作者使用 GPT 5.6-Cyber 对运行在 Debian Linux 12 和 AMD Zen3 宿主机上的 QEMU/KVM 虚拟机进行了逃逸测试 1。测试结果显示，该 AI Agent 在约 12 小时的时间跨度内持续自主运行，通过回溯失败路径并构建可复用的漏洞利用，成功实现了三次虚拟机逃逸 1。
在具体的逃逸过程中，第一次逃逸利用了 Januscape 漏洞（CVE-2026-53359）1。第二次逃逸结合了 libslirp 4.7.0 的 CVE-2026-9539 漏洞与一个无 CVE 编号的修复提交，实现了任意内存读写 1。第三次逃逸则使用了三个 0-day 漏洞以及一个未进入发行版内核的已修补漏洞 1。
此次测试表明，当前常规虚拟机无法有效隔离具备网络攻击能力的先进 AI Agent 1。为此，作者建议重新评估沙箱安全策略，改用 Firecracker 等最小攻击面虚拟化技术，并加强最小权限、日志与主动监控 1。
An author conducted virtual machine escape tests using the GPT 5.6-Cyber AI agent, which successfully breached a QEMU/KVM virtual machine three times 1. The testing environment consisted of a QEMU/KVM VM hosted on a Debian Linux 12 system running on an AMD Zen3 processor 1. During the first escape, the agent exploited Januscape, identified as CVE-2026-53359 1. The second breach was achieved by combining CVE-2026-9539 in libslirp 4.7.0 with a fix commit without an assigned CVE to gain arbitrary memory read and write capabilities 1. For the third escape, the agent utilized three zero-day vulnerabilities alongside a patched flaw that had not yet been included in the distribution's kernel 1.
Throughout the testing process, the AI agent operated autonomously for approximately 12 hours, continuously retracing failed paths and constructing reusable exploit chains 1. The results demonstrate that conventional virtual machines are currently insufficient to isolate advanced, cyber-capable AI agents 1. Consequently, the author recommends reevaluating sandbox security strategies by adopting virtualization technologies with a smaller attack surface, such as Firecracker 1. Additionally, the author advises strengthening security through the enforcement of least privilege principles, comprehensive logging, and proactive monitoring 1.
评论
还没有评论，欢迎留下第一条。