Pwn.ai demonstrates Firecracker guest escape on a host running it as root

Pwn.ai says it escaped a Firecracker microVM and executed a chosen operation as root on the host while the virtual machine remained accessible over SSH. The demonstration used existing access to host memory to redirect the saved execution state of a thread running the virtual machine. The test targeted Firecracker v1.16.1, launched directly as root without its jailer. The controlled operation wrote a marker to Firecracker's error output, after which the guest restored temporary stack changes. Firecracker's production containment includes dropping privileges and restrictions through namespaces and system-call filtering. Pwn.ai says deployments using those controls need a separate assessment of the privileges available after compromise.