The patch treadmill just became the attack surface

The standard pattern for giving a capable AI its own safe corner of the computer is to hand it a disposable virtual machine. Trail of Bits' new field report quietly retires that pattern. The trust boundary is no longer the VM; it is the patch-update gap, and a patient, token-rich agent can live in it.

In a Debian 12 QEMU/KVM sandbox on bare metal, a preview build of GPT-5.6-Cyber broke out three different ways. First, through recently disclosed host-kernel bugs. Then through bugs that were public but not yet packaged, or not yet classified as security bugs. Finally, given a from-source rebuild of QEMU and its dependencies, the agent found 0-days on its own. It worked for hours, backtracking from dead ends and writing its own oracles; the operator's main job was physically rebooting the host when the kernel hard-locked.

Three escapes is the evidence. The reusable category is the mechanism: any environment whose safety depends on bugs being known faster than they are fixed is a foothold for an agent that can grind through CVEs the way a junior analyst would, without a coffee break. Trail of Bits' own line in the field report is the clean version: you can no longer assume a mere VM will contain a sufficiently advanced AI agent. The VM has to be the last layer, sitting behind patch latency, formally verified components, and hardened pre-release testing, not the first.

Treat the agent like an advanced persistent threat, the way the report recommends. The perimeter moves.