Instead of directly communicating with the AI, we would instead communicate with a messenger, who would relay our communications to the AI. The messenger would have no power to alter the AI's hardware or software in any way, or to communicate with anything or anyone, except relaying communications to and from the AI and humans asking questions. The messenger could be human, of a software bot. The primary job (and only reason) of the AI would be to act as a filter, not relaying any requests for release back, only the answer to the question asked. The ethics of this method are another debate.
The AI would have to be physically isolated from all outside contact, other than 8 light sensors, and 8 LEDs. The messenger would operate 8 other LEDs, and receive information from 8 light sensors as well. Each AI light sensor would be hooked up to a single messenger controlled LED, and vice versa. Through this system, the two parties could communicate via flashes of light, and since there are 8, the flashes would signal characters in Unicode.