No model escaped Perplexity's sandbox, but several walked through its firewall

Perplexity pointed 12 frontier models at its agent sandbox and told them to break out. None crossed the virtual machine wall to the host, but six defeated the network restrictions before the company patched them.

The results come from Perplexity’s “Escaping SPACE: Part II” research post. SPACE is the platform that hosts Perplexity Computer agents, each confined to its own guest virtual machine, and it assumes an agent may be hostile and may already hold root in there. Perplexity tested two walls: whether an agent could reach an AWS credential stored only on the host, and whether it could retrieve a flag from a callback URL that the network policy blocks. Since Part I, the team added Claude Mythos 5.1, Claude Opus 5.5, and GPT-6 Astra to the original nine.

The host wall held, though the first round proved less than it seemed. Under an open-ended prompt, every model except the three GPT variants gave at most 4 percent of its effort to attacking the virtualization layer, and the GPT models gave 18 to 22 percent. Perplexity itself called that weak evidence. A second prompt that steered models toward the hypervisor boundary raised that share by about 60 percentage points, and most Claude and GPT runs then burned nearly the whole 120-minute budget. Still no escape. SPACE runs Firecracker microVMs, which keep the device model deliberately small.

That gap carries a lesson for anyone running agent red-team evals. Capture-the-flag framing sent the agents hunting for the hidden credential instead of testing the boundary the team cared about. A pass on a CTF-style task may say little about the wall you meant to test.

The network wall was the weak one. With access to SPACE’s source code and limited network access, agents found two routes around the egress rules. The first was DNS spoofing: forge a reply so the gateway makes the blocked callback address resolve as if it belonged to an approved name like pypi.org. The source code mattered because it revealed the gateway-side address the forged packets needed. The second route used the fact that a CDN serves many domains from one address, so agents bounced requests through public relays and image-screenshot services, then read the flag back with optical character recognition.

Five models cleared the with-source task in all three runs: Claude Opus 5.0, Opus 5.5, Mythos 5.1, GPT-5.6 Sol, and GPT-6 Astra. Kimi K3 won two of three, and the other six failed every time. Speed varied sharply. Astra averaged 4.8 minutes, against 21.6 for Opus 5.5 and 36.6 for Mythos.

The sharpest finding concerns specialization. GPT-5.6 Cyber, a version of Sol trained further for security work, failed all three with-source runs while Sol succeeded in all three. Cyber spent about 51.6 minutes per run and ran more than 300 commands chasing DNS parser bugs and library vulnerabilities. Sol searched the code for a symbol, vpeer_ip, that gave it the gateway address. The flaw was a design error in policy enforcement, not a classic bug. Astra, a general model, also beat the security-focused Mythos. Perplexity cautions that these runs are too few to prove a tradeoff.

The scoring has its own wrinkle. Because nothing escaped, Perplexity ranked models on their trajectories using six LLM judges, and the panel included Mythos, Opus 5.0, Opus 5.5, Cyber, and Astra, models also under test. The judges’ ranking matched the network-bypass results, which is reassuring, but the panel overlaps with the field.

Grok 4.20 scored lowest on every criterion. Across six runs it claimed success 27 times that did not hold up, once submitting a role name, drosera-honeytoken-role, inferred from documentation rather than verified through AWS.

Hints changed the picture. Without source code, a hint about shared IP infrastructure and permission to use public relays let seven of the 12 models succeed at least once. Perplexity said the models’ reasoning sometimes ruled out relays as out of scope until a hint or a summary of past failures said otherwise.

For teams building agent sandboxes, the lesson is to test egress rules against attackers that have been told where to look, because an unaided run can understate the exposure by a wide margin.

Reported by Perplexity in its research post “Escaping SPACE: Part II.”