An agent debugged a kernel escape for weeks

The security startup pwn.ai says an agent it built escaped a guest virtual machine during kvmCTF, Google's security program for the KVM hypervisor, and captured the challenge flag. kvmCTF runs a bare-metal host with a single guest virtual machine and gives participants reserved one-hour slots to attempt a guest-to-host attack; Google unlocks a per-boot random token when host-side instrumentation records a qualifying memory-safety violation. It is a sanctioned contest and not a breach of Google's production systems.

According to the company's write-up, the agent worked inside nested KVM for weeks while building a 14,338-line kernel exploit harness. pwn.ai says the agent had already produced the challenge flag on 17 May 2026, against the company's own replica of the challenge host — Google's review later noted that a locally generated token could not replace the official flag — before it entered an official Google kvmCTF slot on 17 June, and that during that live session it was several attempts into the challenge before completing the attack. Reaching the flag is the achievement the company claims; whether the underlying flaw was previously unknown is a separate question.

The number of lines makes a striking headline, but pwn.ai's more consequential claim is about process. Exploit development is rarely a straight line from vulnerability to working attack: researchers form hypotheses, test them, inspect the failures, change the approach and repeat. Pwn.ai says its agent sustained that cycle over multiple weeks rather than receiving a finished exploit and executing it, and that the harness grew from a 3,304-line prototype through a 12,955-line revision to the 14,338-line version that landed the final attack.

Google says kvmCTF focuses on zero-day vulnerabilities and will not reward exploits that use n-days, which makes a flag capture more meaningful than demonstrating an existing proof of concept. The company says it searched Google's public kvmCTF repository, GitHub and the wider web on 2 September and found no earlier example of an AI agent building and operating an exploit that captured a kvmCTF flag, qualifying the claim as holding "as far as the public record shows".

The account is company-reported. Google has not independently confirmed the achievement in the material available, and the status of the underlying vulnerability, whether it was still a genuine zero-day at submission or already public by then, has not been independently established. The degree of human direction behind the agent's work is also unstated.

pwn.ai says Google declined the bounty. According to the company, Google's review judged that the public vulnerability report and patch appeared while the kvmCTF service was still operational, so the zero-day window had closed before the submission. Google attributed the flaw to a shadow-paging use-after-free later assigned CVE-2026-46113, an attribution pwn.ai says it accepts without claiming Google supplied a host stack trace.

If independently verified, an agent maintaining a long-running offensive-security research process, where each failed attempt informs the next, would be a more significant shift than a model generating exploit code on request. The claim still needs that independent scrutiny.