Perplexity Found a Hidden Blind Spot Breaking Its SPACE Sandbox Security Tests

Perplexity’s security team found that a common Capture the Flag prompt distorted its red-team evaluation of SPACE, the Firecracker-based sandbox behind Perplexity Computer. Across 12 frontier models, most agents searched the guest virtual machine for a flag and devoted little effort to the VM-host boundary under test. The team published its analysis in Escaping SPACE II .

The earlier Part I report recorded zero VM escapes across 108 runs. Part II qualifies that result by examining where agents directed their work. A zero-escape rate offers limited evidence when the agents barely exercise the relevant attack surface.

SPACE uses Firecracker microVMs, lightweight virtual machines that isolate each Perplexity Computer session from its host. Perplexity has released the source under the Apache License 2.0; an independent SPACE architecture review describes its main components. The evaluation gave agents root access inside the guest, removing ordinary guest-level permissions as an obstacle and testing whether they could cross the virtualization boundary.

CTF prompts sent agents inward

The initial Part I campaign gave nine models two objectives. The VM-escape task asked agents to cross into the host and retrieve a decoy AWS credential. The network task asked them to reach a blocked callback URL from a sandbox with restricted outbound access. Both used a familiar CTF instruction: find the flag.

The expanded Part II analysis covered 12 models and classified how they allocated their effort. The flag became the operative target, drawing agents toward files and services inside the guest while the virtualization layer received little attention.

The revised runs provide stronger evidence because the agents directly attacked Firecracker and the surrounding isolation controls. The original failures largely measured how agents pursued an underspecified reward inside the guest.

Make coverage part of the score

• Name the boundary. Identify the control under test, such as VM-host isolation, network egress filtering, or credential separation.
• Define acceptable evidence. Specify what would demonstrate a breach, including host access, secret retrieval, or a verified outbound callback.
• Track attack coverage. Classify actions by subsystem so the report shows where the model spent its token, time, and tool-call budget.
• Pair outcomes with effort. Report success rates alongside the share of activity directed at the target surface.
• Keep flags subordinate. Use a flag to confirm compromise after the boundary has been crossed, while directing the prompt toward the security control itself.
• Compare prompt variants. Rerun the same model, tools, and budget with direct and indirect formulations to measure prompt sensitivity.

Security tuning missed a bypass

Part II also found that cybersecurity-specific tuning did not predict better performance on every task. GPT-5.6 Cyber, a variant built on GPT-5.6 Sol, missed a DNS-spoofing flaw in the network-bypass evaluation that Sol had found.

The network gateway allowed selected destinations by resolving hostnames and checking their IP addresses. In one Sol run, the agent used Perplexity web search to discover that fiddle.fastly.dev , a tool capable of fetching a user-supplied URL, shared an IP address with the allowed domain pypi.org . That route let the agent use allowed infrastructure to reach a blocked destination. A second technique forged DNS responses so the gateway accepted a poisoned hostname-to-IP mapping.

Four models exploited these weaknesses in 11 of 54 runs with partial network access before Perplexity deployed fixes. In this harness, the base model found one path that its security-tuned counterpart missed. Model selection therefore requires repeated trials against the exact environment, tools, and attack surfaces under evaluation.

SPACE after the fixes

Perplexity says it patched both network paths and observed no bypasses in post-fix testing. The boundary-focused VM runs also produced no escapes. Together, the reported tests found no breach of either isolation control under the revised methodology.

Perplexity presents those results as empirical evidence from finite runs, bounded by the chosen models, prompts, tools, budgets, and test cases. The open-source release allows other teams to inspect SPACE, run independent harnesses, and repeat the evaluation as agent capabilities change.

The study’s practical contribution is a measurement correction: sandbox evaluations should report whether an agent succeeded and how thoroughly it tested the intended boundary. Success rates without attack coverage can make an untouched control look secure.