physical transmission medium to transfer data in and out of the targeted air-gapped networks.”

The UK’s National Cyber Security Centre makes the same point about every import path in its pattern for safely importing data: “the paths you use to import legitimate data and software also offer attackers a route by which to get malware into your systems.” Its answer is to transform and verify what comes in, in steps that cannot be bypassed.

AI adds its own failure modes:

• A component that downloads a model on first use, and fails the first time someone asks a question.
• A model file that runs code when it loads. Hugging Face warns that pickle files, the default format for PyTorch weights, allow exactly that. Prefer formats that hold only data, such as safetensors or GGUF.
• A model that is never updated, because every update is a trip across the gap.
• Software that keeps trying to reach a host outside. It fails quietly, but the attempts fill the firewall logs and hide the ones that matter.

Ask the vendor six questions, in writing:

1. Which hosts does the software contact, and which setting stops each one?
2. What does it download on first use, and how do we place that on disk in advance?
3. How is it licensed with no connection?
4. Which models run inside, and what hardware does each need?
5. How does an update arrive, and how do we check that it is the vendor’s?
6. What happens when an outside host cannot be reached: does it wait, retry or carry on?

Then test it. Install the system on a network with no route out, run it for a week with real users, and read the firewall logs. A system that answers every question and leaves the logs empty is ready for the gap.

Curiosity Studio runs on premises or in your private cloud. Air gapped deployments are supported, with an offline license, local models and usage reporting switched off. For an air gapped install, the installation guide runs the container from your own registry, with the image mirrored into it first.

A connected install reports out by default. Studio sends a daily usage report and error reports to Curiosity, and you can switch both off. Behind a gap, a report that cannot be delivered is dropped, and switching them off keeps the attempts out of your logs. The front end also reports product usage to Mixpanel and has no setting to stop that; behind a gap those requests have nowhere to go. The subprocessors page lists both.

Data at rest is encrypted under a key you hold. You set the key, so back it up with the rest of your secrets. The model is a setting: open weights run on your own servers through Ollama or any OpenAI compatible endpoint, and Spark serves open models on your own hardware. The models page shows which models run on premises.