A security firm with preview access to GPT-5.6-Cyber escaped a VM three times in under a day

Trail of Bits has preview access to OpenAI's GPT-5.6-Cyber through the Patch the Planet partnership, and Dinaburg, opening his post with a direct reference to the OpenAI disclosure above, gave it one task: escape the QEMU and KVM virtual machine he normally uses to sandbox agents on his own Debian 12 dev machine. It got out three times. First it used a recently disclosed but unpatched host-kernel bug (CVE-2026-53359) to hardlock the machine within about an hour. After Dinaburg patched the kernel, it combined a known libslirp networking flaw (CVE-2026-9539) with an unmarked upstream bugfix commit to get an arbitrary read and write into host memory. After he rebuilt QEMU and its dependencies from the latest upstream source specifically to close that path, it spent roughly twelve hours working autonomously across many context resets and chained three fresh zero-days with one KVM bug that had been fixed upstream but not yet backported to his distribution's kernel. A parallel test against Firecracker, a microVM built for a minimal attack surface, resisted escape, though it still hardlocked the host on known, unpatched kernel flaws. "You can no longer assume a mere VM will contain a sufficiently advanced AI agent," Dinaburg wrote. "You should treat such agents as an advanced persistent threat."

Why it matters: this is a specific, falsifiable claim from someone who ran the test on his own machine, not a general warning: an off-the-shelf VM, even a fully patched one, has too much attack surface for a model this capable, and a distribution that lags upstream security fixes by even a few weeks should be assumed vulnerable to it. Purpose-built isolation like Firecracker, aggressive patching, and least-privilege network access are no longer optional hardening for anyone running a coding or security agent with real system access.