Post by @cR0w@infosec.exchange

RE: https://mastodon.social/@LukaszOlejnik/117161940796927694

Another way to read this is that those VMs your org paid big money for were poorly engineered and we're now publicly seeing just how poorly.

Lukasz Olejnik

@LukaszOlejnik@mastodon.social yesterday

An off-the-shelf VM is not enough to contain a modern, cyber-capable AI agent. AI agent escaped a VM three times. First via known bugs, then via missed patches, then it found 0-days and chained them. AI can hack, and agents can persist, research, adapt, and weaponize software flaws faster than patch cycles can handle it. https://blog.trailofbits.com/2026/08/26/vms-wont-contain-cyber-capable-agents/

4 Replies

4 Boosts

Elric

@elricofmelnibone@mastodon.social 10 hr. ago

@cR0w Paraphrasing Theo de Raadt (because I don't remember the actual quote): "how can you expect people to write a secure virtualisation layer when they can't even write a secure operating system?"

Msb

@msb@mastodon.sdf.org 54 min. ago

@elricofmelnibone @cR0w
A secure OS would be nice, to run on systems with secure firmware built from systems with secure microcode.

:rainbowCrow:

@cR0w@infosec.exchange 52 min. ago

@msb @elricofmelnibone It's almost like all these people calling themselves "engineers" haven't been doing a good job with, you know, engineering concepts.

Msb

@msb@mastodon.sdf.org 36 min. ago

@cR0w @elricofmelnibone
Imagine if other engineering disciplines adopted 'agile' methodologies?
It would be like "sorry that toaster burned your house down, but by plugging it in, you agreed to waive all liability. Here's a 10% off coupon for our new Toast as a Service subscription with a guaranteed 6 month price freeze on monthly rates when you sign up for a year. We'll even include one free single serving jam packet"

2 more replies