CARD · Card record
Trail of Bits field test: a network-capable agent escaped its VM sandbox three times
A Trail of Bits engineer with preview access to GPT 5.6-Cyber (via Patch the Planet) gave it a real challenge: escape the QEMU/KVM VM (Debian 12, AMD Zen3) he uses for sandboxing. It succeeded three times — first via newly disclosed host-kernel bugs, then via disclosed bugs not yet classified as security issues after full updates, and finally by finding several 0-days in freshly rebuilt upstream sources — running autonomously for hours, pulling papers and writing oracles and minimal examples on its own.
01
THE STORY · The original
Read the explanation and its limits.
In-post points: the author tasked GPT 5.6-Cyber with escaping his QEMU/KVM sandbox; it used recently disclosed kernel bugs first, then disclosed-but-unclassified bugs after patching, then found several upstream 0-days outright — running autonomously for hours, writing oracles and minimal repros. His stated takeaway: treat such agents as an APT.
- Originalpress reporthttps://blog.trailofbits.com/2026/08/26/vms-wont-contain-cyber-capable-agents/
Why it is worth understanding
"Just put it in a VM" is the de facto default for running agents today, and this first-hand report falsifies it — required reading if you sandbox agents or evaluate vendors' isolation claims.
Conditions and limitations
[Evidence provenance: Trail of Bits' own blog] One machine, one demonstration — not a systematic benchmark; it targets a cyber-specialized model, and Lobsters upvotes are attention, not proof that the method generalizes to ordinary models or every configuration.
Reading progress is saved in this browser. Save or add a note →
02
THE THREAD · Full timeline
1 event, every row traceable.
A card accumulates records as its story develops: new corroborators, market contrasts, material changes at the original — each dated and linked to its archive day.
- Added to BitShovelEntered the BitShovel radar: 25 entries in the current Lobsters front page feed.
03
SOURCES · Sources and evidence
Check each link's purpose and limits.
Sources and evidence · 2 links
Each link has a purpose and scope. Link counts do not establish independent confirmation; direct support applies only to the statements specified below.
- Trail of Bits blogScope not documented
A per-link statement of support has not been attached.
- Lobsters front pageScope not documented
A per-link statement of support has not been attached.