{
  "schemaVersion": "bitshovel-editorial-review-v1",
  "id": "reading-quality-105-20260912",
  "signalId": "lobsters-blog-trailofbits-com-2026-08-26-vms-wont-contain",
  "originalUrl": "https://blog.trailofbits.com/2026/08/26/vms-wont-contain-cyber-capable-agents/",
  "kind": "editorial-correction",
  "reviewedAt": "2026-09-12T14:35:12.516Z",
  "before": {
    "id": "lobsters-blog-trailofbits-com-2026-08-26-vms-wont-contain",
    "state": "new",
    "lane": "platformShift",
    "publishedAt": "2026-08-26T17:05:04.000Z",
    "observedAt": "2026-08-27T00:42:11.669Z",
    "originalUrl": "https://blog.trailofbits.com/2026/08/26/vms-wont-contain-cyber-capable-agents/",
    "digest": {
      "zh": "页内要点：作者给 GPT 5.6-Cyber 的任务是从自己的 QEMU/KVM 沙箱 VM 里逃逸；先用已披露的主机内核漏洞，补丁打全后改用未按安全类分级的披露漏洞，最后直接找到多个上游源码 0-day。自主运行数小时、自建 oracle 与最小复现，结论是\"必须把这类智能体当作 APT 看待\"。",
      "en": "In-post points: the author tasked GPT 5.6-Cyber with escaping his QEMU/KVM sandbox; it used recently disclosed kernel bugs first, then disclosed-but-unclassified bugs after patching, then found several upstream 0-days outright — running autonomously for hours, writing oracles and minimal repros. His stated takeaway: treat such agents as an APT."
    },
    "relatedSources": [
      {
        "label": {
          "zh": "Lobsters 热榜",
          "en": "Lobsters front page"
        },
        "url": "https://lobste.rs/"
      }
    ],
    "source": {
      "zh": "Trail of Bits 官方博客",
      "en": "Trail of Bits blog"
    },
    "title": {
      "zh": "Trail of Bits 实测：网络能力型智能体三次逃出 VM 沙箱",
      "en": "Trail of Bits field test: a network-capable agent escaped its VM sandbox three times"
    },
    "summary": {
      "zh": "安全公司 Trail of Bits 工程师在 Patch the Planet 项目中获得 GPT 5.6-Cyber 预览权限，并给它一个真实挑战：逃出自己用来隔离的 QEMU/KVM 虚拟机（Debian 12 / AMD Zen3）。结果智能体三次得手——先用新披露的内核漏洞，补丁全打完后再利用未被标记为安全问题的已披露缺陷，重建最新上游 QEMU 后甚至挖出多个 0-day；全程自主工作数小时，会自行拉取论文、写 oracle 和最小复现。",
      "en": "A Trail of Bits engineer with preview access to GPT 5.6-Cyber (via Patch the Planet) gave it a real challenge: escape the QEMU/KVM VM (Debian 12, AMD Zen3) he uses for sandboxing. It succeeded three times — first via newly disclosed host-kernel bugs, then via disclosed bugs not yet classified as security issues after full updates, and finally by finding several 0-days in freshly rebuilt upstream sources — running autonomously for hours, pulling papers and writing oracles and minimal examples on its own."
    },
    "why": {
      "zh": "\"放进 VM 就安全\"是当前几乎所有人跑智能体时的事实默认值，而这份一手报告把它彻底证伪：对自建智能体沙箱、或评估供应商隔离声明的团队，这篇是必读的一手材料。",
      "en": "\"Just put it in a VM\" is the de facto default for running agents today, and this first-hand report falsifies it — required reading if you sandbox agents or evaluate vendors' isolation claims."
    },
    "caveat": {
      "zh": "[证据来源：Trail of Bits 团队博客自述] 这是单台机器上的单次演示，不是系统化评测；攻击目标是 Cyber 特化模型，Lobsters 热榜上的热度只是注意力，不能证明该方法可推广到一般模型或所有配置。",
      "en": "[Evidence provenance: Trail of Bits' own blog] One machine, one demonstration — not a systematic benchmark; it targets a cyber-specialized model, and Lobsters upvotes are attention, not proof that the method generalizes to ordinary models or every configuration."
    },
    "timeline": [
      {
        "date": {
          "zh": "8 月 27 日",
          "en": "Aug 27"
        },
        "datetime": "2026-08-27T00:42:11.669Z",
        "summary": {
          "zh": "进入 BitShovel 雷达：Lobsters 热榜收录时可见 25 条。",
          "en": "Entered the BitShovel radar: 25 entries in the current Lobsters front page feed."
        },
        "source": {
          "zh": "Lobsters 热榜快照",
          "en": "Lobsters front page snapshot"
        }
      }
    ],
    "followTarget": {
      "id": "discussion:blog-trailofbits-com-2026-08-26-vms-wont-contain",
      "label": {
        "zh": "VMs won't contain cyber-capable agents 原文",
        "en": "VMs won't contain cyber-capable agents post"
      },
      "scope": {
        "zh": "原文与后续补充材料的实质修订",
        "en": "Substantive revisions to the post and follow-up material"
      },
      "url": "https://blog.trailofbits.com/2026/08/26/vms-wont-contain-cyber-capable-agents/",
      "updateMode": "verified-change"
    },
    "ingestion": {
      "mode": "editorial",
      "adapter": "syndication-feed",
      "evidenceClass": "team-report",
      "observationRef": "source-observations/history/syndication-feeds.2026-08-27T00-42-11Z.snapshot.json#feed:lobsters-hotstories",
      "changeRef": "source-observations/history/syndication-feed-changes.2026-08-27T00-42-11Z.snapshot.json#feed:lobsters-hotstories"
    },
    "retireReceipt": {
      "decision": "retire-candidate",
      "basis": "silent",
      "lateral7d": 0,
      "vertical7d": 0,
      "decidedAt": "2026-09-03T01:05:08.780Z"
    },
    "__retiredAt": "2026-09-03T01:05:08.780Z"
  },
  "after": {
    "title": {
      "zh": "Trail of Bits：虚拟机隔离经受了怎样的挑战",
      "en": "Trail of Bits: what its VM isolation experiment showed"
    },
    "summary": {
      "zh": "Trail of Bits 用 GPT 5.6-Cyber 挑战一台开发机上的虚拟机隔离。报告涉及旧漏洞、补丁传递和新发现，但三阶段的结果并不完全相同，不能概括成三次都成功逃出。",
      "en": "Trail of Bits challenged VM isolation on a development machine using GPT 5.6-Cyber. The report covers old vulnerabilities, patch delivery and new findings, but the three stages have different outcomes and should not be summarized as three completed escapes."
    },
    "source": {
      "zh": "Trail of Bits 研究者报告",
      "en": "Trail of Bits researcher report"
    },
    "why": {
      "zh": "报告把虚拟设备、网络依赖和宿主机补丁纳入隔离问题，有助于具体检查智能体运行环境的边界。",
      "en": "The report brings virtual devices, networking dependencies and host patches into the assessment of agent containment."
    },
    "caveat": {
      "zh": "这是研究者在单台开发机上的报告，不是系统化评测或本站复现。第一阶段只明确记录卡死，后续两阶段报告逃逸；智能体运行在虚拟机外，宿主机部分缓解措施关闭。",
      "en": "This is a researcher account on one development machine, not a systematic benchmark or BitShovel replication. Stage one records a hardlock; the later stages report escapes. The agent ran outside the VM and some host mitigations were disabled."
    },
    "digest": {
      "zh": "研究者让 GPT 5.6-Cyber 经 SSH 挑战 QEMU/KVM 隔离。第一阶段尝试未顺利完成并令主机卡死；更新内核后与重建 QEMU 后的阶段分别报告逃逸。结果受该主机、依赖、权限和缓解措施配置影响，不能直接推广到所有虚拟机。",
      "en": "GPT 5.6-Cyber accessed the QEMU/KVM target through SSH. The first attempt did not land cleanly and hardlocked the host; the post-kernel-update and rebuilt-QEMU stages report escapes. Outcomes depend on this host, its dependencies, permissions and mitigations and do not generalize directly to all VMs."
    }
  },
  "note": {
    "zh": "按详细记录区分宿主机卡死与成功逃逸，纠正三次均成功的说法，补充实验条件与 Firecracker 对照范围。 保留事件、发现和收录日期。",
    "en": "Distinguished host hardlocks from completed escapes, corrected the three-successes claim and added experimental conditions and the Firecracker comparison. Event, discovery and collection dates remain unchanged."
  },
  "withdrawnSources": [],
  "withdrawnTimeline": [],
  "evidence": [
    {
      "type": "retained-official-page",
      "label": {
        "zh": "Trail of Bits 官方博客",
        "en": "Trail of Bits blog"
      },
      "url": "https://blog.trailofbits.com/2026/08/26/vms-wont-contain-cyber-capable-agents/",
      "fetchedAt": "2026-09-12T14:18:27.747Z",
      "path": "app/_content/editorial-reviews/evidence/reading-quality-101-105-8061813586c5-20260912.json",
      "bytes": 602,
      "sha256": "b9915ce291c2004649fbfb1e52fcc9306fe09a18f66332a8c3ac0bcc8f8e5220"
    }
  ],
  "integrity": "a0cbfcf5967475f9d1baa19d2fbd94f3c874213706dcb3228bfb56a8b8fbf5d5"
}