Resources

People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!

Trail of Bits has been running GPT 5.6-Cyber on various tasks. With recent events surrounding the HuggingFace hack, the question is whether these sandboxing, virtual machine, and similar measures are actually safe from being circumvented. The claim is that LLMs are so sophisticated that they will find a way to escape.

First, they tried using their host kernel with known bugs, and it escaped. Then, they tried an up-to-date version, but it used known bugs that hadn't been patched to escape. Finally, it found several 0-days in the isolation techniques. They just gave it a simple task: break out of the sandbox with KVM, and QEMU.

To escape, it used three 0-days in total. In QEMU, it found a bug in which VAPIC could have a ROM alias that overlaps with locked SMRAM. This exposed the SMARAM and enabled execution of attacker-controlled SMM. In the KVM, it found two bugs that it used; one of them enabled QEMU heap modification. In libslirp, it found a bug that allowed for hijacking a callback on execution. These bugs are not details very well in this post.

It also found several other bugs in libslirp, CUPS and QEMU that weren't used. The purpose of the post is more a warning: AI is going to hack everything very soon. Putting something into a VM isn't enough like it used to be. Good post on the warning sign but I wish the bugs that it found were explained in more detail.