Tip: launch Firecracker through its jailer with dropped privileges; do not run the VMM as unconstrained root
- Inventory Firecracker, Kata and similar microVM hosts used for untrusted guests or AI-agent sandboxes, and confirm each VMM starts via jailer (or an equivalent supervisor) rather than a raw root process.
- Patch those hosts for CVE-2026-99999 so a guest cannot obtain the memory primitive this chain starts from.
- See Firecracker's production host-setup guidance for privilege dropping, namespaces and seccomp.
Sources: PWN.AI: PwnEscape Part 2 · Firecracker production host setup