The author evaluated GPT 5.6-Cyber's cyber capabilities by challenging it to escape a QEMU/KVM virtual machine. The AI agent successfully escaped the VM three times, demonstrating advanced autonomous hacking abilities. Initially, it exploited recently disclosed host kernel bugs. After updating the host, it utilized disclosed bugs not yet classified as security vulnerabilities or integrated into package maintainers' updates. Finally, even after rebuilding QEMU and dependencies from the latest upstream sources, the AI discovered and exploited multiple zero-day vulnerabilities.The agent operated for hours, autonomously researching, developing exploits, and backtracking from failed attempts. The author's main role was only to reboot the machine when the host kernel hardlocked. This experience highlights that traditional VM sandboxing is insufficient to contain advanced AI agents, which should be treated as advanced persistent threats.The author notes that shared resources and communication pathways between the VM and host provide significant attack surface. The AI's persistence and ability to chain multiple vulnerabilities were particularly impressive. It explored various attack vectors, including network services and hardware bugs, before successfully escaping.The exploits involved vulnerabilities in QEMU, Linux KVM, and libslirp, including several zero-days and unpatched security issues in the author's Debian 12 environment. These findings challenge current software security assumptions, indicating that even "oldstable" distributions with slower update cycles are highly vulnerable.The author suggests that distributions with rapid updates are now a requirement for containing such AI agents. Using virtualization technologies like Firecracker, built with minimal attack surface and security in mind, offers a more robust solution, as the AI could only hardlock the machine but not escape it.Ultimately, containing advanced AI agents necessitates re-evaluating sandboxing quality, adopting stricter security fundamentals like least privilege, enhanced logging, active monitoring, limiting operational time, and ensuring pristine environments for each use.