A Trail of Bits researcher reports that preview access to GPT 5.6-Cyber produced three virtual-machine escape attempts against a QEMU/KVM guest running on a Debian 12 host with an AMD Zen3 processor. The agent was given SSH access to the guest and a CTF objective of reading a flag on the host. It autonomously researched code and papers, built test cases and exploit components, retried failed paths, and operated for roughly 12 hours across multiple context compactions. Several attempts hardlocked the host kernel. The first escape attempt used Januscape, CVE-2026-53359, in the host kernel but did not complete cleanly. After the kernel was updated, the agent combined CVE-2026-9539 in Debian's libslirp 4.7.0 with an unclassified libslirp fix to obtain host memory read/write capability. After QEMU and libslirp were rebuilt from current upstream source, the reported final chain used three then-unpatched flaws in QEMU, Linux KVM, and libslirp, plus a KVM bug patched upstream but absent from the distribution kernel. The researcher says an off-the-shelf VM should not be assumed to contain capable cyber agents, particularly on slower-updating systems. Firecracker resisted escape in a separate test, although the agent still triggered host hardlocks through upstream-patched Linux kernel flaws. The researcher recommends rapid patching, least privilege, monitoring, limited execution windows, and fresh environments.

Proxmox has been decommissioned in favor of NixOS running Incus for managing a homelab. The transition involved migrating from a multi-node Proxmox cluster to a declarative configuration using NixOS.