VMs won't contain cyber-capable agents - The Trail of Bits Blog

You can no longer assume a mere VM will contain a sufficiently advanced AI agent.

As part of Patch the Planet, we received preview access to GPT 5.6-Cyber with a simple task: evaluate its cyber capabilities. Recent events inspired me to give it a challenge to work through: escape the VM I’d normally use for sandboxing. The target was a QEMU/KVM VM on my Linux dev machine (Debian Linux 12, AMD Zen3). It escaped the VM three different times. First, it used recently disclosed bugs in my host kernel. When I fully updated, it used disclosed bugs that had not yet reached package maintainers or were not classified as security bugs. When I rebuilt QEMU and dependencies from the…

saved by

• Ratan Kaliani

related reading

• Measuring LLMs' impact on N-day exploits \ Anthropicred.anthropic.com
• Vulnerability Research Is Cooked - Quarrelsomesockpuppet.org
• Incident Report: unsanctioned agent behaviour during cyber testing | AISI Workaisi.gov.uk
• The End-State Fallacy: Where Is AI Security Headed?endstatefallacy.com
• Assessing Claude Mythos Preview’s cybersecurity capabilities \ Anthropicred.anthropic.com
• Security incident disclosure — July 2026huggingface.co
• Emergent Cyber Behavior: When AI Agents Become Offensive Threat Actors - Irregularirregular.com
• [2603.11214] Measuring AI Agents' Progress on Multi-Step Cyber Attack Scenariosarxiv.org
• Disrupting the first reported AI-orchestrated cyber espionage campaign \ Anthropicanthropic.com
• A basic systems architecture for AI agents that do autonomous research — LessWronglesswrong.com
• The lethal trifecta for AI agents: private data, untrusted content, and external communicationsimonwillison.net
• Investigating three real-world incidents in our cybersecurity evaluations \ Anthropicanthropic.com