How “Fansmitter” Malware Steals Data from Air-Gapped Computers

This answers my question. I was just thinking about this and other methods like encoding data in pulses from a keyboard led at high enough frequencies that humans dont see a flicker but an optical sensor can read it, hard drive parking noise, drive activity indicators, and power state changes could be used to transmit sensitive data from air gapped systems.

Also smuggling data out of containers or vms might be possible by these means or manipulating signals measurable across security boundaries. One could encode bits in the cpu utilization of a process and watch the load from another app outside the secured area to read encoded data, or by loading/unloading a measurable amount of data in RAM, for example. Where did my foil hat go?