Trail of Bits pointed GPT 5.6-Cyber at its own sandbox and watched it break containment three times, with the author patching each hole before the next run, ending with a roughly 12-hour autonomous run that chained zero-days across QEMU, Linux KVM, and libslirp, backtracking from dead ends and rebuilding exploit chains as it went. The first escape went through Januscape (CVE-2026-53359), a use-after-free in KVM’s x86 shadow MMU that Hyunwoo Kim had already used as a 0-day in Google’s kvmCTF without releasing the full escape exploit, so the agent wrote its own. Their takeaway is blunt: a distribution with rapid updates is now a requirement, and anyone containing cyber-capable agents should be on hardened microVMs like Firecracker instead of a stock hypervisor. The VM was supposed to be the box you put the demon in; this demon reads QEMU changelogs.
