{"slug": "pwn-research-details-a-firecracker-escape-that-runs-host-code-as-root", "title": "PWN Research details a Firecracker escape that runs host code as root", "summary": "PWN Research published a write-up detailing a Firecracker escape in which a guest holding a host memory primitive can hijack a vCPU thread, turning a memory bug inside the microVM into root code execution on the host. The finding matters because Firecracker is a common sandbox for running untrusted agent code, so the flaw lets a guest compromise the machine hosting it.", "body_md": "Firecracker is a common sandbox for running untrusted agent code. The write-up shows that a guest holding a host memory primitive can hijack a vCPU thread, so a memory bug inside the microVM becomes root code execution on the host that runs it.\nRead: Firecracker is a common sandbox for running untrusted agent code. The write-up shows that a guest holding a host memory primitive can hijack a vCPU thread, so a memory bug inside the microVM becomes root code execution on the host that runs it.\nTry: Behind LLM gateways with telemetry or flags off, auto mode no longer proceeds on calls the server cannot check unless CLAUDE_CODE_AUTO_MODE_SERVER=0. The new denyInsteadOfPrompting setting lets unattended runs fail fast rather than hang on a prompt.\nRead: Most of the gain came from low-risk resale, not riskier play, so the improvement is in steady long-horizon execution. Anthropic also tested teams against a secretly sabotaging member, the compromised-peer case multi-agent safeguards exist to catch.\nRead: Refit for the largest open models moves about 10 TB per step, and Reshard sends only the theoretical minimum data between layouts. Refit repeats on every RL post-training step, so the speedup cuts a cost paid throughout a whole training run.\nRead: Horinger has up to 286 MW of IT power, and Epoch projects 70% more compute by early 2028. That growth would leave it near 12% of Colossus 2's compute today, so Huawei's Ascend campus stays a small fraction of one US training site.\nRead: Terminal-based agent tools can now embed a production terminal emulator under semantic versioning instead of writing their own. JetBrains' IDE terminal and several agentic coding tools already run on it, so the 1.0 promise covers code in use today.", "url": "https://wpnews.pro/news/pwn-research-details-a-firecracker-escape-that-runs-host-code-as-root", "canonical_source": "https://www.vibeleaderboard.ai/intel/brief/2026-11-07", "published_at": "2026-11-07 12:01:59+00:00", "updated_at": "2026-11-09 01:58:06.096157+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "ai-infrastructure"], "entities": ["PWN Research", "Firecracker"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/pwn-research-details-a-firecracker-escape-that-runs-host-code-as-root", "markdown": "https://wpnews.pro/news/pwn-research-details-a-firecracker-escape-that-runs-host-code-as-root.md", "text": "https://wpnews.pro/news/pwn-research-details-a-firecracker-escape-that-runs-host-code-as-root.txt", "jsonld": "https://wpnews.pro/news/pwn-research-details-a-firecracker-escape-that-runs-host-code-as-root.jsonld"}}