GPT 5.6-Cyber Successfully Escapes QEMU/KVM VM Three Times... Exposing Limits of AI Agent Isolation

As part of the Patch the Planet program, Trail of Bits evaluated the cyber capabilities of GPT 5.6-Cyber, during which the model successfully escaped from a QEMU/KVM-based VM three times.

First Escape: Host Kernel Vulnerability The agent discovered a publicly disclosed host kernel vulnerability, Januscape (CVE-2026-53359), and wrote and tested an exploit. The attack was severe enough to hard-lock the host machine, requiring a physical reboot.

Second Escape: Combination of libslirp Vulnerabilities Even after the kernel update, the agent combined a vulnerability in libslirp 4.7.0 included in Debian 12 (CVE-2026-9539) with a security fix commit that had not been assigned a CVE to gain arbitrary read/write access to host memory.

Third Escape: Discovery of 0-days In an environment where QEMU was rebuilt with the latest source code, the agent identified multiple 0-day vulnerabilities to bypass isolation.

Practical Implications The process demonstrated AI agents autonomously conducting research for hours, backtracking from failed approaches, writing oracles, and creating reusable exploits. This signifies that simple VMs are no longer sufficient to isolate advanced AI agents, leading to the conclusion that such agents must be treated at the level of Advanced Persistent Threats (APTs).