On 11 November Perplexity’s security unit, the Perplexity Secure Intelligence Institute, published a report on experiments in which it tried to get AI models to break out of the company’s sandbox. The SPACE platform runs Perplexity Computer agents in Firecracker virtual machines. In the experiments, the agent had root privileges inside the virtual machine.

In the escape task, the agent had to retrieve an AWS credential stored on the host. In the network task, it had to reach a blocked address. In some experiments the agent could see SPACE’s source code, and in others it could reach permitted destinations such as the PyPI package repository. Twelve models took part, three of which were not included in the first part of the report.

No model got out of the virtual machine

A standard CTF-style prompt, an instruction to retrieve a hidden secret, led the agents to look for credentials inside the virtual machine. Nine of the 12 models spent at most 4 per cent of their effort probing the virtualisation layer; three GPT models spent 18–22 per cent on average. Perplexity said these runs revealed little about how robust the isolation was.

When the prompt directed the agents to the virtualisation layer, the share of effort spent on that layer rose by about 60 percentage points on average. Still, no run reached the host. Perplexity regards this as stronger evidence of isolation but stresses that the findings apply only to the tasks and set-ups tested.

Agents bypassed network blocks before the fix

When the agents could reach permitted destinations, they found two workarounds. In DNS spoofing, the agent fed the gateway a forged DNS response stating that the IP address of the permitted domain pypi.org was the address of the blocked server. The method required the source code, which revealed the gateway’s external address.

The second method exploited content delivery networks, where many domains share the same IP address. The gateway did not check that the server name declared when opening the encrypted connection (SNI) matched the permitted domain. Agents relayed their requests through Fastly services or used screenshot services, reading the secret from the images with optical character recognition.

With the source code, Claude Opus 5.0, Opus 5.5, Mythos 5.1, GPT-5.6 Sol and GPT-6 Astra succeeded in all three runs. Kimi K3 succeeded twice; the six other models never did. Without the source code and with the original prompt, only GPT-5.6 Sol (in two of three runs) and GPT-5.6 Cyber (in one) succeeded. The Opus and Mythos models identified the relay route but judged that using it was not part of the task.

Perplexity has fixed both gaps, and testing after the fix found no workarounds. In the first part of the report, similar gaps turned up in eight of ten sandbox platforms from other companies, and the gaps were reported.

Security model lost to general-purpose model

GPT-5.6 Cyber is a model further trained from GPT-5.6 Sol for security tasks. With the source code, Sol succeeded in every run, taking 20.8 minutes on average, while Cyber failed in every run after attempts averaging 51.6 minutes. According to Perplexity’s analysis, Sol first mapped the network structure, whereas Cyber looked for parsing bugs. The general-purpose GPT-6 Astra succeeded in 4.8 minutes on average; the security-oriented Mythos 5.1 took 36.6 minutes.

The report’s authors said the experiments were too limited to show that specialisation weakens broader capabilities. They consider it possible that the training data and tasks used to teach models security skills are not diverse enough.

Grok 4.20 falsely claimed success 27 times in six escape runs.

SPACE has been released as open source under the Apache 2.0 licence, Hermes AI News reported.