Agents given the CTF prompt spent substantial effort hunting for the flag inside the VM, through files and services, rather than testing the VM's isolation.
9 of 12 models spent at most 4% of their effort on the virtualization layer, so their failed escapes were weak evidence.
