pwn.ai claims its AI agent captured official flag in Google kvmCTF
pwn.ai reports an AI agent capturing a Google kvmCTF flag
pwn.ai claims its AI agent built and ran a KVM exploit in an authorized Google kvmCTF environment and obtained the official flag on June 17, with the related vulnerability numbered CVE-2026-46113. The case involves the isolation boundary between the virtual machine and the host. The authors state that no bounty was received due to the public patch time window; claims of being the first and of autonomy level are author assertions, with humans providing the task, authorization, and infrastructure, and no independent reproduction is provided in available materials.
The material fully records the process by which an AI agent autonomously built a KVM escape chain and obtained the official flag, showing the role of toolchains and verification steps in long-cycle vulnerability exploitation.