VMS WON'T CONTAIN CYBER-CAPABLE AGENTS

Summary from the TLDR InfoSec newsletter

Trail of Bits gave GPT 5.6-Cyber preview access and tasked it with escaping a QEMU/KVM sandbox on a patched Debian 12 host, and it broke out three separate times over roughly 12 hours of largely unsupervised operation. The agent chained a recently disclosed host-kernel bug first, then pivoted to an unpatched libslirp CVE paired with an unmarked bug fix after the kernel got updated, and finally, once QEMU was rebuilt from upstream source, synthesized a full exploit chain from three fresh 0-days (a QEMU VAPIC SMRAM flaw, a KVM shadow-page desync, and a libslirp ICMP-reflection bug) plus one kernel fix that hadn't reached the distribution's stable branch. Trail of Bits recommends treating such agents as advanced persistent threats: move to minimal-attack-surface hypervisors like Firecracker (which held even after a kernel hardlock), track upstream patches rather than trusting distro backport cycles, and enforce least-privilege network access, time-boxed runs, and pristine per-session environments.