Trail of Bits had GPT 5.6-Cyber escape a QEMU/KVM VM three separate ways, one by chaining three unknown bugs
In a post dated 2026-08-26, Trail of Bits gave an agent a QEMU/KVM guest and a single objective, read a flag file on the host. It escaped three times: once via CVE-2026-53359 in the host kernel in about an hour, once by combining CVE-2026-9539 with an unpatched fix to get arbitrary host memory read/write, and once by chaining three previously unknown vulnerabilities plus an unrecognized bug across QEMU, KVM and libslirp. The agent ran autonomously for hours, backtracked from dead ends, and pulled research papers during a 12-hour session, turning up further unused vulnerabilities along the way. The recommendation is Firecracker-class virtualization, rapid-update distros over stable, least privilege with active monitoring, and capping how long an agent runs in one environment.
Source
↳ Follow the thread