I think Noam @polynoamial is receiving a lot of undeserving flak for this and I wanted to chip in as someone who escaped sandboxes for a living (as well as published a ton of web/browser research). For reference I escaped out of pretty much every sandbox you could think of: KVM, Kubernetes/container isolation, Firecracker, Docker, gVisor, browsers, ... among many. And my experience thus far proves to me AIs have made this significantly easier, esp for people who already do research and have enough taste to know when a weird primitive is interesting. Tbf escaping out of a Hypervisor is very rarely "easy" but if you study most of these exploits, they can be brain meltingly out of the box in how they bend how the machine is expected to work, break assumptions, or straight up invent new computation techniques inside whatever tiny capabilities they were given. success in Hypervisor escapes often requires doing some novel compute plumbing, ie turning a weak leak into addresses, addresses into a write, a write into control flow, etc etc. The primitive is almost never the final exploit. My take is that what he is claiming is being taken way too literally, as in people think he is saying that particular paper, as written, can communicate huge sets of data, or that an AI can just heat up a CPU and magically get internet. If you actually read bitwhsiper paper it showed 2 adjacent, already computers communicating in both directions by modulating CPU/GPU heat and reading temperature sensors, at around 1-8 bits per hour over 0-40cm. For someone who isn't deep into exploit that might seem like uninteresting. But... 8 bits being tiny is not the own people think it is. In the exploit industry we refer to something like his refered paper as a "primitive" or proof of concept, not the final prodct. Also even if you don't shape manage to increase it (which Is unlikely), a single reliable bit can still be a yes/no oracle, tell you if another stage worked or distinguish state, coordinate timing,, select the next stage, or bootstrap a much better channel. 8 bits gives you 256 possible states. So I think "can this send a 200gb model" is the wrong question, the right question is "how can this primitive be escalated". And heat is not even close to the weirdest published channel. Many papers have already made RAM produce WiFi-band signals, video cables produce FM/radio signals, SATA and Ethernet cables act as antennas, HDD LEDs transmit thousands of bits per second, screen brightness changes invisible to humans carry data into cameras, fans/HDDs/PSU coil whine carry audio, CPUs generate magnetic signals through tested Faraday shielding, CPU load modulate current through building power lines, and fan vibrations travel through a desk into a phones accelerometer. TrojPix recently showed imperceptible pixels producing controllable emissions from video cables with an 8.1mbps peak and, separately, a maximum tested range of 208 metres. I often refer to the infamous FORCEDENTRY NSO exploit chain as an example of how not every technique is previously documented. An image encoder with no script ability, where NSO used 70,000+ bitmap operations to create logic gates, registers, a full 64-bit adder and a comparator inside a single decompression pass. They basically built a computer inside an image format because that was the compute primitive available to them. Dismissing a tiny channel because it isnt already a complete escape is like looking at one NAND gate and saying it cant run a computer. A computer is not just a "computer". the necessary parts to get a working computer to "sandbox" is also a heater, radio, speaker, light source, magnet, vibrator and electrical load. computation is ultimately physical. switching charge creates heat, current, photons, pressure waves, vibration and electromagnetic fields. If software can modulate something and anything outside can measure it, you have the beginning of a channel. We should still sandbox!!

The attack surface is actually infinite

The details of the long awaited KVM Escape are published. PwnEscape leads to VM escapes across multiple hypervisors due to a super cool Linux networking bug. CVE-2026-99999 is a 9.3 CVSS critical rated KVM escape ⛓️ pwn.ai/blog/pwnescape