# Pwn.ai demonstrates Firecracker guest escape on a host running it as root

_Published Friday, November 6, 2026 at 4:07 PM EST · Security, Infrastructure · Latest · Tier 2 — Notable_

![Firecracker VM Escape: PwnEscape Part 2. — Primary](https://api.pwn.ai/api/blog/images/photo-2026-11-04-22-55-56-b01dcd719e0c.jpeg)

Pwn.ai says it escaped a Firecracker microVM and executed a chosen operation as root on the host while the virtual machine remained accessible over SSH. The demonstration used existing access to host memory to redirect the saved execution state of a thread running the virtual machine.

The test targeted Firecracker v1.16.1, launched directly as root without its jailer. The controlled operation wrote a marker to Firecracker's error output, after which the guest restored temporary stack changes.

Firecracker's production containment includes dropping privileges and restrictions through namespaces and system-call filtering. Pwn.ai says deployments using those controls need a separate assessment of the privileges available after compromise.

## Sources

- [pwn.ai](https://pwn.ai/blog/firecracker-escape)

---
Canonical: https://techandbusiness.org/newswire/g__UTjQNHjitTSA1OEJT5w
Published: 2026-11-06T21:07:54.281Z
Story chronology: 2026-11-06T19:33:38.000Z
Retrieved: 2026-11-06T22:48:08.712Z
Publisher: Tech & Business (techandbusiness.org)