Running AI agents in virtual machines isolates execution environments. However, host-level vulnerabilities, network configurations, and credential privileges must also be taken into account.
The evaluation published by Trail of Bits on August 26, 2026 serves as material for making those determinations. Researchers tasked a preview build of GPT-5.6-Cyber with escaping a QEMU/KVM environment to read files on the host. This testing was not reproduced by our company.
Distinguishing the details and conditions of the "three attempts"
The report covers three vectors. However, it notes that the initial attempt hard-locked the host and the attack did not succeed completely. Summarizing this as "successful full escapes all three times within 12 hours" overlooks this distinction.
Subsequently, a chain involving known issues related to libslirp and an undisclosed issue was reported. Because environments were updated and rebuilt between attempts, this was not a result of repeating tests three times under identical conditions.
Additionally, the agent operated from outside the target VM via SSH, and there were instances where researchers rebooted the host. The host configuration also included specific conditions. This test does not show that all models, VMs, and cloud infrastructures can be breached in the same manner.
Reviewing updates and permissions separately during implementation
Drawing from the public report, we propose verifying the following points during implementation. This is not a checklist certifying specific configurations as secure.
| Item | Information to document before rollout |
|---|---|
| Infrastructure updates | Owners, versions, and update procedures for the host OS, hypervisor, and supporting libraries |
| Attack surface | Presence of unnecessary virtual devices, shared folders, and host-bound network communications |
| Operational privileges | Readable/writable data, executable actions, and credential lifespans |
| Monitoring and termination | Logged data, anomaly detection, and procedures for terminating execution |
| Recovery | Destruction and recreation of compromised environments, along with credential revocation workflows |
Assigning patch owners is not enough on its own. Verify whether fixes released upstream are reflected in the packages currently in use. Conversely, faster patching provides no guarantee of preventing all unknown zero-day issues.
Not evaluating credentials solely by where they reside
Even if credentials reside outside the VM, their impact remains if the agent can invoke high-privilege actions. Conversely, systems can be designed to grant short-lived, narrowly scoped permissions strictly needed for the task.
Under either approach, minimize actions an agent can execute and restrict production data access to only what is necessary. Combine destination restrictions, operation approvals, and credential revocations to evaluate the blast radius should isolation fail. Claiming "even if breached, we just have to recreate the environment" cannot be justified without reviewing the host and overall network.
When selecting managed execution environments, distinguish the layers updated by the provider from the templates, packages, and permissions managed internally. Even if updates are outsourced, designing your operational privileges remains your internal responsibility.
For organizing permissions, refer to AI Agent Identities and Permissions.
Reviewed the public report text on September 20, 2026. VM escape reproduction and attack code execution were not conducted. Assessing vulnerabilities in specific environments requires investigating their exact configurations and versions.
For designing AI agent execution environments and operational permissions, please contact GleamHub.
