AITOPAI热报
PapersSelected

Perplexity reports no VM escapes in SPACE sandbox testing

官方账号Perplexity@perplexity_ai
Post
View the post
Why we picked it

Sandbox escape resistance is the metric that decides whether an AI agent can safely execute untrusted code, and Perplexity publishing its attack methodology lets other teams replicate the tests rather than take the result on faith. Builders running code-execution agents, and security engineers evaluating sandbox vendors, can use the writeup as a testing baseline. The results can also be compared with sandbox claims from OpenAI and Anthropic.

Perplexity ran a security evaluation of SPACE, its sandbox environment, described in the blog post 'Escaping SPACE: Part I'. Nine model configurations were given root access inside the VM and mounted 108 escape attempts. None of the attempts reached the host system.

Image · Perplexity
Original · Perplexity

We tested SPACE by attacking it with frontier models. In Escaping SPACE: Part I, nine model configurations with root inside the VM made 108 escape attempts, and none reached the host. Read the research: perplexity.ai/hub/blog/escap… 💬 1 🔄 0 ❤️ 6 👀 1701 📊 2 ⚡

#Perplexity#SPACE#AI safety#agents

Keep reading

Recent stories with the same tag or section
ProductsBuildersSelected01:44
Exa 3.0 Ties Perplexity at Top of Search Index

The benchmark was run with a Stirrup agent harness and GPT-5.6 Luna (medium), so the gains reflect real agent workflows rather than single-shot queries. Teams building search-backed agents can now choose between auto mode for quality and a lite tier costing 33% less per task, both positioned on the cost-versus-capability Pareto frontier. The results put Exa level with Perplexity's Search API, giving agent developers a directly comparable alternative at published per-task prices.

#Exa#Perplexity#Search API#agents
Event
官方账号Artificial Analysis@ArtificialAnlys2 sourcesSource
ProductsBuildersSelected01:11
Perplexity open sources SPACE agent sandbox platform under Apache 2.0

Isolating each agent task in a Firecracker microVM with externally managed credentials is a concrete, reusable pattern for agent safety that goes beyond model-level guardrails. Developers building autonomous agents can adopt SPACE directly or borrow its architecture to limit blast radius from malicious prompts. The Apache 2.0 license allows both commercial and open-source integration without restrictions.

#Perplexity#SPACE#Firecracker#agents
官方账号NVIDIA AI@NVIDIAAISource
ProductsBuildersSelected22:38
Perplexity open-sources SPACE, its agent code execution platform

The interesting part is the state machine: Pause keeps memory resident for fast recovery, Suspend snapshots VM memory plus filesystem for true persistence, with idle sandboxes auto-suspending after 6 hours. Engineers building agent sandboxes or code-interpreter features can study how warm pools and btrfs snapshots attack cold-start latency, a problem most teams still solve ad hoc. Management and attachment tokens being non-interchangeable is a useful security boundary pattern to copy.

#Perplexity#SPACE#Firecracker#agents
shao__meng@shao__mengSource
ProductsBuildersSelected02:35
Perplexity open-sources SPACE, the sandbox platform behind Perplexity Computer

Scaling isolated execution environments to production traffic is one of the harder infrastructure problems in agent deployment, and Perplexity is handing over a system that already runs at that scale. Teams building agent products can inspect how Perplexity handles sandbox provisioning, isolation and throughput instead of assembling their own stack. The GitHub repository makes it directly usable for anyone evaluating sandbox backends.

#Perplexity#SPACE#agents#open-source models
Aravind Srinivas@AravSrinivasSource
ProductsBuildersSelected02:13
Perplexity open sources SPACE sandbox platform under Apache 2.0

Isolating each agent task in a Firecracker microVM, with credentials and network egress managed outside the VM, is a concrete pattern teams building agent infrastructure can study or adopt directly. Developers running autonomous agents with tool access can compare SPACE with alternatives like E2B or self-managed gVisor setups. The Apache 2.0 licence permits commercial use without restrictions.

#Perplexity#SPACE#Firecracker#agents
官方账号Perplexity@perplexity_aiSource
ProductsBuildersSelected02:04
Perplexity open sources SPACE, the first component of its Agentic Runtime Platform

Security tooling from a major AI company being open sourced means developers can inspect and reuse the safeguards rather than trust them as a black box. Teams building agent products should review the blog post to see how SPACE fits into a runtime stack and whether its protections apply to their own deployments. Comparable security layers for agents remain rare in open source.

#Perplexity#SPACE#agents#AI safety
官方账号Perplexity@perplexity_aiSource