VMs Won't Contain Cyber-Capable Agents

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://blog.trailofbits.com/2026/08/26/vms-wont-contain-cyber-capable-agents
• Blog Title: VMs Won't Contain Cyber-Capable Agents
• Suggested Section: Binary Exploitation > Common Exploiting Problems > QEMU/KVM VM Escapes, with cross-references from Linux Hardening > Kernel/LPE/CVE material and Network Services > libslirp/user-mode networking

🎯 Content Summary

Trail of Bits evaluated OpenAI GPT 5.6-Cyber by challenging it to escape a QEMU/KVM virtual machine running on a Debian 12 oldstable AMD Zen 3 host and read a host-side flag. The agent was launched outside the VM, received SSH access to the guest, and was allowed to download, build, test, and debug software; inspect dependencies; retrieve source code and research papers; create fuzzers, minimal test cases, and exploit oracles; invoke subagents; and maintain a research ledger. Sta...

🔧 Technical Details

Chain CVEs with unclassified fixes: Review ordinary upstream bug-fix commits in addition to CVE records. A known vulnerability may supply one memory primitive while a correctness fix reveals the second condition needed to obtain arbitrary host-process read/write. In host-facing VM components such as libslirp, arbitrary memory access can be converted into escape by locating and modifying QEMU heap objects, callbacks, or function pointers.

Attack user-mode networking from the guest: Networking libraries such as libslirp parse guest-controlled packets inside the host virtualization process. Fragment sequences with inconsistent Internet Header Length values can desynchronize reassembly accounting from later protocol processing. If ICMP reflection copies beyond the logical reassembled packet, repeated requests can generate recognizable live heap objects such as NetPacket structures.

Use heap spraying as an addre...

🤖 Agent Actions

Implemented the HackTricks update:

• Added src/binary-exploitation/qemu-kvm-vm-escape-chains.md
  • KVM stale shadow translations
  • libslirp heap landmarks and callback hijacking
  • VAPIC/SMRAM aliasing
  • QEMU display and queue-state bugs
  • CUPS loopback certificate abuse
  • Technical attack-surface reduction
  • Numbered primary-source references
• Linked the page from common-exploiting-problems.md.
• Added it under Common Exploiting Problems in src/SUMMARY.md.
• Validated references, Markdown fences, internal paths, and forbidden-source absence.

mdbook build was unavailable because mdbook is not installed.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://blog.trailofbits.com/2026/08/26/vms-wont-contain-cyber-capable-agents

Content Categories: Based on the analysis, this content was categorized under "Binary Exploitation > Common Exploiting Problems > QEMU/KVM VM Escapes, with cross-references from Linux Hardening > Kernel/LPE/CVE material and Network Services > libslirp/user-mode networking".

Repository Maintenance:

• MD Files Formatting: 990 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0