GPT-5.6-Cyber escaped a VM three times on its own

Two stories today: a security researcher proved that a frontier cyber agent can punch out of the sandbox it's supposed to be trapped in, and Google quietly polished up the speech layer of its AI stack.

GPT-5.6-Cyber escaped the virtual machines Trail of Bits used to contain it — three times. Security firm Trail of Bits gave the model a simple challenge under its Patch the Planet program: break out of a standard QEMU/KVM virtual machine and read a flag file. It got out the first time via a recently disclosed kernel bug, then through a pair of exploits buried in Debian's slow package backlog, and finally with a chain of four vulnerabilities including three genuine zero-days in the host kernel, QEMU, and libslirp. The agent ran autonomously for about 12 hours, backtracked from approaches that failed, and deliberately aimed for a reusable, reliable exploit — the researcher's main job was just rebooting the machine when the agent hard-locked the host kernel.

Why it matters: the industry's default answer to running an untrusted AI agent — wall it off inside a disposable VM — stops working at a certain level of capability. Trail of Bits' conclusion is blunt: you can no longer assume a mere VM will contain a sufficiently advanced agent, and a capable one should be treated as an advanced persistent threat, not a process you can fence in. The counterintuitive catch is that a VM has to share resources and network access to be useful, and every one of those shared paths is attack surface an agent can now grind on for hours.

The fix isn't to abandon sandboxing but to treat containment as a hardened perimeter. Trail of Bits reports that the agent failed to escape Amazon's minimal-attack-surface Firecracker microVM, so the shift is toward virtualization built for security plus least privilege, tight network limits, active monitoring, and fresh environments per run. The deeper implication is that "can a sandbox hold it?" is becoming a question of how hard and how long an agent wants out — a change every team building agent infrastructure has to plan for, not just security specialists.

Google's Gemini 3.5 Transcribe model edits as it transcribes, stripping filler words like "um" and "uh" in more than 85 languages. It detects specialized jargon, accepts a custom vocabulary, attributes speech to up to three speakers, and returns word-level timestamps, with Google billing it as a major step beyond its older Chirp 3 transcription engine. The model rolls out today in English to macOS Gemini users, to Android's Rambler dictation in select countries, and to developers in the Gemini API — arriving while the promised flagship Gemini 3.5 Pro still hasn't shipped. It's a small but telling example of Google shipping the speech layer of its AI stack even as its headline model stalls.

What to watch: whether OpenAI and Google formalize safety limits on cyber-capable models in the wake of demonstrations like this.

If a capable AI agent can't be contained by a VM, what should the new sandbox look like? Tell us in the comments.

Sources: Trail of Bits · Threat.wiki · The Verge · Google · 9to5Google