https://www.welivesecurity.com/2021/12/01/jumping-air-gap-15...

There are still several vectors even with the top security clearance procedures. They routinely miss things at security checkpoints.

“Even a perfect air gap will be vulnerable to a variety of different attack vectors, including (but not limited to) the following:

Physical compromise: An adversary bypasses physical security and gains access directly to the air-gapped network devices. Physical access is by far the most effective and obvious technique.

Insider threats: Someone who is part of an organization and has access to air-gapped secure systems intentionally or unintentionally compromises a system.

Supply chain compromise: A vendor with legitimate access to air-gapped systems unwittingly is compromised and brings infected devices into a network.

Misconfiguration: Misconfiguration of access controls or permissions allows an attacker to access the air-gapped system through a separate device on the network.

Social engineering (media drop): If an attacker was able to successfully conduct a malicious USB/media drop and an employee was to use that media within the air-gapped system, the network could be compromised.

Other advanced tactics: Thermal manipulation, covert surface vibrations, LEDs, ultrasonic transmissions, radio signals, and magnetic fields are among a range of advanced tactics documented and demonstrated by researchers at Ben Gurion University. “

https://darktrace.com/blog/why-the-air-gap-is-not-enough