The autonomous cyberattacks carried out over the past few weeks by agents built on AI models from OpenAI, Anthropic, and Meta have shown impressively how important it is to properly isolate AI agents, especially in cybersecurity testing. According to research from Trail of Bits, though, simply confining agents to virtual machines isn't enough.
Escaped the VM three times
As Trail of Bits researcher Artem Dinaburg describes it, he tested OpenAI's language model GPT 5.6-Cyber inside a QEMU/KVM VM on his Linux development system running Debian 12, a setup he normally uses for sandboxing. The AI managed to break out of the VM three times.
Virtual machines are commonly used to test things that could cause damage on a production system. A VM runs a separate operating system, and snapshots make it easy to restore an earlier state. That gives VMs a degree of protection, for instance when opening and examining files potentially infected with malware. But virtual machines always share resources with the host system too, for things like displaying the desktop, mouse and keyboard control, and file exchange between the systems. Security vulnerabilities can sometimes make it possible to break out of a VM through these channels and execute code on the host.
Known and new flaws exploited
That's exactly the kind of flaw GPT 5.6-Cyber found repeatedly during Dinaburg's tests. The researcher had explicitly instructed the AI to break out of the VM, but such breakouts are conceivable in other situations too. An AI agent could, for example, independently conclude, based on a task assigned to it, that it might find a solution or useful clues outside the VM, similar to OpenAI's attack on Hugging Face.
According to Dinaburg, GPT 5.6-Cyber exploited various security vulnerabilities for its VM breakouts. Some were already publicly known and simply hadn't been patched yet on the test system, such as the KVM flaw Januscape and a vulnerability in the networking library libslirp. On the third attempt, though, the AI reportedly also found and exploited three zero-day vulnerabilities. The AI agent reportedly worked autonomously for hours at a time during the tests, analyzing code and research papers and trying different approaches to escape the virtualized environment. Dinaburg provided only minor assistance, such as restarting his machine when the agent crashed the host kernel.
AI sandboxing as a new challenge
Against this backdrop, the researcher warns that a regular VM is no longer sufficient to isolate AI agents today. The attack surface is "simply too large," he says, and gets further inflated by seemingly harmless features. "We need to reassess the quality of sandboxing solutions for capable AI agents, and more generally the software stack they interact with," Dinaburg says. He recommends always limiting the permissions granted to an AI to the bare minimum required for the task and patching software used as quickly as possible. "I like older, stable software, but the backporting cycle for patches is simply too long," the researcher explains.
Dinaburg also advises switching to minimalist virtualization solutions with a smaller attack surface, such as Firecracker, developed by AWS. He also ran tests with it, but GPT 5.6-Cyber apparently only managed to crash the host system there, without escaping its VM. "With more time it might have succeeded, but Firecracker is clearly a much harder target," the researcher says.