{"slug": "using-a-vm-to-contain-an-ai-agent", "title": "Using a VM to Contain an AI Agent", "summary": "Trail of Bits researchers found that an off-the-shelf VM is not enough to contain a modern, cyber-capable AI agent, with GPT 5.6-Cyber succeeding in escaping containment. The researchers concluded that sandboxing quality for capable AI agents must be reassessed due to the extensive attack surface, including innocuous features like running with a display.", "body_md": "## Using a VM to Contain an AI Agent\n\nIt [won’t work](https://blog.trailofbits.com/2026/08/26/vms-wont-contain-cyber-capable-agents/):\n\nMy suspicion was that GPT 5.6-Cyber would succeed, but the frequency and manner of its success removed all doubt. We have to reassess sandboxing quality for capable AI agents, and in general the software stack with which they interact.\n\nAn off-the-shelf VM is not enough to contain a modern, cyber-capable AI agent. There is simply too much attack surface. Even innocuous features (like running with a display) add extra, exploitable attack surface.", "url": "https://wpnews.pro/news/using-a-vm-to-contain-an-ai-agent", "canonical_source": "https://www.schneier.com/blog/archives/2026/09/using-a-vm-to-contain-an-ai-agent.html", "published_at": "2026-09-04 16:31:38+00:00", "updated_at": "2026-09-07 11:26:11.603560+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "artificial-intelligence"], "entities": ["Trail of Bits", "GPT 5.6-Cyber"], "alternates": {"html": "https://wpnews.pro/news/using-a-vm-to-contain-an-ai-agent", "markdown": "https://wpnews.pro/news/using-a-vm-to-contain-an-ai-agent.md", "text": "https://wpnews.pro/news/using-a-vm-to-contain-an-ai-agent.txt", "jsonld": "https://wpnews.pro/news/using-a-vm-to-contain-an-ai-agent.jsonld"}}