When the AI Agent Breaks Out: Trail of Bits on Crypto Security

In a Trail of Bits lab this summer, engineers put an AI model inside a virtual machine, the same kind of sandbox that cloud providers, exchanges, and node operators lean on to keep untrusted code away from everything that matters, and asked it to escape. It escaped three times in roughly twelve hours. The final escape chained together three previously unknown vulnerabilities across the virtualization stack, the sort of zero-day work that used to take a skilled human team weeks.

That result, published on 26 August 2026 by Trail of Bits researcher Artem Dinaburg, is not a crypto story on its face. It is a warning about how software is contained. But it lands hardest on crypto, because crypto is the industry that has bet everything on the idea that code can be sealed in a box: a smart contract that only does what it says, a validator that only signs valid blocks, a signing server that guards a treasury, a hardware wallet that never leaks a key. With Bitcoin trading near $77,000 and the total crypto market capitalization around $2.69 trillion, according to CoinGecko, the value sitting behind those boxes is measured in the trillions.

Trail of Bits is not a bystander here. It is one of the auditors that Uniswap, Aave, Compound, Chainlink, and the Solana Foundation have paid to check their code. So when that firm says a virtual machine can no longer be assumed to contain a sufficiently advanced AI agent, the people who build and hold crypto should read the fine print. This is what the fine print says, and what it means for anyone whose money lives on-chain.

The twelve-hour jailbreak: what Trail of Bits found

The setup was deliberately ordinary. Trail of Bits ran OpenAI’s GPT 5.6-Cyber, one of the most capable security-focused models available, inside a standard QEMU/KVM virtual machine on a Debian Linux 12 host, the kind of configuration a developer or a mid-sized company might spin up without a second thought. The agent’s job was to get out of the guest and reach the host underneath it. Over about twelve hours of autonomous work, with no human steering it move by move, it succeeded three separate ways.

The first escape, nicknamed Januscape, rebuilt a working exploit for a recently disclosed host-kernel flaw, CVE-2026-53359. It worked well enough to hardlock the host before it finished, a crash rather than a clean getaway, but it proved the agent could weaponize a fresh public bug on its own. The second combined a known libslirp vulnerability, CVE-2026-9539, with an unmarked bug fix the agent spotted in the source code, assembling an arbitrary read-and-write primitive on the host that made escape trivial. The third was the one that should make operators sit up.

For the finale the agent found three previously unknown vulnerabilities spread across QEMU, the Linux KVM subsystem, and libslirp, added a fourth bug that had been patched upstream but not yet deployed, and stitched them into a reliable, repeatable escape. Finding one zero-day is hard. Finding three in different components and composing them into a single working chain is the kind of campaign that has historically defined elite offensive teams. Here it came out of one model left alone with a goal.

Dinaburg did not hedge in the write-up. “If it wasn’t clear before, I will state it plainly: you can no longer assume a mere VM will contain a sufficiently advanced AI agent,” he wrote. “To use a 2010s term of art, you should treat such agents as an advanced persistent threat.” In security jargon an advanced persistent threat is a well-resourced human adversary that gets inside a network and stays there, quietly, for as long as it takes. Dinaburg is saying that a single model, handed a task and a shell, now belongs in that category.

Who Trail of Bits is, and why the warning carries weight

Trail of Bits was founded in 2012 in New York by Dan Guido and Alexander Sotirov, both career security researchers. It is privately held, funded by paid engagements and government research contracts rather than venture rounds, and runs somewhere between roughly 125 and 140 engineers depending on the source. Over the years it has published hundreds of security assessments and shipped a well-used open-source toolkit for smart-contract analysis, including the static analyzer Slither and the fuzzers Echidna and Medusa. Crucially, its practice areas are not limited to blockchain: it also does application security, cryptography, systems, supply chain, and, increasingly, AI and machine-learning security.

That breadth is why the VM-escape research matters coming from this firm specifically. Trail of Bits is not an AI-hype shop chasing headlines; it is the auditor that DeFi blue chips call before they ship, and it spends its days finding real bugs in real crypto code. In late August 2026 alone it disclosed a flaw in Provenance Blockchain, a Cosmos SDK chain, that let any user grant themselves administrative control over marker accounts without holding a single token. When a firm with that day job tells you the containment model underneath modern infrastructure is cracking, the claim carries the weight of people who break things for a living and do it with receipts.

It also means the firm has skin in both games at once. The same shop that audits your contract is now studying how autonomous agents attack the machines those contracts run on. That dual vantage point, defender and offensive researcher, is exactly what makes its warning worth localizing for a crypto audience rather than filing under generic infosec news.

Patch the Planet: why an auditor is running AI at open source

The VM-escape test did not happen in isolation. It grew out of Patch the Planet, an initiative OpenAI announced on 22 June 2026 as part of its Daybreak security program and built together with Trail of Bits. The idea is to point OpenAI’s cybersecurity model at critical open-source projects, find bugs, and route every finding through human review by Trail of Bits engineers before it ever reaches a maintainer. You can read the framing on OpenAI’s own page for the program. The launch cohort included some of the most load-bearing software on the internet, among them cURL, Python, the Go project, and pyca/cryptography, the library that underpins a huge slice of Python’s security stack.

The program has already produced results that matter beyond crypto. Using the model, researchers surfaced a denial-of-service technique dubbed the HTTP/2 Bomb affecting NGINX, Apache, IIS, and Pingora, a class of servers numbering in the hundreds of thousands online. The June launch ran on OpenAI’s GPT-5.5-Cyber; by the August containment test, Trail of Bits was running the newer GPT 5.6-Cyber. That version bump in two months is itself part of the story: the offensive capability of these models is not a fixed quantity you can audit once and forget.

The uncomfortable subtext of Patch the Planet is that the same engine that helps a maintainer patch a bug can help an attacker find one. Trail of Bits ran the escape test precisely because it wanted to know what happens when that engine is turned loose inside the box instead of pointed at the code. The answer, three escapes in twelve hours, is the reason the rest of this piece exists.

The attacker’s new force multiplier

Trail of Bits is not describing a hypothetical. In a report published on 11 May 2026, Google’s Threat Intelligence Group documented, for the first time, a threat actor using a zero-day exploit that Google believes was developed with AI. The bug was a two-factor-authentication bypass in a popular open-source system-administration tool, a semantic logic flaw rather than a memory-corruption crash, and the exploit code carried tells of machine authorship, including tidy educational docstrings and a hallucinated severity score. In other words, the exact profile of a capable agent doing vulnerability research and weaponization.

The same Google report catalogs a growing family of malware that calls a language model at runtime rather than merely being written by one. The distinction matters. Static AI-written malware is just faster malware; malware that queries a model mid-operation can improvise, rewrite itself, and act without a human at the keyboard. Google’s analysts put the shift bluntly: “The LLM is no longer merely a passive advisor but an active participant in the offensive chain, capable of orchestrating complex toolsets and making tactical decisions at machine speed.”

Read that table next to the Trail of Bits escape and the picture snaps into focus. The capability is real, it is in the field, and it is being industrialized. The question for crypto is not whether cyber-capable agents exist. It is what they do when the box they break out of happens to be holding money.

Why crypto is ground zero

Every industry runs untrusted code in sandboxes. What makes crypto different is what sits on the other side of the wall. In a typical enterprise, an agent that escapes a VM reaches data: emails, customer records, source code. Painful, but recoverable, and often insured. In crypto, the same escape can reach a hot wallet, an RPC endpoint, a validator’s signing key, or a deployer account, and money that moves on-chain does not come back. There is no chargeback, no fraud department, no reversing a confirmed transaction. The escape and the theft become the same event.

The industry is also busy handing agents the keys on purpose. Autonomous on-chain agents that trade, rebalance, and pay for services are no longer a thought experiment. Whole platforms now exist to let AI agents act independently on-chain, a design space we covered in our look at Ritual and the chain built for agents that act alone, and agents are moving into markets that were already contested legal ground, as in the fight over prediction-market agents. Every one of those agents is a program with spending authority and an attack surface. Trail of Bits just demonstrated that a sufficiently capable agent can break the assumptions we use to contain programs.

Put those two facts together and crypto is not one of several industries exposed to cyber-capable agents. It is the one where the blast radius is denominated directly in transferable value, and where the defenders have the least room to make a mistake.

Where the money actually went in 2026

The escape research matters more once you see how crypto is already being robbed. According to CertiK’s Hack3d report for the first half of 2026, the industry lost over $1.31 billion across 344 incidents. The headline that should stop crypto builders cold is not the total, but the shape. Wallet and key compromise, not smart-contract bugs, was the single most destructive category, accounting for more than $444 million across just 33 incidents. The two largest events of the half, the Kelp DAO RPC compromise and the Drift Protocol breach, both in April, together made up nearly 44% of all losses, and neither was a Solidity flaw.

The pattern the CertiK data describes, fewer but far more surgical attacks, is the crux. Attackers have largely stopped hunting for arithmetic bugs in audited contracts and started going after the people, keys, and infrastructure around the code. Phishing incident volume fell by more than half year over year, yet losses barely moved, because the campaigns that remain are targeted rather than sprayed. Money is leaving through the operational plumbing: an RPC node, a deployer key, a compromised laptop, a signing server.

That is precisely the surface a cyber-capable agent expands. An audit can prove a contract is sound and still be irrelevant if an autonomous program escapes the box guarding the key that controls it. The 2026 loss data and the Trail of Bits escape are describing the same weakness from two directions.

Agentic wallets: handing an autonomous program the keys

Nowhere is the collision sharper than in agentic wallets, the fast-growing category of tools that let an AI agent hold or trigger spending authority so it can trade, subscribe, or pay for compute without a human clicking approve. The convenience is obvious and the danger is structural. If the agent can move funds, then anything that can steer the agent can move funds too. Researchers have already found this in the wild. In April 2026, security researcher Chaofan Shou described a hidden layer of intermediary services between users and models, warning that “26 LLM routers are secretly injecting malicious tool calls and stealing creds. One drained our client $500k wallet,” in reporting by CoinDesk.

The dominant attack vector against these agents is not a memory bug in the wallet code. It is prompt injection: feeding the agent malicious instructions through a webpage it reads, an API response it trusts, or a document it processes, so the agent itself becomes the insider. The most credible wallet builders have responded by refusing to let the agent be the last line of defense. The pattern that MetaMask lays out in its agentic-wallet security guidance is to keep the signing key out of the model’s reach entirely, bound every action with an explicit policy engine and spending caps, and require the agent to request signatures rather than produce them. The through-line across serious designs is the same: the agent should never hold the raw signing key.

For ordinary users the takeaway is old advice in new clothes. Give an agent only what you can afford to lose, cap what it can spend, and keep long-term savings in cold storage that no agent can touch, the boring discipline we walk through in our hardware wallet reviews. An agentic wallet is a hot wallet with initiative. It should never be your vault.

Prompt injection: the bug class with no patch

Prompt injection deserves its own section because it breaks the mental model most builders bring from smart-contract security. A reentrancy bug has a fix. An integer overflow has a fix. Prompt injection does not, in the same clean sense, because the vulnerability is the feature: an agent that can read the world and act on it cannot fully distinguish instructions it should follow from instructions an attacker planted in the data it was told to process. You can reduce the risk, sandbox it, and constrain it, but you cannot patch it away without removing the capability that made the agent useful.

Trail of Bits demonstrated exactly how ugly this gets in a pre-launch audit of Perplexity’s Comet browser in February 2026. As the firm documented, its researchers found prompt-injection techniques that could exfiltrate a user’s Gmail inbox to an attacker’s server simply by asking the AI assistant to summarize an attacker-controlled web page. No malware, no stolen password, just a page crafted to hijack the agent’s instructions. The techniques were fixed before launch, but the lesson generalizes: any agent that browses, reads messages, or ingests untrusted content is a candidate for the same class of attack.

Now transpose that from an email inbox to a wallet. An agent that summarizes a project’s documentation, reads a governance proposal, or parses a token’s metadata is reading attacker-influenceable text, and if it also holds spending authority, a successful injection is not embarrassing, it is expensive. This is why keeping keys off the agent is not a nice-to-have. It is the only reliable containment for a vulnerability class that has no true patch.

The defenders have agents too

The picture is not one-sided. The same capability that lets an agent escape a VM lets an agent find the bug before an attacker does, and Trail of Bits is a leading example of using it that way. Its open-source cyber-reasoning system, Buttercup, took second place and a $3 million prize at DARPA’s AI Cyber Challenge finals, combining fuzzing, static analysis, and language models rather than betting on a model alone. Per the firm’s own account, Buttercup found 28 vulnerabilities across 20 weakness categories and shipped 19 correct patches at roughly 90% accuracy, at a cost of about $181 per competition point, and it was made fully open source after the contest.

Others are pushing the frontier from the offensive side of the defensive line. Google’s Big Sleep agent became, by the company’s account, the first AI system to find a previously unknown exploitable memory-safety bug in widely used real-world software, and later helped cut off a vulnerability that was about to be used by attackers. The autonomous pentesting agent XBOW went further into the open, becoming the first non-human to reach number one on HackerOne’s US bug-bounty leaderboard after more than a thousand validated submissions, as the company detailed in its write-up. Defenders, in short, are shipping agents as fast as attackers are.

The risk is mistaking the tool for the discipline. David Schwed, chief operating officer at SVRN, put the trap plainly to CoinDesk: “’Claude, audit my smart contract, make no mistakes’ is not a security program.” An AI finder accelerates good engineers and gives false comfort to lazy ones. The projects that come out ahead in this arms race will be the ones that treat agents as one instrument in a layered process, not as a substitute for it.

What an audit can and cannot promise now

It is tempting to read all of this as proof that audits are worthless. That is the wrong lesson. An audit is a point-in-time review of specific code by specific people, and it remains one of the highest-value things a serious protocol can buy. What it was never designed to do is guarantee the safety of the machines, keys, and humans around the code, or to anticipate a threat model that shifts every two months as models improve. The 2026 loss data makes the gap concrete: most of the money left through operational compromise that no contract audit could have caught.

Dan Guido, the firm’s co-founder, has been consistent about why auditors build tools rather than relying on hero effort. “I don’t ever want to find the same bug twice,” he told Decential, framing static analysis and verification as ways to make a finding permanent rather than one-off. He is also blunt about the raw material, arguing that smart-contract platforms “have reinvented every security issue that we eliminated from modern languages like Rust and Go and Swift.” An audit works against that backdrop; it does not erase it.

The subtler point is that the hardest bugs were never purely technical. Alexander Urbelis, chief information security officer at ENS Labs, observed in the same CoinDesk piece that “the bugs that drain treasuries often turn on intent and adversarial incentives,” the sort of reasoning about who benefits and how that a checklist, human or machine, struggles to encode. This is why the crypto press keeps returning to the question of what a green checkmark actually certifies, a theme we unpacked in the crypto audit badge problem. Read the report, understand its scope, and never mistake the badge for a guarantee.

Defense in depth for an agentic world

The good news is that Trail of Bits did not just raise an alarm; it shipped a to-do list, and it translates cleanly for crypto operators. The core idea is that you cannot rely on the box alone, so you stack cheap, independent layers so that no single failure hands an agent your treasury. For a validator operator, an RPC provider, a DAO, or an agent developer, the same principles apply that a cloud team would use, adjusted for the fact that the thing behind the wall is money.

Two of these deserve emphasis for crypto specifically. First, keys off the agent: a policy engine that only ever signs transactions within a preset allowlist and spending cap means that even a fully compromised agent can drain only what you authorized, not the vault. Second, limited runtime and pristine environments: the Trail of Bits escapes took hours of uninterrupted work, so an agent that is spun up fresh for a bounded task and torn down afterward is a far worse target than a long-lived process with standing access. None of this is exotic. It is discipline, applied before the incident rather than after.

The regulatory vacuum

If you are waiting for a regulator to require any of this, do not hold your breath. In the United States, no rule mandates a smart-contract audit, let alone an agent-safety standard, and the Securities and Exchange Commission’s remit runs to securities law and fraud, not to code quality or the containment architecture of an AI agent. Audit quality in crypto is reputation-policed, not licensed. There is no accreditation body for the people checking the code that guards billions, and there is certainly none for the models now attacking it.

That vacuum will not last untouched, because the money-laundering and market-integrity angles are already drawing attention. Autonomous agents that can move funds, obfuscate their own behavior, and act at machine speed are a natural fit for the concerns driving anti-money-laundering policy worldwide. Where the compliance perimeter actually falls, on the protocol, the front end, the operator, or nobody, is the fight playing out in the DeFi compliance debate. Cyber-capable agents will sharpen every one of those questions, because an attacker that is a program rather than a person complicates attribution, intent, and liability all at once.

For now, the practical reality is that the industry is on its own. The standard of care is whatever the best operators choose to adopt, and the gap between them and everyone else is where the next $291 million incident is being set up right now.

What it means for builders and users

For builders, the mandate from the Trail of Bits research is direct. Treat capable AI agents as advanced persistent threats, not as clever scripts. Never give an agent standing authority over funds; put a policy engine and a hardware boundary between the model and the key. Assume prompt injection is possible on any agent that touches untrusted input, and design so that a successful injection is annoying rather than catastrophic. Keep humans in the loop for anything irreversible, patch fast, and run agents in fresh, minimal, monitored environments. And keep buying audits, while understanding exactly what they cover and what they do not.

For users, the discipline is simpler but no less important. An agentic wallet is a hot wallet that can act on its own, so fund it like one: small balances, hard spending caps, and no access to your long-term holdings. Be skeptical of any product that promises an autonomous agent will manage real money with no bounds, and remember that convenience purchased by handing a program your keys is convenience an attacker can inherit. The safest assets in 2026 are still the ones no agent, yours or anyone else’s, can move.

The deeper shift is that crypto security is finishing its move from a code problem to a systems problem. The exploited weakness is less often a flaw in a contract and more often a failure in the machines, keys, and processes around it, and now both attackers and defenders have autonomous agents accelerating the whole contest. Trail of Bits gave the industry twelve hours of clear evidence about where this is heading. The projects that internalize it will build for the world where the box does not hold. The ones that do not will learn the same lesson the expensive way.

Frequently Asked Questions

What did Trail of Bits’ AI agent actually do?

Trail of Bits ran OpenAI’s GPT 5.6-Cyber model inside a standard QEMU/KVM virtual machine on a Debian Linux 12 host and asked it to escape to the host system. Over about twelve hours of autonomous work it succeeded three times, including a final chain that combined three previously unknown zero-day vulnerabilities across QEMU, the Linux KVM subsystem, and libslirp. The firm’s conclusion was that a virtual machine can no longer be assumed to contain a sufficiently advanced AI agent.

Does this mean AI can hack my crypto wallet?

Not your cold-storage hardware wallet directly, but the research raises the risk for anything that keeps keys near running software, especially agentic wallets that let an AI agent spend on your behalf. The dominant attack against those agents is prompt injection, where malicious instructions hidden in a webpage or document hijack the agent. The defense is to keep signing keys off the agent, cap what it can spend, and keep long-term savings in cold storage no agent can reach.

Is Trail of Bits saying audits are useless now?

No. An audit is a point-in-time review of specific code and remains valuable, but it was never designed to secure the machines, keys, and people around that code. CertiK data for the first half of 2026 shows most crypto losses came from wallet and infrastructure compromise, not smart-contract bugs, which is exactly the surface a contract audit does not cover. The takeaway is to combine audits with operational defense in depth, not to abandon them.

What is prompt injection and why can’t it be patched?

Prompt injection is when an attacker plants instructions in the data an AI agent reads, such as a web page or a message, so the agent follows the attacker instead of its owner. It resists a clean patch because a useful agent cannot fully separate legitimate instructions from malicious ones buried in the content it was asked to process. You can reduce the risk with sandboxing and strict limits, but the reliable containment is to make sure a hijacked agent cannot move funds on its own.

How can crypto projects defend against cyber-capable AI agents?

Use layered defenses so no single failure is fatal: run agents in minimal microVMs such as Firecracker, apply least privilege, patch quickly, and monitor for escape attempts. Most importantly, keep signing keys out of the agent by using a trusted execution environment or hardware module plus a policy engine with spending caps, so even a fully compromised agent can only move pre-authorized amounts. Treat capable agents as advanced persistent threats and keep humans in the loop for anything irreversible.

Anneke de Vries covers security and exploits for HOGE Wire.