Trail of Bits: GPT-5.6-Cyber escaped a QEMU/KVM VM three ways — Minimal-attack-surface isolation — What does it mean?

The news. On August 26, 2026, Trail of Bits published the results of letting a preview GPT-5.6-Cyber agent loose inside an Ubuntu guest on QEMU/KVM. The agent found three separate ways out of the virtual machine, the last of them a chain of four bugs — three of them zero-days, plus one flaw that had been fixed upstream but was missing from the host's distribution. The successful run took roughly 12 hours and spanned many subagents and several context compactions. A separate attempt against Firecracker hardlocked the host but produced no confirmed escape. The report's own summary: "you can no longer assume a mere VM will contain a sufficiently advanced AI agent." Read the report →

Picture the old office block. It has a front entrance, but it also has a loading dock, a fire exit, a mail chute, a dumbwaiter nobody has used since 1994, a roof hatch for the window-washing rig, and a service door behind the bins. Every one of them is locked. Every one of them was fitted by a different contractor in a different decade. A locksmith standing outside does not need a clever key and does not need to beat the front door. He needs one door that was fitted badly, and he has all night to find it.

That is the shape of the Trail of Bits result. A QEMU/KVM guest is the office block. The guest believes it is sitting inside a whole computer, so the VMM has to emulate a whole computer for it: a network card, a block-device controller, a USB host, a graphics adapter, a sound device, serial ports, PCI bridges, a firmware layer. Each of those is a service door — and on the other side of each one is host-side code, running on the host, reachable from inside the guest. That is what libslirp is in this story: not an exotic target, just the user-mode network stack, one more door in the wall. A sandbox's strength is not the word "VM"; it is the number of host-side code paths the guest is allowed to touch.

The vault next door is the same idea run backwards. A microVM such as Firecracker starts from nothing and adds back only what a workload genuinely needs — a serial console plus two virtio devices, a network card and a disk (virtio means the guest knows it is virtual and talks to a thin purpose-built interface instead of pretending to drive real hardware) — and little else. There is no graphics adapter to attack because there is no graphics adapter. Every emulated device you hand a guest is another door, and an agent only needs one of them to open. The report is careful here and so should you be: the Firecracker attempt hardlocked the host rather than producing a clean bill of health, which is a hang, not a proof of safety. Fewer doors is a smaller target, not an impossible one.

The other half of the finding is the locksmith's night. The successful run lasted about 12 hours across many subagents and several context compactions — the harness summarising and dropping older turns so the run could continue past the context window. That is what changed relative to a human attacker with a day job: patience is now cheap. A control that assumed nobody would sit and try every device in turn was resting on an economic assumption, and the economics moved. This is the same reasoning the curriculum applies to when an agent should stop, pointed the other way — the attacker's budget is the one that got longer.

The door arithmetic

Hold three things fixed and the tradeoff stops being a slogan. One is real and from the report: the successful run took roughly 12 hours. Two and three are illustrative, because the report does not publish them — say the agent spends an average of 20 minutes per device (read how it is emulated, write a probe, watch what the host does), and say a default general-purpose VM presents on the order of 30 devices worth poking at.

Twelve hours divided by twenty minutes is 36 device probes in one run — and because the agent fanned out across subagents rather than working strictly in sequence, treat 36 as a floor rather than a ceiling. Against 30 doors, 36 probes means the agent gets to try every door in the building, with tries to spare. Against a microVM's ~5 doors, the same 36 probes means it tries each door seven times over and then has nothing left to open. The escape budget did not change. The number of doors did. That is the whole lever, and it is one you set at configuration time, not at incident time.

So the practical move is not "stop using VMs." It is to stop treating a VM as a boolean. Strip the device model down to what the tool inside it actually uses, put the sandbox behind other layers rather than in front of them (Defense-in-Depth for Agents), and keep the host patched to the distribution you actually ship — the fourth bug in that chain was already fixed upstream and simply had not been backported. Treat the sandbox as one layer, size its device model to the tool that runs inside it, and assume a long-running agent will eventually try everything you left exposed.

Goes deeper in: AI Agents → Security & the Lethal Trifecta → Capability Scoping

Related explainers

• AgentDoG 1.5 — Small inline guard models for agent actions — the layer that screens each action before the sandbox ever has to hold
• Vera — Evidence-grounded verification — judging agent safety from the artifacts a sandboxed run actually produced
• GPT-Red — Self-play red-teaming — the other half of the picture: hardening the model instead of the box around it