AI Agent Containment Threat-Model Lab

A virtual machine is a useful security boundary, but it is not a guarantee. This lab asks students to compare two AI-agent containment designs and explain how unnecessary features increase attack surface.

Goal

Build a simple threat model for an AI coding or security agent and recommend controls that reduce the consequences of a containment failure.

Activity

1. Read the source article’s conclusion and list the capabilities an AI agent might receive: shell access, network access, credentials, a graphical display, shared folders and execution time.
2. Draw two small containment designs:
   • a general-purpose virtual machine with a desktop, shared clipboard and broad network access;
   • a minimal disposable environment with no display, limited networking, short execution time and no reusable credentials.
3. For each design, identify at least four attack surfaces or assets at risk.
4. Apply four controls: least privilege, rapid patching, logging/monitoring and a pristine environment for each run.
5. Rank the remaining risks as low, medium or high and explain one limitation of the ranking.

Do not run exploit code or give an autonomous agent access to a real account, campus network, personal files or production credentials.

Deliverable

Submit:

• both containment diagrams;
• a table with capability, asset at risk, control and residual risk;
• a 150–200 word recommendation choosing one design for a classroom demonstration;
• one sentence explaining why “inside a VM” is not the same as “safe.”

Discussion and safety

• Which convenience feature creates the most unnecessary authority?
• Why can a long-supported distribution still lag an upstream security fix?
• When would a microVM, container or separate physical machine be more appropriate?
• What evidence would be needed before claiming that an agent cannot escape?

This is a defensive threat-modeling exercise. It does not require vulnerability exploitation.

Source material

This lab was first developed from the PTIR Daily Briefing for August 27, 2026. Trail of Bits reported experiments in which a cyber-capable agent found and combined flaws across a general-purpose virtualization stack. The article argues for minimal attack surface, rapid updates, least privilege, logging, time limits and pristine disposable environments. It generated this lab because beginning technology students need practice distinguishing a useful security boundary from a security guarantee.

Consult the original source: VMs won’t contain cyber-capable agents.