Using a VM to Contain an AI Agent

It won’t work: My suspicion was that GPT 5.6-Cyber would succeed, but the frequency and manner of its success removed all doubt.

We have to reassess sandboxing quality for capable AI agents, and in general the software stack with which they interact. An off-the-shelf VM is not enough to contain a modern, cyber-capable AI agent.

There is simply too much attack surface. Even innocuous features (like running with a display) add extra, exploitable attack surface. My suspicion was that GPT 5.6-Cyber would succeed, but the frequency and manner of its success removed all doubt.

We have to reassess sandboxing quality for capable AI agents, and in general the software stack with which they interact. An off-the-shelf VM is not enough to contain a modern, cyber-capable AI agent. There is simply too much attack surface.

Even innocuous features (like running with a display) add extra, exploitable attack surface.