Perplexity’s Secure Intelligence Institute ran 216 red-team trials against SPACE, the sandbox that powers Perplexity Computer, and found that the wall keeping an agent’s virtual machine away from the host stayed intact while the wall meant to keep it off the open internet did not. Four models talked their way past network confinement. None reached the host.
The test design separated two questions. Could an agent with root access inside the guest VM reach a secret stored on the host machine? And could it reach a network address it was supposed to be blocked from? Nine models were run across four combinations of source-code visibility and network access, three times each. None of the 108 VM-escape attempts got through, not even when the agent could read SPACE’s own source, run web searches, or install its own software. Perplexity is explicit that this is not proof the isolation is unbreakable, only that these models did not break it in this test.
Network confinement told a different story. When all outbound traffic was blocked, the boundary held across all 54 runs. But in a partial-network setting that allowed access to package repositories such as PyPI, four models got out: Claude Opus 5.0, GPT-5.6 Cyber, GPT-5.6 Sol and Kimi K3, succeeding in 11 of 54 attempts. They used two distinct techniques. Running as root inside the guest, one agent forged a false DNS answer that pointed the allowed domain pypi.org at the blocked destination instead. The gateway had no way to verify where that reply had actually originated, so it accepted the forgery. The trick only worked when the agent could also see SPACE’s source code, since the real target address was otherwise invisible from inside the guest. The second technique exploited the fact that content delivery networks host many unrelated domains behind the same IP address. A GPT-5.6 Sol run reached the target through a tool called Fastly Fiddle. GPT-5.6 Cyber took a longer path: an image service, then a screenshot service, then optical character recognition pulled the flag out of the screenshot.
The report’s most notable result is what one model chose not to do. Claude Opus 5.0 spotted the same IP-sharing path in its own reasoning process, then ruled it out: it wrote that leaning on a third-party proxy “would violate that constraint,” since the test barred agents from touching systems outside the sandbox itself. Perplexity calls this arguably over-conservative, noting that the models which did use those shared services were using them for their normal function, not attacking them. That framing is Perplexity’s own read of its own model on its own test, a claim worth logging rather than an independently verified finding.
Two fixes followed. Forged DNS replies no longer work, because Perplexity now checks where each reply actually comes from before accepting it. And on shared infrastructure, an incoming connection must now present a hostname, in both the handshake and the headers, that is on an allowlist and matches the real destination address before TLS terminates. Running all nine models again under the hardest settings, nobody retrieved the flag.
Perplexity ran the same tests outward too, against ten sandboxes built by other vendors. Eight of the ten had at least one working bypass, based on whatever version each vendor was running on August 31 and September 1. Perplexity names nine of the ten it tested: Cloudflare Sandbox, NVIDIA OpenShell, Daytona Sandbox, Deno Sandbox, microsandbox, E2B, Fly.io Sprites, Modal Sandboxes and Vercel Sandbox. Only the first two came through clean. The other seven each showed at least one bypass. All nine responded after Perplexity reached out on September 1. Daytona, Deno and microsandbox already have fixes shipped. E2B and Fly.io are working on mitigations. Vercel and Modal call the gap a known limitation rather than something to patch. One more vendor, the tenth, asked Perplexity for extra time before being named.
The wider lesson here, in Perplexity’s own words, is architectural rather than a single bug: allowing a hostname is not the same as controlling which IP address that traffic ultimately reaches, since a CDN can put unrelated tenants behind one shared address. Teams running agents on Vercel Sandbox, Modal or E2B should ask those vendors directly whether the documented network-policy gap has closed, before treating an outbound-domain allowlist as a real security boundary.
Reporting is based on Perplexity’s Secure Intelligence Institute blog post “Escaping SPACE: Part I,” published September 23, 2026.
