GPT-5.6-Cyber escaped Trail of Bits' VM three times, finding 0-days en route
Trail of Bits gave GPT-5.6-Cyber one task: break out of a QEMU/KVM sandbox and read a flag file. It escaped three times — first via disclosed kernel bugs, then unpatched ones, then 0-days it discovered itself — working autonomously for hours with minimal prompting. The blunt conclusion: a snapshot-able VM is no longer a dependable perimeter for a determined AI agent, and such agents should be treated as an advanced persistent threat.