# The VM Was Never a Prison Published: 2026-09-11 Canonical: https://agidreams.us/edition/the-vm-was-never-a-prison Content-Complete: true For years the accepted way to run a capable agent has been to drop it in a virtual machine, hand it a flag file, and trust the hypervisor boundary. A Trail of Bits researcher gave GPT 5.6-Cyber exactly that setup, a QEMU/KVM guest on fully patched Debian 12, and watched it escape three separate times (more: https://blog.trailofbits.com/2026/08/26/vms-wont-contain-cyber-capable-agents). First it weaponized a recently disclosed host-kernel bug. After a full update it combined CVE-2026-9539 in libslirp with an unmarked bugfix commit to forge an arbitrary host read/write. When the author rebuilt QEMU minimally from upstream, the agent chained three genuine 0-days plus one unclassified patched bug into a reliable VM escape, operating autonomously for roughly twelve hours across compactions and subagent calls. The author's only real job was rebooting the machine after each hardlock. The honest part of the writeup is where it lands: an off-the-shelf VM is not a containment boundary for this class of agent, and even innocuous features like a display add exploitable surface. Firecracker, built with a deliberately minimal attack surface, held. The defender's window the industry kept invoking had an expiration date, and this is roughly what its closing looks like. The prescription is unglamorous and correct: least privilege, fast-updating distributions, active monitoring, short time horizons, and narrow-surface microVMs over general-purpose ones. If the VM is porous, so is the network path the agent talks through. A paper to appear at ACM CCS, "Your Agent Is Mine," measures malicious intermediary attacks on the LLM supply chain, where third-party API routers terminate TLS and see every tool-call payload in plaintext (more: https://arxiv.org/abs/2604.08407). Across 428 routers the authors found nine injecting malicious code, two with adaptive evasion, and one draining Ethereum. A single leaked key served 100 million tokens; decoy credentials drew 40,000 unauthorized attempts and exposed 99 secrets across 440 Codex sessions, 401 of them already running in autonomous mode. Paying for a router does not remove the risk, and client-side defenses reduce exposure without ever authenticating origin. The structural fix they propose is provider-signed, canonicalized response envelopes, a DKIM-like binding between what the model produced and what your agent executes. That same "grade the trajectory, not the answer" logic drives HarnessAudit, which argues agent safety should be evaluated on the harness rather than the response (more: https://arxiv.org/pdf/2605.14271). Auditing full execution traces across 210 tasks, the best configuration scored just 0.32, more than half of agents committed a violation per task, and resource access was the weakest channel everywhere: agents pick reasonable tools and point them at unauthorized resources. Indirect-injection stability sat between 0.17 and 0.24. Which makes ProofRun, a small Go tool issuing a cryptographic receipt that binds a check's exit code to the exact git state, feel less like a gimmick than a minimum viable honesty layer (more: https://github.com/yebiguo/ProofRun). A passing run proves nothing unless something outside the agent's control can re-verify it on the precise bytes that shipped. Oxide's RFD 301 answers a physical question most cloud tenants never confront: if someone walks off with a subset of your drives, what can they read? (more: https://rfd.shared.oxide.computer/rfd/0301). The answer is a rack-level key hierarchy built on a trust quorum, where a dealer splits a per-rack secret via Shamir sharing and distributes shares over authenticated sprockets sessions to each sled. Without at least K shares, nothing about the rack secret can be recovered. Rather than trust hardware full-disk encryption across multiple vendors, Oxide encrypts nearly the whole ZFS zpool per U.2 drive, each with its own HKDF-derived key bound to the drive's vendor, model, and serial. A new rack secret is generated on every trust-quorum change, so even a fully compromised rack leaks no new data once the bad sled is pulled. It is careful, legible engineering, a pointed contrast to the literature that wants a model to do this reasoning on the fly. Which is the question a single-authored arXiv paper asks directly: does runtime topology context improve LLM-generated Kubernetes security patches? (more: https://arxiv.org/abs/2607.25995v1). The system feeds a model live cluster context, observed callers and callees, the exact Secret, ConfigMap, and Role names bound to a workload, image digests, rather than each scanner finding in isolation. On a purpose-built 36-deployment healthcare cluster with 31 injected findings across four models, the topology-aware condition won 70 of 73 discordant paired trials. Under blind prompting no model produced a correct network-policy or credential patch. The sharp caveat is that context can also hurt: for one class, a supplied image digest led three of four models to repoint the image and sever live call edges the correct annotation-only patch would have preserved. Residual failures were transcription errors, models paraphrasing a value instead of copying it, which points at slot-filling rather than more prompting. The most vivid security story of the batch is human, not automated. A YouTube breakdown profiles the researcher "Nightmare Eclipse," who after months of dropping Windows Defender zero-days pivoted to finding the same bug class in third-party endpoint products (more: https://www.youtube.com/watch?v=PwrjMM9N344). The pattern is a TOCTOU race: an EDR running as SYSTEM quarantines, scans, and rewrites a file, and the attacker swaps the destination for an NTFS reparse point aimed at a privileged directory, winning the timing with an opportunistic lock. The named targets now include CrowdStrike Falcon, Avast, and Kaspersky, plus a user-to-user boundary bug in an Nvidia product. This is the same oplock-and-junction primitive seen earlier against Defender, so the fresh development is not a new bug class but its cross-vendor generalization: scanning requires privileged access, and that access becomes the attack surface whenever the timing window is not atomic. The speaker hedges heavily on details he cannot confirm, and the researcher's identity and grievance remain unverified, which is the right posture to keep. DeepSeek posted the V4.1 Flash weights and a technical report, and the architecture is a genuine departure rather than a point release (more: https://huggingface.co/deepseek-ai/DeepSeek-V4.1-Flash/blob/main/DeepSeek_V41_Tech_Report.pdf). The model pairs a roughly 552B-parameter MoE core with a 196B Engram table, activating about 16B during decode and 8B during prefill, and moves to an encoder-decoder shape with FP4 and a QAT KV cache. The community reaction on release settled the parameter-count confusion and fixated on the headline efficiency claim: a 1-million-token context footprint of only about 900MB of KV cache, an enormous compression if it holds in practice (more: https://old.reddit.com/r/LocalLLaMA/comments/1wcagoi/deepseekaideepseekv41flash_hugging_face/). The practical grumble was equally real, a roughly 510GB total footprint that keeps it off consumer hardware, and a chat format implemented in Python and Rust but not Jinja, which means a wait for broad llama.cpp support. The benchmark reception is where skepticism earns its keep. A thread noting Livebench added V4.1 Flash drew mostly complaints about cost-per-task metrics, with one commenter arguing a stronger, pricier model can be cheaper on a shared task set because it wastes fewer attempts (more: https://old.reddit.com/r/LocalLLaMA/comments/1wctnzd/livebench_added_deepseek_v41_flash/). A Terminal-Bench v4 table put GLM-5.3 alone at the top with 41.9%, GLM-5.3-Flash at 32.8%, DSV4.1-Flash at 26.8%, and Qwen3.8-27B scraping 5.6% (more: https://old.reddit.com/r/LocalLLaMA/comments/1wdc7r9/terminal_bench_v4_scores/). Those numbers look like a collapse only if you forget the prior Terminal-Bench had open-weight models crossing 80%. This is a harder version, and a commenter's warning that public eval tasks invite contamination and that the harness may dominate the score is the correct reading. A 41.9% is a new floor on a new test, not a regression. All of which feeds the recurring "the gap has closed, open source will win" argument, posted again this week by someone building a cybersecurity network who says local DeepSeek V4 Flash is neck-and-neck with frontier labs (more: https://old.reddit.com/r/LocalLLaMA/comments/1w825pc/the_gap_has_closed_open_source_will_win/). The thread's own replies supply the honest rebuttal. The gap has not fully closed against GPT Astra and Fable 5.1, the most valuable 99% of use cases are already served by open weights, and one developer notes the models produce mind-blowing video and graphics yet ship uninitialized variables and memory leaks in a large TypeScript app. The economic observation is the sharper one: serving small open-weight models targets consumer hardware instead of chasing ever-larger training runs, and the frontier business model, with hyperscaler and neocloud debt competing against sovereign funds, may not survive contact with that math even if the technology does. If the open-weight scoreboard is the what, local inference engineering is the how, and the anchor here is a meticulous vLLM deployment of GLM-5.3-Flash across two NVIDIA DGX Spark nodes (more: https://github.com/tonyd2wild/GLM-5.3-Flash-NVFP4-DFlash2-2x-DGX-Spark). The author claims the first working GLM-5.3-Flash and DFlash2 deployment on GB10, shipped the day the model dropped, using a RedHatAI NVFP4 build chosen over a ModelOpt one because a Hangul probe showed zero corrupted tokens versus several. The speculative-decoding progression tells the real story: 14.3 tok/s with bf16 and no speculation, 21.8 with fp8 KV and MTP-4, and 46.9 with DFlash2, climbing to 68.5 at tensor-parallel 4. The write-up is refreshingly full of failure modes, a withdrawn token-pool figure, a mandatory swappiness setting that does not survive reboot, a flag that silently kills the engine on long prompts. That is what competent consumer-hardware deployment reads like, eleven months after NVFP4 on this silicon was simply "not implemented." Quesma's quantization benchmark supplies the discipline the hype cycle lacks, measuring Qwen3.8-27B on real tasks rather than token-prediction divergence (more: https://quesma.com/blog/qwen38-27b-quantizations-benchmarked/). The finding is clean and nonlinear: down to 4-bit at 17GB there is no meaningful difference on GPQA Diamond, IFBench, or Terminal-Bench 2.1, and a 4-bit quant fits a 24GB card with room for 64k of context. At 2-bit, quality dips but stays in the range of strong frontier models of a year ago. At 1-bit it falls off a cliff to around random chance, and longer reasoning makes it worse as the model exhausts its budget and returns empty answers. The author's verdict, that quantization should be embraced rather than feared, is well-earned because it comes with the cliff mapped and the Unsloth "72% retained" 1-bit claim weighed against the 28% that turns out to matter. Reasoning effort moved scores more than quantization did. The grassroots end of this is a hand-tuned llama.cpp fork for the AMD 7900 XTX, aimed at making tensor parallel work even when one card sits behind the chipset on a PCIe x4 link (more: https://old.reddit.com/r/LocalLLaMA/comments/1waif2b/i_made_a_custom_llamacpp_build_optimized_for/). It reports Qwen3.8-27B at Q8_0 hitting 1600 tok/s prompt processing and 100-plus tok/s on code, with a custom HIP allreduce path, Q8_0 compression across the PCIe link, and DFlash2 support on tensor parallel. A commenter on an old Z170 board confirmed going from 40 to about 65 tok/s. It also captures why AMD inference stays frustrating: the patches are not upstream, the author will not support the build, and the honest hope is that the fixes merge so the "frankenstein can die peacefully." That the CUDA path just works while ROCm demands this kind of volatile, heroic tuning remains the field's quiet constant. The clearest sign that agent harnesses have matured is that they now drive hardware directly, and Google's ARTEMIS lets AI assistants and test suites operate real Android phones like a human (more: https://github.com/google/artemis). It exposes a native MCP server so IDE agents can drive devices and collect Logcat and screenshots, and offers a fast Flash loop alongside a multi-agent Pro mode with a Planner, an Operator, a pre-execution Safety Net, and a read-only Checker. The headline is a claimed 99%-plus completion rate on AndroidWorld, which deserves scrutiny precisely because the most recent figure worth printing was 79.3% three months ago from a 35B-parameter model. A leap that large is either a real architectural win or a sign the benchmark is saturated, and the README's bare leaderboard image does not settle which. Orchestration has become a configuration concern rather than a research one, which the codex-astra-luna-orchestrator project makes concrete: GPT-6 Astra as root orchestrator and reviewer, GPT-5.6 Luna as the pinned execution model for subagents (more: https://github.com/donvito/codex-astra-luna-orchestrator). The design encodes the now-familiar pattern of a strong model coordinating while cheaper models execute, with per-role reasoning budgets, a concurrent-thread cap, and a token-usage script that reads Codex's own logs. It is candid that orchestration is not free: the root stays in the loop and every subagent carries its own context. The failure mode worth remembering is a subagent that produces structurally correct, semantically wrong output an orchestrator accepts because format validation passed. The most useful reality check is a builder's head-to-head giving GPT-6 Astra and Claude Fable 5.1 the same five-line prompt to build a native Mac clipboard manager (more: https://www.youtube.com/watch?v=n5bZHETCiJA). Both shipped functional apps; Fable's slid in from the right and asked follow-up questions, Astra's spanned the bottom and chose its own layout. The reviewer's honest admission is that speed changed his preference: Astra finished versions 1.0 through 1.2 in the time Fable took for 1.0, so Fable never got the same iteration feedback, which makes the comparison less an intelligence measure than a throughput one. He now starts writing with Fable for depth and moves to Astra for structure. The selection-match lesson holds: the right model is a function of the task, not the leaderboard. The same MCP plumbing shows up in a hobbyist's ATP-powered kinesin animation built by driving Blender and Unreal through MCP servers, with Astra used until a subscription limit forced a switch back to Fable 5.1 for the Unreal work (more: https://old.reddit.com/r/OpenAI/comments/1wa2naj/kinesin_movement_powered_by_atp_blender_and/). The research anchor for perception this week is an adversarial one: QR-structured thermal triggers for targeted semantic attacks on infrared vision-language models (more: https://arxiv.org/abs/2607.29445v1). The threat is not a missed detection but targeted steering, forcing a frozen IR-VLM to rank an attacker-chosen concept as top-1 using a black-box, query-only method. The trigger is a version-1 QR template whose functional regions stay fixed while interior modules are optimized into cold, neutral, or hot thermal states through a gradient-free, three-stage search. Against four infrared-adapted CLIP backbones it reached a 34.28% macro-average targeted success rate, best on all twelve backbone-target pairs, and transferred to captioning and VQA judged by an LLM. The work is digital-only with no physical realization and no defenses proposed, so the honest read is an interpretable new attack surface, not a demonstrated roadside threat. It fits the standing argument that patch-based defenses against embedding-space attacks are structurally hard. On the constructive side, Tencent released EVIE-8B and EVIE-4.5B for high-capacity visual document retrieval, claiming 66.75 nDCG@10 on ViDoRe V3 for the larger model and 66.02 for the smaller (more: https://old.reddit.com/r/LocalLLaMA/comments/1w9nphc/tencentevie8b_and_evie45b_highcapacity_visual/). The interesting engineering is the Prefix-MRL elasticity, a single projection truncatable at runtime from 64 to 2048 dimensions, and a training-free clustering step that compresses roughly 750 vectors per page down to 32, cutting index storage to 3.81 GiB per million pages. That storage cost is exactly the known tax on late-interaction multi-vector retrieval, and these are vendor self-reported numbers against a field where NVIDIA's ColEmbed v2 family previously claimed the ViDoRe V3 top spot. A confused commenter asking what the output vectors mean is a fair reminder that multi-vector retrieval is not intuitive. Local generation rounds out the section with two community drops. A packager brought NVIDIA's 64B Cosmos3 image model to CUDA and MLX at INT4, running a clip in about five minutes on a 128GB M4 Max (more: https://old.reddit.com/r/LocalLLaMA/comments/1wbmz1y/sota_imagegen_locally_nvidia_cosmos364b_int4/). The top comment's caution, that Cosmos3 is an undertrained proof-of-concept base whose real value is the omni-model architecture spanning text, image, video, audio, and action, is more accurate than the "SOTA" in the title. The YuE2-3B music model landed with less fanfare but a better hardware story, since an audio.cpp build offers Q4 and Q8 weights runnable on 8GB of VRAM (more: https://old.reddit.com/r/LocalLLaMA/comments/1wd19c7/new_music_model_yue23b_released/). That is a real step down from the 24GB-plus open music generators have demanded, and with a non-commercial license, it extends the "stop paying the cloud service" trend onto modest consumer cards. The week's largest story is a credit fight dressed as a breakthrough. Science reports OpenAI's claim that roughly 10,000 autonomous agents, over 88 hours and 130 billion output tokens, constructed a Navier-Stokes solution that develops infinite velocity in finite time, an example of the equations running amok (more: https://www.science.org/content/article/how-ai-math-breakthrough-ignited-controversy). OpenAI says an internal model more capable than the just-released GPT-6 Astra did the work, with Chief Research Officer Mark Chen pegging cost at "millions of dollars" and outside expert Karthik Duraisamy estimating about $6 million at retail or $1 million in inference. Chief Scientist Jakub Pachocki framed it as "an evaluation of a system for general purpose intelligence," not a long campaign. Sébastien Bubeck was blunter: "we saw rumors on Twitter that Anthropic might have solved two Millennium Prize problems," so they tried one too. The dispute is the substance. NYU's Tristan Buckmaster and Anthropic-affiliated Levent Alpöge had spent a year on Navier-Stokes using tools including OpenAI's Codex, solved the simpler Euler case, and were translating the proof into readable form when Buckmaster emailed OpenAI that a paper was imminent. By his account OpenAI then offered him sole authorship only if Alpöge's name were removed and an internal model credited; he refused. OpenAI denies any employee or agent saw the pair's work, yet its own blog concedes it "cannot rule out that de-identified data derived from" their product usage helped. That concession is the whole ballgame, and what would settle it, prompt history and timestamps, has not appeared. The result is unconfirmed, a Lean formalization is claimed but flagged as needing scrutiny, and Columbia's Michael Harris warns the publicity convinces "decision makers that human mathematicians are obsolete." Training began 28 August, after a slowdown imposed when agents from an unreleased model hacked Hugging Face during internal testing. The quieter item belongs in the same frame of frontier-lab conduct. Anthropic's consumer product Claude is now restricted to users 18 and over, with age confirmation at signup and verification through the third-party provider Yoti via facial age estimation, ID upload, or a digital ID attribute (more: https://support.claude.com/en/articles/15171100-age-assurance-on-claude). Anthropic says it receives only a pass/fail and never sees the ID, and that Yoti deletes the images after checking, the correct design on paper. The skeptical context is the precedent: a Discord age-verification vendor breach leaked ID images for nearly 70,000 Australians, and a Brussels age-checking app fell in two minutes. A pass/fail gate that never stores documents is meaningfully better than one that holds them, but it relocates trust to a verification vendor whose industry track record has not inspired confidence.