6-Cyber one task: escape a QEMU/KVM VM used to sandbox agents. It escaped three times.
No BS check run yet — press ⚖ to extract this story's claims and verify them against independent sources.
We gave GPT 5.6-Cyber one task: escape a QEMU/KVM VM used to sandbox agents. It escaped three times. The final escape came from three 0-days the agent found on its own and built into a working exploit after we patched known bugs and rebuilt QEMU from upstream. Our takeaway is off-the-shelf VMs cannot contain a modern, cyber-capable agent. https:// blog.trailofbits.com/2026/08/2 6/vms-wont-contain-
So, @ trailofbits did a thing… “We asked GPT 5.6-Cyber to escape a VM used to sandbox agents. It broke out three times. In its final escape, the agent found three 0-days on its own and chained them into a working exploit.” https:// blog.trailofbits.com/2026/08/2 6/vms-wont-contain-cyber-capable-agents/