VMs won
Summary: Trail of Bits gave GPT 5.6-Cyber preview access and tasked it with escaping a QEMU/KVM VM on a Debian 12, AMD Zen3 Linux host; the agent escaped three times, first via the Januscape kernel bug (CVE-2026-53359), then by combining libslirp CVE-2026-9539 with an unmarked fix commit, and finally through a chain of three 0-days plus one patched vulnerability that had not reached the distribution kernel. The agent ran autonomously for roughly 12 hours across multiple compactions and subagent invocations, backtracked from failed paths, and against Firecracker it hardlocked the machine using patched upstream kernel flaws but did not escape.
Why it matters: An off-the-shelf VM is no longer a containment boundary for a capable agent: this one found three 0-days and built a reliable escape in about 12 hours, so any sandbox resting on an oldstable distribution that lags upstream patches should be treated as already compromised.
Read the original at Trail of Bits Blog ↗
- Mentions
- CVE-2026-53359
- Related