What's this about?
A Qubes Security Bulletin describing arbitrary code execution reachable through the error-reporting backchannel of the copy-to-VM mechanism.
Why is a bug in an error path especially notable in Qubes?
Because Qubes' entire proposition is that compromising one VM does not compromise the rest, and inter-VM copy is one of the few sanctioned paths across that boundary. Its data path gets heavy scrutiny. Its *error* path carries messages back — and error reporting is the classic place where a boundary is quietly weaker, because it is the code nobody exercises deliberately and everyone assumes only carries diagnostics.
Why does this matter to you?
- "The error channel is a channel" is a transferable auditing heuristic, and it applies to agent harnesses that pipe tool errors back into context.
- Qubes disclosing this openly and in detail is the model for how the Omarchy-class issues above should be handled.
- For anyone using Qubes as agent isolation — which the "AI agent has root" thread recommends — this is a reason to patch now.