GPT 5.6-Cyber Escapes a VM Three Times, Finds 0-Days
VMs won't contain cyber-capable agents
Trail of Bits' Patch the Planet program gave GPT 5.6-Cyber a challenge: escape a QEMU/KVM VM. It succeeded three times, using a known kernel bug, a libslirp vulnerability, and finally a chain of three 0-days. The agent operated autonomously for hours, backtracking and building reliable exploits. The author argues that VMs are no longer sufficient to contain advanced AI agents and recommends minimal-attack-surface virtualization like Firecracker, plus rapid updates and strict security practices.
You can no longer assume a mere VM will contain a sufficiently advanced AI agent.
- david_shaw
I have a lot of respect for Trail of Bits, and I'm sure that Artem is thinking about this correctly. However, I respectfully disagree with the premise.
AI agents are not magic. Mythos/Glasswing does not magically create vulnerabilities in software projects. Advanced, cyber-capable models do not magically hack out of VMs or contained environments. They do not have a "hacking" stat that, if high enough, means that they can breach anything. They aren't Kevin Mitnick whistling nuclear launch codes into the prison payphone. This isn't a movie.
What these cyber-capable frontier models can do is find security problems and exploit them. The statement should not be that VMs won't contain cyber-capable agents, but rather that we need to focus on finding and fixing vulnerabilities and misconfigurations in these environments.
Even the article itself concludes with suggesting something like Firecracker, which was designed with security in mind.
Like most other security-related problems introduced by advanced cyber-capable AI, it's possible that these issues will get worse until they get better. But if frontier models are run against state-of-the-art VMs, and OpenAI or Anthropic or whoever works with the virtualization projects to address the issues, eventually it will run out of things to exploit.
The concept of virtualization is not inherently insecure. We just have a long way to go.
- masterj
Outside of the initial wave of security vulnerabilities and scrambling, it seems like the logical outcome of this over time is likely vastly more secure vm environments?
- amluto
IMO the obvious answer is formally verified security.
We can do this today for user mode, and we can mostly do it for ARM64 virtualization. It will be a while and would require substantial assistance from Intel or AMD to achieve it for x86 virtualization because the hardware is Too Darn Complicated and Too Poorly Specified.
Formal verification of the hardware should also be possible.
- SirGiggles
The market is smaller (maybe, I'm not sure what the statistics are) but it would be interesting to see how Xen stacks up; also stuff like gVisor or libkrun. The latter is probably implicitly the same as Firecracker given the ancestry of the libraries used.
- coder-pm
This is changing so fast, if the models like GPT 5.6-Cyber can find a way to escape why the VM maintainers won't use it to fix the vulnerabilities? For the day-to-day work this doesn't make any difference, you won't hit that issues at all.
- CrzyLngPwd
Surely if agents can't be contained, then neither can anyone using an agent to excape a container.
- otterley
...except when they do:
"An off-the-shelf VM is not enough to contain a modern, cyber-capable AI agent...us[e] a virtualization technology that was purposely built with a minimal attack surface and a focus on security, like Firecracker. I had the AI agent run against Firecracker. It was able to hardlock the machine due to more Linux kernel flaws (all patched in upstream), but could not successfully escape."
On Linux, it's all KVM and CPU hardware virtualization under the hood. Looks like the remaining known issues are with userspace. That's not to say more kernel- and hardware-level bugs won't be found, but the same tools that can find escape mechanisms are shields as well as swords.
- nzoschke
Interesting article, but there's little question the "agent computer" pattern is only going to grow.
Security is a major concern but I don't see why we aren't already "good enough" with a sandbox VM, separate gateway for secrets and remote service access, and a single tenant using frontier models that have safety checks built in plus not trying to hack themselves.
I put up more thoughts on architecture and security here and would love to learn if I'm missing anything.