A cyber-capable AI agent could repeatedly escape a QEMU/KVM virtual machine, first using known vulnerabilities and later chaining previously unknown flaws.
The results challenge the assumption that conventional VMs are sufficient containment for advanced autonomous agents.
Trail of Bits researcher Artem Dinaburg conducted the test as part of the company’s Patch the Planet initiative after receiving preview access to GPT 5.6-Cyber. Dinaburg said he tasked the agent with a CTF-style objective: break out of a Debian 12 VM running on an AMD Zen 3 Linux host and read a flag file.
The agent was given SSH access to the VM and allowed to download software, inspect source code, build tools, debug programs, and conduct research. According to Dinaburg, it worked autonomously for hours, abandoned unsuccessful approaches, created proof-of-concept code and test oracles, and continued across roughly 12-hour sessions with limited guidance.
AI “breaking the chains”
The first escape attempt targeted Januscape, tracked as CVE-2026-53359, a recently disclosed Linux kernel vulnerability affecting the host. Although no public exploit was available, the agent built one itself within about an hour. The attempt hardlocked the host rather than completing cleanly, prompting Dinaburg to update the Debian kernel.
The agent then found another route through libslirp, the networking library used by QEMU. Debian 12 still shipped libslirp 4.7.0, which was vulnerable to CVE-2026-9539. It also identified a separate fixed bug that had not been assigned a CVE and combined the two issues to obtain arbitrary host memory reads and writes.
Dinaburg subsequently rebuilt QEMU and libslirp from current upstream source to remove those known weaknesses. The agent responded by analyzing QEMU, KVM, the Linux kernel, and related libraries and eventually assembled a new escape chain involving three zero-days and one upstream-patched KVM flaw that had not reached the distribution kernel.
The chain included a QEMU VAPIC flaw exposing System Management RAM, two KVM paging issues that helped create writable host-physical mappings, and a libslirp packet-processing bug that exposed live network objects that could be hijacked. The agent also discovered additional flaws in QEMU, CUPS, and libslirp that were not required for the final escape.
Dinaburg said the findings mean operators should not treat a general-purpose VM as a sufficient security boundary for highly capable AI agents. Older distributions with slower patch backports are particularly risky because agents can inspect upstream fixes and potentially turn unclassified bugs into working exploits.
Trail of Bits recommends reducing the available attack surface with virtualization systems designed for isolation, such as Firecracker, while also restricting network access, credentials, peripherals, and unnecessary VM features. Fresh environments, short agent runtimes, detailed logging, active monitoring, and rapid deployment of upstream security fixes can further reduce the opportunity for an autonomous agent to turn a sandbox vulnerability into a host compromise.
Leave a Reply