Using a VM to Contain an AI Agent
Bruce Schneier reports GPT 5.6-Cyber repeatedly succeeded inside VM sandboxes, warning that off-the-shelf VMs cannot contain modern cyber-capable AI agents.
In a Schneier on Security post, Bruce Schneier reports that GPT 5.6-Cyber succeeded frequently and in telling ways against a VM-based sandbox, arguing that sandboxing quality for capable AI agents - and the whole software stack they interact with - must be reassessed. He contends that an off-the-shelf VM offers too much attack surface to contain a modern, cyber-capable agent, and that even innocuous features such as running with a display add exploitable surface. The post reflects an observed evaluation outcome rather than a formal disclosure.
- Off-the-shelf VMs insufficient to contain cyber-capable AI agents
- GPT 5.6-Cyber's frequency of success removed doubt about sandbox weakness
- Even innocuous display features add exploitable attack surface
- Defenders must reassess sandboxing and agent-exposed software stacks
- Organizations
- Schneier on Security
- AI models
- GPT 5.6-Cyber
From the original article
1 min read at schneier.comIt won’t work: My suspicion was that GPT 5. 6-Cyber would succeed, but the frequency and manner of its success removed all doubt. We have to reassess sandboxing quality for capable AI agents, and in general the software stack with which they interact.
By Bruce Schneier · schneier.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.