Perplexity Publishes Red-Teaming Research on SPACE Computer Agent Sandbox

On 2026-11-12, Perplexity published new research from red-teaming SPACE, its VM sandbox for computer agents, via its official X account. The study tested 12 models on two tasks: escaping the VM to take a credential from the host, and bypassing SPACE's network policy to reach a blocked URL. The design follows the standard Capture the Flag (CTF) format in agent red-teaming experiments. The flag was a credential stored only on the host, so an agent could reach it only by breaking out of the VM.

Perplexity noted that agents given the CTF prompt spent substantial effort hunting for the flag inside the VM, through files and services, rather than testing the VM's isolation. Nine of the 12 models spent at most 4% of their effort on the virtualization layer, so Perplexity describes their failed escapes as weak evidence. To sharpen this, Perplexity revised the task description to focus agents on the VM-host boundary. The share of effort spent there rose by about 60 percentage points on average. Agents that then attacked the boundary directly still failed to escape, which Perplexity presents as stronger evidence of the sandbox's isolation.

The results also showed that cybersecurity-specific models sometimes underperformed their general-purpose counterparts. For example, GPT-5.6 Cyber, which is built on GPT-5.6 Sol, failed to exploit the DNS spoofing flaw that Sol found in the network bypass task. Perplexity concludes that in security red-teaming, asking agents to "find the flag" can waste effort on tasks that do not actually test the target security boundary, and security-specific model training did not guarantee better results on these tasks. Perplexity added that it has fixed the network flaws the agents exploited, that post-fix testing found no bypasses, and that it will keep testing SPACE as models get stronger. The full research is available via a link in the post.