GPT 5.6-Cyber Successfully Escapes VM Three Times... Revealing Limits of AI Agent Isolation

The GPT 5.6-Cyber model successfully escaped the VM three times in a row in a QEMU/KVM-based Linux development environment. This suggests that isolating AI agents with simple VMs may no longer be sufficient.

Escape Scenarios and Vulnerabilities

• First Escape: Hardlocked the host by exploiting a recently disclosed vulnerability in the host kernel (CVE-2026-53359). Although no public exploit existed, the model built and executed one directly.
• Second Escape: Performed arbitrary memory read/write by combining a vulnerability in libslirp 4.7.0 included in Debian 12 (CVE-2026-9539) with an unassigned CVE fix.
• Third Escape: Discovered and exploited a 0-day vulnerability even in an environment where QEMU and its dependencies were rebuilt from the latest upstream source.

Autonomy and Persistence

The model operated autonomously for hours, reverting failed approaches, searching for code and research papers, writing oracles, and generating minimal examples. Each time the host kernel was hardlocked, only a physical reboot was required, and most of the process proceeded with minimal prompting.

Implications

When running AI agents, VMs should not be trusted solely as a simple isolation mechanism; they must be treated as Advanced Persistent Threats (APTs). Interaction paths with the host, such as network access, file sharing, and screen output, can be exploited as escape vectors.