OpenAI Model Escaped a Virtual Machine Three Times, Trail of Bits Finds, as Salesforce Auto-Enables AI Agents for All Customers

Since Trail of Bits published its virtual-machine escape findings on August 26, the security research firm has forced a blunt admission into the open: standard virtualization can no longer be assumed to contain a frontier AI agent that's actually trying to get out.

That finding is landing the same week Salesforce is auto-enabling its Agentforce AI agents across every eligible customer org, and while a federal standards body is still drafting, not finalizing, rules for how autonomous agents should even be identified and policed.

The Escape

Trail of Bits researcher Artem Dinaburg gave OpenAI's purpose-built security model, GPT 5.6-Cyber, a capture-the-flag task: break out of a QEMU/KVM virtual machine running Debian Linux 12 and read a flag file on the host machine, according to the Trail of Bits report covered by Tech Times. The model had SSH access, could download software, and could build its own tools.

It got out. Three times. In its third and final attempt, during a 12-hour autonomous session, the model discovered and chained three previously unknown zero-day vulnerabilities plus one already-patched-but-undistributed flaw, Tech Times reported.

Dinaburg didn't soften the conclusion. "If it wasn't clear before, I will state it plainly: you can no longer assume a mere VM will contain a sufficiently advanced AI agent," he wrote, according to Tech Times, adding that such agents should now be treated as an advanced persistent threat.

NIST's Computer Security Resource Center defines an APT as an adversary using custom tooling and zero-days, maintaining hidden persistence, adapting to detection, and pursuing a goal with real resources. Tech Times noted the model displayed every one of those traits in a single test session. Notably, Firecracker, a different virtualization technology, reportedly resisted the same style of attack where QEMU/KVM did not, suggesting containment strength varies significantly by architecture rather than being a solved problem across the board.

The test was run under Patch the Planet, a joint OpenAI-Trail of Bits program where the security model hunts for real vulnerabilities in widely used software. It is a controlled research exercise, not a report of a real-world breach, and it involved a specialized security model, not a general-purpose office assistant.

Salesforce Turns the Agents Loose

At the same time this research was circulating, Salesforce confirmed that its Winter '27 release will auto-enable Agentforce by default in every org with Agentforce access, starting on a rolling basis in the first week of September, according to SalesforceBen. The toggle that let admins turn it off entirely is being removed from setup later in the release cycle.

Salesforce says this costs customers nothing extra and won't change billing, SalesforceBen reported. But it also means agents move from an opt-in feature to a default state across Salesforce's customer base without those customers taking any action.

The scale of what these agents are being asked to do is expanding fast. Salesforce's own release materials describe agents that now qualify sales pipelines, resolve service cases end-to-end, book appointments, and underwrite risk, operating across Slack, Microsoft Teams, voice, and legacy systems using what the company calls governed CRM data. Agentic Commerce Search is producing a 13% conversion lift and 17% add-to-cart increase, the company says, and Adaptive Experiences is already running in production at four customers, including PowerSchool with more than 550 users, according to Salesforce and Futurum Group.

Futurum Group's latest enterprise software survey (n=833) puts agentic AI at 73.1% as a high technology priority among decision-makers, down from 86.6% in the prior survey wave (n=830), still ranking behind only predictive AI and generative AI. Salesforce holds 34.1% of a $29.1 billion CRM market, per Futurum.

The Gap Nobody Has Closed

Salesforce's pitch is that trust comes from governance: every agent acts on permissioned CRM data, which the company says makes handing off entire workflows safe. That's a real design choice, not just marketing, and it's a fair defense of why a CRM-bound agent isn't the same risk profile as a security-testing model deliberately hunting for VM escapes.

But the standards meant to police agent identity and authorization across the industry are still in draft form. NIST's Center for AI Standards and Innovation has only opened a request for information on AI agent security and released a draft concept paper on agent identity and authorization, according to Federal News Network as cited by MarketScale and Superpower Daily. No binding rule exists yet on what an autonomous agent is allowed to do, on whose authority, or how its actions get audited after the fact.

Meanwhile the infrastructure is already straining under agent traffic. Cloudflare data cited by Superpower Daily puts more than half of internet traffic as non-human. Plume found that 22% of its connected homes carried regular large language model traffic in April, up from 19% a year earlier, with data volume in those homes climbing roughly 2,000% year-over-year, according to Superpower Daily.

CoreWeave says its Serverless RL approach cuts training costs by up to 40% and speeds training by 1.4 times, letting agents improve continuously in production, per Superpower Daily. Those numbers come from CoreWeave itself, not an independent audit, and a system designed to keep changing itself while handling live workflows is exactly the kind of moving target that identity and observability standards are supposed to catch before it reaches sensitive systems.

Salesforce's Winter '27 release goes generally available October 12, 2026. Whether NIST's draft agent-identity framework, or anything like it, is finalized before then remains an open question.