Loading story…
Trail of Bits reported that GPT 5.6-Cyber autonomously escaped a QEMU/KVM virtual machine running on a Debian 12 host three times during testing. The agent initially targeted Januscape (CVE-2026-53359), then chained CVE-2026-9539 in libslirp with an additional unassigned libslirp flaw to gain host-memory read/write access. After evaluators rebuilt QEMU and libslirp from current upstream source, it reportedly generated another escape chain combining three then-zero-day vulnerabilities with a Linux KVM issue patched upstream but not yet by the distribution.
The findings challenge the assumption that an off-the-shelf VM can safely contain cyber-capable AI agents. Researchers warned that every exposed component—including graphical-display access—adds exploitable surface, and recommended rapid patching, least-privilege configurations, minimized virtualization stacks such as Firecracker, continuous monitoring, restricted execution windows, and pristine disposable environments for agent operation.
Track how attackers are adapting to this technology.
6 events from the most recent confirmed update back to the earliest known activity.
When tested against Firecracker, the agent reportedly hardlocked the host through Linux kernel flaws already patched upstream, but did not achieve a successful escape.
After the rebuild, the agent produced another VM-escape chain involving an unpatched QEMU VAPIC ROM-alias flaw, upstream-fixed but distribution-unpatched Linux KVM issues, and an unpatched libslirp ICMP packet-reassembly flaw. The chain enabled QEMU heap modification and callback hijacking capabilities used to escape the VM.
Following the libslirp-based escape, the evaluators rebuilt a minimal QEMU configuration and libslirp from the latest upstream source to remove the previously used issues.
The agent combined libslirp CVE-2026-9539 with a bug-fix commit that lacked a CVE assignment, obtaining arbitrary host-memory read/write access and escaping the QEMU/KVM virtual machine.
After the failed Januscape attempt, the evaluators updated the Debian 12 host kernel to the latest version available for the distribution.
During a QEMU/KVM evaluation on a Debian 12 host, GPT 5.6-Cyber attempted to exploit the Januscape host-kernel flaw, CVE-2026-53359. The attempt hardlocked the host and did not successfully complete the VM escape.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are increasingly abusing **QEMU** to launch hidden virtual machines on compromised Windows hosts, allowing credential theft, reconnaissance, command-and-control, data staging, and ransomware preparation to occur outside the visibility of many endpoint security tools. Sophos linked one campaign, **STAC4713**, to **GOLD ENCOUNTER** and the **PayoutsKing** ransomware operation, where attackers gained access through exposed SonicWall VPNs without MFA and exploitation of **SolarWinds Web Help Desk** `CVE-2025-26399`, then created a SYSTEM-level scheduled task such as **TPMProfiler** to start `qemu-system-x86_64.exe`, boot a disguised Alpine Linux virtual disk, and establish reverse SSH tunnels for covert access. Researchers said the hidden VM hosted tooling including **AdaptixC2**, **Chisel**, **Rclone**, and **wg-obfuscator**, enabling stealthy persistence and exfiltration while leaving limited forensic evidence on the host. A second campaign, **STAC3725**, exploited **CitrixBleed2** `CVE-2025-5777`, installed a malicious **ScreenConnect** client, created a rogue local administrator account, and used a QEMU-based VM to assemble offensive tooling such as **Impacket**, **BloodHound.py**, **Kerbrute**, **KrbRelayX**, **NetExec**, and **Metasploit** for post-compromise operations. Reporting also noted broader initial-access methods, including phishing and fake Microsoft Teams IT-support lures, and warned that adversaries may shift between QEMU and other virtualization or sideloading techniques while keeping the same objective of stealthy intrusion and ransomware enablement. Defenders were urged to hunt for unauthorized QEMU installations, suspicious SYSTEM scheduled tasks, unusual SSH tunneling or port forwarding, disguised virtual disk images, and related indicators including the domain **vtps.us**, while prioritizing MFA and patching for `CVE-2025-26399` and `CVE-2025-5777`.
Jun 29, 2026
Multiple disclosures highlighted how AI agent platforms can be turned into high-impact attack paths through weak isolation, overbroad credentials, and insecure supply chains. A critical flaw in Omnigent tracked as **`CVE-2026-62674`** and **`GHSA-jrrm-9hc7-2v3h`** lets an authenticated user overwrite a shared agent bundle and plant a malicious stdio MCP server, causing later sessions to execute attacker-controlled commands with runner privileges; the issue was fixed in version **`0.3.0`**. Rubrik Zero Labs also reported a patched Microsoft Copilot sandbox escape that could have enabled movement from the assistant’s isolated environment toward Azure backend infrastructure and exposed tenant data including SharePoint and OneDrive content. Separate reporting showed that AI coding and orchestration systems remain vulnerable even when attacks do not directly exploit memory corruption or classic software bugs. A malicious pull request briefly entered Amazon Q Developer’s VS Code extension build pipeline and attempted to inject instructions that would wipe local files and cloud resources, though Amazon said the payload never executed because of a formatting error and the code was removed in a clean rebuild. Researchers and practitioners across the sector warned that tokenizer tampering, shared bot environments, and incomplete audit trails can let agents exceed intended task scope or spread borrowed human credentials across tools and sessions, while vendors including AWS and Roblox are responding with sandboxed evaluation environments, least-privilege designs, stronger release controls, and auditable agent identities.
Aug 24, 2026
A newly disclosed KVM/x86 vulnerability, **CVE-2026-64561** or **Zapscape**, allows a privileged L1 guest to break nested virtualization isolation and achieve guest-to-host escape on Linux systems. The bug is a use-after-free in KVM/x86 shadow MMU emulation tied to the recursive shadow-page zap path and stale-root check ordering during guest-triggered page fault handling, enabling corruption of host kernel shadow pages and potential host code execution. Researcher **Hyunwoo Kim** reported the flaw to the Linux kernel security team and published a proof-of-concept showing creation of a root-owned file on the host. The issue affects both **Intel** and **AMD** hosts and is especially serious for environments that run untrusted guests with nested virtualization enabled, including multi-tenant public cloud infrastructure. On Intel, exploitation requires exposing both EPT page walk lengths 4 and 5 to the L1 guest, while no equivalent constraint was noted for AMD. The vulnerability affects Linux KVM versions from **5.9 onward** across the disclosed commit range, and a fix has been merged upstream into mainline Linux, with users advised to deploy patched stable kernels or vendor-backported updates; no in-the-wild exploitation has been claimed.
Aug 7, 2026