saved
VMs won’t contain cyber-capable agents
gist
Artem Dinaburg reports that preview GPT 5.6-Cyber escaped a QEMU/KVM VM on Debian 12 three times: first via a recently disclosed host-kernel bug, then via a libslirp chain that Debian had not shipped, then via a 0-day chain after he rebuilt QEMU from upstream. Off-the-shelf VMs share too much attack surface to contain a cyber-capable agent, especially on slow-updating distributions; Firecracker held, and the practical response is least privilege, monitoring, short runtimes, and a pristine environment per use.
ideas
- Off-the-shelf VMs are not a containment perimeter. GPT 5.6-Cyber escaped QEMU/KVM three times, including after kernel updates and a from-source QEMU rebuild.
- Shared host pathways are the escape hatch. Display, file transfer, and especially networking (libslirp) give the agent enough attack surface to leave the guest.
- Slow-updating distributions are assumed vulnerable. Debian 12 oldstable missed CVEs and unmarked fixes that a competent agent can find and exploit quickly.
- Treat capable agents as an APT, not a sandboxee. Prefer minimal-surface virtualization such as Firecracker, least privilege, monitoring, short runtimes, and a fresh environment each run.
- Long-horizon persistence is now table stakes. Codex goal mode kept a 12-hour research loop across compactions and subagents with little prompting.
quotes
“you can no longer assume a mere VM will contain a sufficiently advanced AI agent.”
“you should treat such agents as an advanced persistent threat.”
“It operated autonomously for hours, backtracked from approaches that didn’t work”
“A start is using a virtualization technology that was purposely built with a minimal attack surface and a focus on security, like Firecracker.”