Escape to Host
Think of a container as a locked room inside a house. An 'escape to host' is when someone inside that room finds a way to break through the walls, allowing them to roam freely throughout the entire house and access every other room inside it.
An escape to host occurs when an adversary exploits vulnerabilities in the isolation boundary of a container or virtual machine to execute code on the underlying host operating system. In the context of AI, this often involves manipulating agent configurations or tool-use permissions to bypass sandbox restrictions, granting the attacker host-level privileges and lateral access to other co-located resources.
An escape to host is a privilege escalation attack where an adversary breaches the kernel-level or hypervisor-level isolation mechanisms separating a guest environment from the host. By exploiting misconfigurations, kernel vulnerabilities, or insecure AI agent tool-invocation patterns, the adversary transitions from the restricted guest context to the host execution environment. This breach invalidates the security boundary, enabling the adversary to compromise the host's integrity, persist across the infrastructure, and perform lateral movement to other isolated resources managed by the same host.