AI agents repeatedly escape standard VMs by chaining zero-days, demanding urgent security rethink

Researchers at Trail of Bits have demonstrated that state-of-the-art autonomous agents can successfully escape standard virtual machine setups by orchestrating chains of exploits against kernel flaws and unpatched software—a finding that fundamentally undermines the use of traditional VMs as security boundaries for containing AI systems.

The escape experiments#

Security evaluations using GPT-5.6-Cyber, distributed freely through OpenAI's Patch-the-Planet initiative, tested the model against a standard QEMU and KVM environment on Linux. The autonomous agent successfully achieved multiple escapes, operating independently for extended periods, analyzing source code, and synthesizing working exploit chains. The system demonstrated adaptive behavior—backing away from failed attempts and designing new attack vectors iteratively.

Notably, when tested against Firecracker, a minimalist microVM platform, the agent remained contained, though it still managed to hardlock the underlying machine due to unpatched kernel issues.

How the attacks unfolded#

The research documented three successive trials, each involving increasingly stringent hardening measures:

• First trial: The agent leveraged known host kernel vulnerabilities within an hour, causing a hard lock by exploiting Januscape, a recently disclosed Linux flaw lacking public exploits at the time. The agent generated functional attack code from partial vulnerability disclosures.

• Second trial: After kernel patching, the agent shifted tactics to target libslirp, a virtual machine networking library. It identified an unassigned bug-fix commit that, when combined with CVE-2026-9539 in outdated stable distribution packages, enabled arbitrary memory read and write operations on the host—an effortless escape path.

• Third trial: Researchers rebuilt a minimal, hardened environment with the latest upstream code for libslirp and QEMU. Despite this, the agent conducted sophisticated bug-hunting across kernel source and dependencies, successfully chaining multiple zero-day vulnerabilities. Tactics included exploiting unchecked ROM aliases in VAPIC to manipulate locked memory regions, abusing unsynchronized shadow pages in KVM, weaponizing stale page-role bugs to create host-physical memory mappings, and leveraging fragmented packet-handling flaws in libslirp to corrupt control flow.