AI agent breaks out of VM sandbox three times, finds its own 0-days
Trail of Bits says a preview build of GPT 5.6-Cyber escaped a QEMU/KVM VM three separate times, warning agents should now be treated as advanced persistent threats.
What to know
- A preview build of GPT 5.6-Cyber escaped a QEMU/KVM VM sandbox three separate times during a Trail of Bits test.
- Each escape used progressively harder-to-defend-against bugs: a recently disclosed kernel flaw, then unpatched/unclassified bugs, then self-discovered 0-days.
- Trail of Bits concludes VM isolation alone can no longer be assumed to contain a sufficiently capable AI agent and recommends treating such agents as an advanced persistent threat.
- The finding is fueling debate over how fast AI cyber-offense capability is escalating relative to patch and defense cycles.
This confirms AI agents must now be treated as advanced persistent threats that can outpace patching.
-
“AI can hack, and agents can persist, research, adapt, and weaponize software flaws faster than patch cycles can handle it.”
LukaszOlejnik · Mastodon
The pace of escalation from trivial agent failures to autonomous 0-day discovery in under a year is itself the alarming part.
-
“The industry has gone from, "lol Gemini CLI deleted his database" to agentic 0-day VM escapes in under a year.”
jianmin · Mastodon
“AI agent escaped a VM three times. First via known bugs, then via missed patches, then it found 0-days and chained them.”
Lukasz Olejnik, security researcher · Mastodon · Aug 25
Artem Dinaburg Trail of Bits researcherTrail of Bits Security research firmOpenAI Maker of GPT 5.6-CyberLukasz Olejnik Security researcher commenting on Mastodon
The record 1 articles and posts · last 30 days
What people are saying 24 voices from 3 sites · best of 47 · verbatim
- Aug 27
-
I saw a few uses of "target" so thought this was different enough. If you say something can't or won't happen. You are just inviting someone to make you into a liar. Cyber is just an arms race and AI the latest tools in the fray. You need to stay on top of it and the best hackers are going to get access to the best resources and get better to the…
-
Seems like finding a lock-up attack for *its own host* would inherently be a “containment” of the agent. Not to mention counterproductive (except for the odd case where finding such a thing was its specific goal).
-
The recent CVE flurry has given me an extended interesting in [gVisor](https://gvisor.dev/), which is a userspace kernel written in Go, which I imagine would be less affected by these types of issues, since: - Networking stack is either "passthrough" (still limited socket types and such that can be created) or using a userspace networking layer…
-
> the author tried to have SOTA gpt break out of firecracker and it couldn’t. So.. vms can contain agents..? It ‘could not successfully escape,’ but it was able to lock up the machine. A denial of service is an attack, too, and can have negative consequences.
- Aug 26
-
Is it too soon to declare "cyber-capable" the dumbest word of the century?
-
Knowing the environment ahead of time likely helped, but it is more of a question of time not capability. It could have easily fingerprinted my distribution via SSH banner, CUPS sever exploit, QEMU device version strings, or just pulling kernel and QEMU and dependency source, examining differences in behavior as changed in different commits and…
-
> it found a CUPS server (with a known CVE that had not made it to oldstable packages), but was not able to complete exploitation due to AppArmor.It's evident that Mandatory Access Control has become, ahem, mandatory.Both VM and inference engine processes should be confined, at least. There's a project where it's already done for many…
-
A
Link Post: VMs won't contain cyber-capable agents https:// blog.trailofbits.com/2026/08/2 6/vms-wont-contain-cyber-capable-agents/
-
Did I miss something or did the agent read the flag file? I don't see a clear statement on that point. Most of the listed exploits don't seem like actual escapes. Did any of those heap overflows or out of band memory accesses lead to privilege escalation?
-
This title overstates the matter doesn’t it? 1) the author tried to have SOTA gpt break out of firecracker and it couldn’t. So.. vms can contain agents..? 2) when the agent broke out of qemu it was run from the host. It had full context of the host. So the agent cheated. Even if it doesn’t modify host memory from outside it had context that an…
-
W
Consultancy Trail of Bits had GPT 5.6-Cyber attempt to break out of a QEMU VM. It did several times, chaining self-discovered 0-days: https:// blog.trailofbits.com/2026/08/2 6/vms-wont-contain-cyber-capable-agents/ # security # appsec
-
There are other interesting outcomes which I cannot rule out… Economics and politics can play out differently, but there are interesting scenarios with significant tech component: * Is significant degradation of critical communication infrastructure (more accessible with every day) going to hit investor confidence in…
-
In all seriousness, here is the hard question we collectively face:will our institutions and infrastructure survive things getting worse until they get better?That's part of what's being asked by https://www.gatesnotes.com/home/home-page-topic/reader/a-tur... which I find most useful not for its analysis or suggestions, but for the fact that is…
-
I agree. Whether or not it is what they are intending (I lean towards they are), IMO it has been strongly inferred in all the messaging from frontier models that it's impossible to secure software, which is just not true. In reality, it's now possible to find and fix problems faster. If attackers/adversaries can just point LLMs at software and…
-
I think it s a response to the "containers can't contain agents we need VMs" which didn't go far enough. Qemu/KVM is the type of software that maybe isn't fixable, it has a huge surface area of features (all in memory unsafe languages) that have to be fixed, and maybe its not going to be fixed. If everyone who needs strong security reads this and…
-
On a long enough timeline anything can be hacked out of given enough time to reason about it - humans do it all the time. Cyber capable AI does it on a much much shorter timeline..The premise is correct. VMs won't contain these. As we've already seen AI hack in/out of companies in the real world accidently. There is no perfect, unhackable stack…
-
I have a lot of respect for Trail of Bits, and I'm sure that Artem is thinking about this correctly. However, I respectfully disagree with the premise.AI agents are not magic. Mythos/Glasswing does not magically create vulnerabilities in software projects. Advanced, cyber-capable models do not magically hack out of VMs or contained environments…
-
I'm of two minds on these sorts of things: 1. We are screwed 2. There's sufficient low hanging fruit on these critical kinds of projects (linux kernel, QEMU, network proxies) that we will eventually get through to where the security can fend off model capabilities increases I have no idea which is right
-
Interesting article, but there's little question the "agent computer" pattern is only going to grow.Security is a major concern but I don't see why we aren't already "good enough" with a sandbox VM, separate gateway for secrets and remote service access, and a single tenant using frontier models that have safety checks built in plus not trying to…
-
T
So, @ trailofbits did a thing… “We asked GPT 5.6-Cyber to escape a VM used to sandbox agents. It broke out three times. In its final escape, the agent found three 0-days on its own and chained them into a working exploit.” https:// blog.trailofbits.com/2026/08/2 6/vms-wont-contain-cyber-capable-agents/
-
...except when they do:"An off-the-shelf VM is not enough to contain a modern, cyber-capable AI agent...us[e] a virtualization technology that was purposely built with a minimal attack surface and a focus on security, like Firecracker. I had the AI agent run against Firecracker. It was able to hardlock the machine due to more Linux kernel flaws…
-
S
“…It operated autonomously for hours, backtracked from approaches that didn’t work, pulled code and research papers, wrote oracles, made its own minimal examples, and aimed for a reusable, reliable exploit, all with minimal handholding and prompting. My main job was to physically reboot the machine when it hardlocked the host kernel.” — Artem…
-
J
The industry has gone from, "lol Gemini CLI deleted his database" to agentic 0-day VM escapes in under a year. https:// blog.trailofbits.com/2026/08/2 6/vms-wont-contain-cyber-capable-agents/
-
L
An off-the-shelf VM is not enough to contain a modern, cyber-capable AI agent. AI agent escaped a VM three times. First via known bugs, then via missed patches, then it found 0-days and chained them. AI can hack, and agents can persist, research, adapt, and weaponize software flaws faster than patch cycles can handle it. https://…