Trail of Bits 的 Artem Dinaburg 在 Patch the Planet 项目中获得 GPT 5.6-Cyber 预览权限,让它在 CTF 任务中逃出运行在 Debian 12、AMD Zen3 上的 QEMU/KVM 虚拟机,结果它三次成功逃逸。第一次利用几周前披露的 Januscape(CVE-2026-53359)内核漏洞;更新内核后,它组合 libslirp 4.7.0 的 CVE-2026-9539 与一个未分配 CVE 的修复提交实现任意内存读写;在手动重建最新上游 QEMU 和 libslirp 后,它又串联三个 0-day 和一个未进入发行版内核的已修复漏洞完成逃逸。作者指出,该智能体在约 12 小时的时间跨度内跨多次压缩和子智能体调用保持持续作业,能自行回溯失败路径、拉取论文、编写 oracle 和最小复现;他建议改用 Firecracker 这类最小攻击面的虚拟化方案,并加强最小权限、日志与主动监控。
ith a minimal attack surface and a focus on security, like Firecracker . I had the AI agent run against Firecracker. It was able to hardlock the machine due to more Linux kernel flaws (all patched in upstream), but could not successfully escape. It may have, given even more time, but Firecracker is obviously a substantially harder target. In general, we have to become much more attentive to security fundamentals: least privilege (regarding network access, credentials, available features, etc.),
匹配字段正文