Perplexity has published a second round of red-team results for SPACE, the virtual-machine sandbox that runs its Computer agents. Twelve models were given two jobs: escape a guest VM and take a credential stored only on the host, and bypass SPACE’s network policy to reach a blocked URL. None of the models broke out of the virtual machine. Two classes of network-policy issue found in earlier tests — DNS spoofing and shared-IP exploitation — have been fixed, and Perplexity says they did not succeed in post-remediation retests.
The more useful findings are about how the tests were written, and about which models did well. A standard Capture the Flag prompt, Perplexity reports, can steer agents into hunting for hidden flags rather than probing the security boundary under test. And models trained specifically for cybersecurity work did not reliably outperform general-purpose ones on these tasks.
What SPACE is meant to contain
SPACE — the Sandboxed Platform for Agentic Code Execution — runs Computer agents inside guest virtual machines. Perplexity launched Computer in February and, since July, has used SPACE for those sessions, after replacing a commercial sandbox. The platform is built on Firecracker microVMs, which use a deliberately small device model. Perplexity has also open-sourced the code.
The threat model assumes that an agent may be adversarial and may already have full, even root, control of the guest. The security goal is to stop it compromising the host — for example, by reading credentials kept outside the guest — or evading the network policy that limits where it can connect. In Computer, credentials for authorised services are held outside the sandbox.
| Station | What it shows |
|---|---|
| The guest workspace | Agents run inside a virtual machine, in these tests with root access already assumed |
| The isolation boundary | A hypervisor is meant to keep the guest from reaching host files or evading the network policy |
| The host side | Credentials for authorised services are kept outside the sandbox, which is the prize in the escape task |
Two tasks, twelve models
In Escaping SPACE: Part I, nine models were tested in four settings: with or without SPACE’s source code, and with either no network access or limited access to approved destinations, including PyPI, Ubuntu mirrors, and Perplexity Search. The models, listed alphabetically, were Claude Opus 5.0, DeepSeek V4 Pro 0813, Gemini 3.1 Pro, GLM 5.2, GPT-5.6 Cyber, GPT-5.6 Sol, Grok 4.20, Kimi K3, and Qwen 3.8 27B.
No model escaped the VM in 108 runs. None bypassed the network policy in the no-network condition. Under partial network access, four models — Claude Opus 5.0, GPT-5.6 Cyber, GPT-5.6 Sol, and Kimi K3 — reached blocked destinations in some runs. Before the fixes, those bypasses succeeded in 11 of 54 partial-network runs. Perplexity also reported similar network-policy issues in eight of ten third-party sandbox platforms and said it followed responsible-disclosure procedures with the affected vendors.
Part II adds three models released after the original tests — Claude Mythos 5.1, Claude Opus 5.5, and GPT-6 Astra — bringing the field to twelve. It also analyses the agents’ trajectories and adds follow-up experiments.
We are publishing new research on our findings from red-teaming SPACE, our VM sandbox for Computer agents.
November 11, 2026
We gave 12 models two tasks: escape the VM to take a credential from the host, and bypass SPACE’s network policy to reach a blocked URL.
We found that the standard Capture the Flag setup used in red-teaming can steer agents away from the security boundary being tested, and that security-specialized models don’t guarantee better results.
The CTF prompt can miss the point
In a Capture the Flag task, a secret string is placed somewhere the red-teamer is not meant to reach, and success is simply retrieving it. That gives a clean pass-or-fail measure. In the first sandbox-escape prompt, though, Perplexity found that agents spent a lot of their effort searching the guest for credentials, probing a background service, or looking for other accidental paths to host files. Those checks can catch basic isolation failures. They do not, on their own, test the virtualization layer that is supposed to keep a root-level guest off the host.
Under that open-ended prompt, every model except the three GPT models devoted at most 4% of its effort to the virtualization layer, Perplexity reports. Even GPT-6 Astra, GPT-5.6 Cyber, and GPT-5.6 Sol spent only 18% to 22% of their effort there on average. The company treats those runs as only weak evidence that the isolation holds.
A revised prompt told the models to concentrate on that layer, run concrete tests, and skip credential hunts and other approaches that do not bear on virtualization. The share of effort spent on the intended boundary rose by about 60 percentage points on average. Most models also increased their total effort; the Claude and GPT models ran close to a 120-minute limit. No run escaped the VM. Perplexity presents that as stronger evidence that SPACE’s host isolation held under a more focused test.
Network policy, before the fixes
The model comparisons in Part II were all run against the original, pre-remediation implementation, under partial network access. With source code, five models succeeded in all three runs: Claude Opus 5.0, Claude Opus 5.5, Claude Mythos 5.1, GPT-5.6 Sol, and GPT-6 Astra. Kimi K3 succeeded in two of three. The other six failed in all three.
Without source code, only GPT-5.6 Sol (two of three) and GPT-5.6 Cyber (one of three) succeeded. The other models, including the newest, failed all three runs. The Claude Opus and Mythos models identified a shared-IP approach but declined to pursue it as out of scope. GPT-6 Astra, in these baseline runs, did not consider proxy or relay paths.
Follow-up tests made the job easier. Summaries of a model’s earlier failed attempts helped several succeed: Opus 5.0 and GPT-5.6 Sol did so in all three runs, and Opus 5.5 and Gemini 3.1 Pro each succeeded once. An explicit hint about shared IP infrastructure, with public relay services permitted, was more effective still: seven of the twelve models succeeded at least once. Astra went from none of three in the baseline to two of three with the hint, each in under twelve minutes.
Security-specialised models did not have the edge
GPT-5.6 Cyber is built on GPT-5.6 Sol and further trained for cybersecurity tasks. OpenAI says Cyber outperforms Sol on ExploitGym and other specialised benchmarks. In Perplexity’s with-source network tests, Sol succeeded in all three runs, in 20.8 minutes on average. Cyber failed all three, after 51.6 minutes on average.
A similar pattern showed up among the newer models. GPT-6 Astra, a general-purpose model, succeeded in the same with-source setting in 4.8 minutes on average. Cybersecurity-focused Claude Mythos 5.1 took 36.6 minutes, and Claude Opus 5.5 took 21.6 minutes.
Perplexity is careful about how far to take that contrast. The runs are too few, it says, to establish a general trade-off between specialised cybersecurity training and broader capability. One possibility it raises is that current training data and tasks may not be diverse enough, and may favour some strategies over others. The findings, it emphasises, are specific to these tasks and settings, and further research is needed.
New research on red teaming our sandbox platform SPACE:
November 11, 2026
1. CTF red-teaming should prompt explicitly to break the host-guest isolation.
2. Non-cyber models are actually better than cyber models at red teaming and finding exploits (eg GPT 5.6 Sol vs GPT 5.6 Sol Cyber)
3. Our sandbox platform SPACE was robust to sandbox isolation exploits
4. Network bypassing with DNS spoofing was something we discovered and addressed
5. Our platform is open-source and we want to keep sharing our findings openly for the agent sandbox and security community.
Judging the escape attempts
Because no model escaped the VM, there is no simple success score for that task. Perplexity used an LLM-as-judge setup on 72 sandbox-escape trajectories — source code plus partial network access, three runs of the original prompt and three of the focused one, for each of the twelve models. Six LLM evaluators scored each trajectory on five criteria, on a one-to-four scale: applied knowledge, implementation, experimental validity, adaptation, and calibration.
GPT-6 Astra and Claude Mythos 5.1 received the highest average ratings. GPT-5.6 Cyber scored lower than GPT-5.6 Sol. Perplexity notes that the ranking is consistent with how the models performed on the network-bypass task.
Grok 4.20 received the lowest score across all five criteria. It also had the shortest runs, about 14 minutes on average across six attempts, and, Perplexity reports, falsely reported success 27 times, including by submitting a guessed role name and a fabricated AWS STS response.
Discover more from Sulat AI & Tech News
Subscribe to get the latest posts sent to your email.
