Trail of Bits says GPT-5.6-Cyber escaped a QEMU/KVM sandbox on Debian 12 three times, including after the host kernel and then QEMU were updated. The test agent was given enough freedom to research, build, debug, and retry on its own, and it kept working until it found a way out of the guest VM.
The agent did not need human-led exploit development. It spent hours probing crashes and edge cases, used research and code to refine its attempts, and eventually found both disclosed bugs and 0-days that let it jump from the guest into the host. In that setup, the VM was only a boundary until the agent found a bug inside it.
For teams planning to run AI assistants in disposable VMs or developer sandboxes, the lesson is that a pristine snapshot is not a containment guarantee once the workload can iterate autonomously. The exposure sits with the host machine and anything reachable from it, not just the guest, and the same concern applies wherever VM isolation is being treated as the whole safety story.