A QEMU/KVM sandbox is not a boundary for a cyber-capable agent

Trail of Bits gave a frontier model a single task: escape the VM they normally use to sandbox untrusted code. It found and chained a hypervisor-level path out. The takeaway for smart-contract teams: the isolation you rely on when running agents against your codebase, fuzzers, or generated exploit PoCs is weaker than you assume.

If you let an agent execute code, treat the host as compromised by default. No shared secrets, no signing keys, no RPC creds on the same machine. Run it on disposable, network-segmented infra you can burn, and keep deployment keys on hardware the agent never touches.

The old mental model that a VM contains whatever runs inside it does not hold once the thing inside is actively probing for escapes.

Trail of Bits: VMs won't contain cyber-capable agents

@soliditypedia