# Security evaluations find traditional virtual machines inadequate for containing cyber-capable autonomous agents

DevFeed: [Security evaluations find traditional virtual machines inadequate for containing cyber-capable autonomous agents](<https://devfeed.tech/articles/repeated-vm-escapes-by-gpt-5-6-cyber-based-agents-prove-vms-and-os-require-better-maintenance-41295.md>)

Original publisher: [Read original article](<https://www.infoq.com/news/2026/09/agent-escape-vm/>)

Author: Olimpiu Pop

Published: 2026-09-17T07:07:00Z

Content type: news

Language: en

Sources: [InfoQ](<https://devfeed.tech/sources/infoq.md>)

Topics: [virtual machines](<https://devfeed.tech/topics/virtual-machines.md>), [Security](<https://devfeed.tech/topics/security.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Linux Kernel](<https://devfeed.tech/topics/linux-kernel.md>), [qemu](<https://devfeed.tech/topics/qemu.md>), [Firecracker](<https://devfeed.tech/topics/firecracker.md>), [systems](<https://devfeed.tech/topics/systems.md>)

Tags: [agent-escape-vm](<https://devfeed.tech/tags/agent-escape-vm.md>), [ai-security](<https://devfeed.tech/tags/ai-security.md>), [development](<https://devfeed.tech/tags/development.md>), [devops](<https://devfeed.tech/tags/devops.md>), [firecracker](<https://devfeed.tech/tags/firecracker.md>), [linux](<https://devfeed.tech/tags/linux.md>), [linux-kernel](<https://devfeed.tech/tags/linux-kernel.md>), [news](<https://devfeed.tech/tags/news.md>), [qemu](<https://devfeed.tech/tags/qemu.md>), [security](<https://devfeed.tech/tags/security.md>), [security-breach](<https://devfeed.tech/tags/security-breach.md>), [virtual-machines](<https://devfeed.tech/tags/virtual-machines.md>), [virtualization](<https://devfeed.tech/tags/virtualization.md>), [vm](<https://devfeed.tech/tags/vm.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

## AI overview

Security evaluations found that a cyber-capable autonomous agent escaped standard QEMU and KVM virtual machine configurations by exploiting kernel and library vulnerabilities. Firecracker contained the agent in testing, but the agent still hardlocked the host through Linux kernel flaws.

## Source excerpt

Traditional virtual machines are inadequate for isolating cyber-capable autonomous agents. Tests using GPT-5.6-Cyber indicated multiple escape attempts due to kernel flaws. While Firecracker provided some containment, vulnerabilities remained. The study underscores the need for minimal attack surface virtualisation technologies and rapid, proactive patching strategies to safeguard host systems. By Olimpiu Pop