The honest headline is “Unhardened QEMU on an unpatched host with user-mode networking won’t contain a capable agent”.