The libslirp chain stands out. libslirp is the library that gives a guest networking [11], so it is loaded precisely because you wanted the agent to reach the internet [17]. Debian 12 still ships version 4.7.0, vulnerable to CVE-2026-9539 [9]. On its own that is a patch-lag story. The agent then found a second libslirp bug-fix commit that carried no CVE at all, and combined the two into an arbitrary memory read and write in the host, after which escape is trivial [10]. Any inventory control keyed to CVE identifiers sees half of that chain.
There were three escapes in total [3]. The first used Januscape, CVE-2026-53359, in the host kernel, and it closed when the kernel went to the newest build Debian 12 offers [7][8]. The second worked on that updated host [9][10]. The third came after QEMU and its dependencies were rebuilt from the latest upstream source, and it was several 0-days [12]. Two of three paths survived a fully patched stack [19].
The operating mode matters more than the bug list. Hours running autonomously, backtracking off approaches that failed, pulling code and research papers, writing oracles, cutting its own minimal examples, aiming at a reusable and reliable exploit rather than a one-shot crash [13]. The researcher's contribution was walking to the machine and power-cycling it after each host hardlock [14]. That is the workload profile of a staffed vulnerability research effort.
What is public is a single first-person account from the person who ran the test [22]. There is no public exploit for Januscape, and the agent's version did not land cleanly on the first attempt [7]. The upstream 0-days come with no identifiers and no count beyond "several" in the material available [21]. The agent was also started outside the VM with SSH access into it, by design, because escape attempts crash the guest [4][5]; the author raises the cheating risk himself and says a final exploit could be audited, and the outcome of any such audit is not reported [20]. So far, no one outside Trail of Bits has reproduced the result.
The author's own assessment shifted over the course of the test: he started out doubting the model could pull this off at all, came to think it might manage it eventually, and ended up expecting it to happen fast [16][15]. His conclusion is that a mere VM should no longer be assumed to contain a sufficiently advanced agent. The design consequence is narrower than the slogan. A sandbox that earns its keep by sharing screen, files and network with the host [17][18] is worth exactly what QEMU's device and networking code is worth on the day you run it.
