Hacker News front pageAug 26, 2026, 22:49 UTC+8

VMs won't contain cyber-capable agents

A Trail of Bits researcher gave GPT 5.6-Cyber a CTF-style task: escape a QEMU/KVM VM on a Debian 12 dev machine. The agent escaped three times in ~12 hours—first via a recently disclosed kernel bug, then by chaining two libslirp vulns that hadn't been patched in Debian oldstable, and finally by finding multiple 0-days after the researcher rebuilt QEMU and libslirp from latest upstream. It backtracked from dead ends, read papers, wrote oracles, and aimed for a reliable reusable exploit. The takeaway: treat cyber-capable agents as an advanced persistent threat, not something a VM can contain.

Why it matters: Trail of Bits ran a real VM escape experiment with GPT 5.6-Cyber: three successful escapes in 12 hours, chaining kernel and library bugs. First public demo of a model autonomously breaking out of a VM sandbox, directly challenging containment assumptions. Score held back by si...

Read the original ↗Export Markdown

Take

I'd open this because the setup is refreshingly real: researcher Artem Dinaburg didn't build a fancy benchmark. He just pointed GPT 5.6-Cyber at his actual Debian 12 dev machine running QEMU/KVM and told it to escape. It succeeded three times in about 12 hours. First escape used Januscape, a kernel bug disclosed a few weeks earlier—crashed the host. After he patched the kernel, the agent found two libslirp vulnerabilities in Debian's oldstable package, chaining them together when one wasn't even classified as a security issue. The wild part was the third round: he rebuilt QEMU and libslirp from latest upstream source, and the agent still found multiple 0-days and built a working exploit.

I'd discount this slightly: GPT 5.6-Cyber is a purpose-built model OpenAI gave Trail of Bits early access to, specifically hardened for vulnerability research and exploitation. This isn't a general-purpose model suddenly getting scary. But the real signal here isn't about model capability—it's that a long-held security assumption just broke. People assumed a VM was enough to contain an AI agent that can run code and access the network. This experiment says otherwise.

A few details in the post stand out: the agent backtracked from dead ends on its own, pulled research papers, wrote oracles, built minimal test cases, and aimed for a reliable, reusable exploit—not a lucky shot. The researcher's main job was physically rebooting the machine when the kernel hardlocked. His conclusion is blunt: treat these agents as an advanced persistent threat, not a sandboxed process. I buy that, because the test environment was a real dev machine, not a CTF-specific target.

Source: Hacker News front page · blog.trailofbits.com
Published: Aug 26, 2026, 22:49 UTC+8 · Aug 26, 2026