Because your AI is trying to be helpful and as we all know the way to hell is paved with good intentions. The canonical example is probably the agent that runs out of diskspace and starts deleting stuff outside its workspace which is obviously not important for the task at hand.

You probably don't expect an employee to engage in wrongdoing but you don't give everyone access to the company bank account.

Maybe you run a uni lab that provides VMs to students, and don't want them accessing the professor's data or confidential research on the same host.

This article is pointing out that QEMU/KVM boxes are trivial for an agent to escape. Obviously if it's your agent, you're probably running it because you want it to hack you (like the article author did), to show you where the leaks are. That or you are the attacker

Then you should not run any LLM in agent mode.