Incredible research worth reading which further solidifies if the sand doesn’t stay in the box it’s not a sandbox. In this case, an LLM escaped a VM 3 times. A VM is not a sandbox. A sandbox is a sandbox. A VM can also have a sandbox, but it needs to keep the sand in the box.

Trail of Bits

@trailofbits · Twitter · 2026-08-26 11:15 UTC

We asked GPT 5.6-Cyber to escape a VM used to sandbox agents. It broke out three times. In its final escape, the agent found three 0-days on its own and chained them into a working exploit. https://blog.trailofbits.com/2026/08/26/vms-wont-contain-cyber-capable-agents/