We gave GPT 5.6-Cyber one task: escape a QEMU/KVM VM used to sandbox agents.
It escaped three times. The final escape came from three 0-days the agent found on its own and built into a working exploit after we patched known bugs and rebuilt QEMU from upstream.
Our takeaway is off-the-shelf VMs cannot contain a modern, cyber-capable agent.
https://blog.trailofbits.com/2026/08/26/vms-wont-contain-cyber-capable-agents/
