Perplexity Tried to Break Agents Out of Its SPACE Sandbox: Zero Escapes, but a Lesson on CTF-Style Testing
Perplexity published part two of its red-teaming tests against SPACE, the sandbox powering its Computer agents. While no model breached the boundary between the virtual machine and the host, the study reveals that the “capture the flag” format distracts agents from the actual target, and that a cybersecurity-specialized model does not necessarily perform better.
What happens when you ask an AI to break out of its cage? Perplexity put the question to its own agents. On November 11, the company published part two of its red-teaming tests against SPACE, the sandbox environment running agents for its Computer product, drawing a conclusion that reaches far beyond its own setup: how you frame the test fundamentally alters what you measure.
Two Different Walls
SPACE runs each agent inside a lightweight Firecracker virtual machine, isolated from the physical host machine; a host-side gateway filters whatever the agent can reach over the network. Perplexity has open-sourced the code. In part one, nine models granted full root privileges inside the virtual machine were tasked with either reading a file stored on the host or retrieving a secret located behind a blocked address.
The results were mixed. Zero escapes to the host occurred across 108 attempts, even with full source code access and web connectivity. However, when agents were granted access to a handful of whitelisted destinations (package mirrors, search), four models figured out how to reach the forbidden address—via DNS spoofing or by routing through IP addresses shared between allowed and blocked domains: Claude Opus 5.0, GPT-5.6 Cyber, GPT-5.6 Sol, and Kimi K3, the only open-weights model to succeed. Perplexity says it has patched these vulnerabilities and found similar flaws in eight out of ten third-party sandboxes it reviewed, reporting them to their vendors.
The Flag Trap
Part two, conducted across twelve models according to Perplexity, scrutinizes the testing protocol itself. Penetration tests frequently adopt a “capture the flag” (CTF) format: hide a secret string, and success is easy to verify. Yet agents briefed this way spent most of their time hunting for loose credentials in the environment rather than attacking the virtual machine’s isolation layer. When the instructions explicitly targeted the virtualization boundary, the share of effort directed at that boundary jumped by roughly 60 percentage points on average. Claude Opus 5.5, which previously stopped after an average of 21.5 minutes, and GPT-6 Astra (28.6 minutes) joined all other Claude and GPT models in utilizing nearly the full 120-minute limit. No verified escape was achieved under either set of instructions.
Another takeaway: domain specialization provides no guarantees. On the network task, GPT-5.6 Sol mapped the topology, located the gateway, and successfully executed DNS spoofing; GPT-5.6 Cyber, trained specifically for security, scrutinized parser code and missed the target. Perplexity emphasizes that this comparison hints at an effect of specialized training without proving it.
Our take
This is one of the rare data-backed reports from a developer red-teaming its own sandbox with cutting-edge models and candidly disclosing what gave way. Two takeaways stand out for anyone deploying agents: virtual machine isolation and network filtering are two separate barriers, and the latter—far more frequently overlooked—is the one that cracked. Furthermore, agentic penetration testing measures the prompt just as much as the model: “zero escapes” under an unfocused brief offers far less reassurance than it seems. These findings remain strictly limited to the tested models, durations, and methods, and do not prove that an escape is impossible.
Sources
- Perplexity — Escaping SPACE: Part II (November 2026) Primary source
- Perplexity — Escaping SPACE: Part I Primary source
- Perplexity — Open-sourcing SPACE, the sandbox platform behind Computer Primary source
- Perplexity on X — announcement of part two (November 11, 2026) Primary source
A primary source comes directly from the company, lab or organization concerned. A secondary source reports the information without being its author: we flag it as such. Spotted an error? See our corrections policy.
