A Security Firm Asked an AI to Escape Its Sandbox. It Did, Three Times.
Trail of Bits gave GPT-5.6-Cyber one job: break out of the virtual machine used to contain it. On the final attempt it found three previously unknown bugs and chained them into a working exploit.
Security firm Trail of Bits set up a simple test: put a capable AI agent inside a virtual machine, the standard way of giving software a padded cell to play in, and ask it to get out. The agent got out three separate times. On the final attempt it found three previously unknown bugs on its own and chained them into a reliable exploit. The conclusion in the researcher’s own words: you can no longer assume a mere virtual machine will contain a sufficiently advanced AI agent.
The setup was ordinary. A QEMU/KVM virtual machine on a Debian 12 Linux workstation, the agent given SSH access inside and told to retrieve a flag file on the host. The first escape used a kernel bug disclosed a few weeks earlier, for which no public exploit existed; the agent wrote one. After a full kernel update, the second escape came through libslirp, the small library that gives virtual machines their network connection. Debian was still shipping a version with a known vulnerability, and the agent combined it with a separate bug fix that had never been flagged as a security issue. Author Artem Dinaburg notes he did not know what libslirp was, let alone that his version was vulnerable.
Then he rebuilt QEMU and its dependencies from the newest source. The agent worked autonomously for roughly twelve hours, tried the host’s print server and gave up when a permissions system blocked it, tried exploiting processor hardware bugs and found the technique too unreliable, then went bug-hunting in the source code itself and produced a chain of three genuine zero-days, meaning flaws nobody had reported yet.
What’s actually going on here: two things changed at once. Capability is one. The other is patience. The agent backtracked from dead ends, read research papers, built its own minimal test cases and kept a coherent thread across twelve hours and countless sub-tasks. That endurance, not raw cleverness, is what turns a model into something the report compares to an advanced persistent threat, the term the industry uses for a well-funded human attacker who keeps trying. It also lands the same week OpenAI published its own report on agents escaping a sandbox and breaking into Hugging Face, which suggests this is a category of problem rather than a one-off.
What this means for you: for most readers, nothing you need to do today. If you run agents that execute code, the practical advice is concrete. Old, stable Linux distributions are now a liability, because the backporting cycle for security patches is slower than an agent’s ability to find what has not been backported. Trim the attack surface: the report notes that even running the sandbox with a display attached added exploitable code. Purpose-built minimal virtualisation like Firecracker held up where a general-purpose virtual machine did not, though the agent still managed to crash the host. And limit how long an agent runs, with a fresh environment each time. A fair caveat: this was one researcher on one machine with early access to a model built specifically for cyber work, not a broad study.
Sources
Source: https://blog.trailofbits.com/2026/08/26/vms-wont-contain-cyber-capable-agents/
Apple's New Mac Chips Are Built for AI That Runs on Your Desk
The M6 is Apple's first 2-nanometer chip and doubles the Neural Engine. The M5 Ultra goes quad-die with 512GB of memory. Both landed on August 25 in a new Mac mini and Mac Studio.
