Perplexity Red-Teams SPACE VM Sandbox with 12 Models
The non-obvious insight is that the CTF format itself may bias agent security evaluations, meaning current red-team benchmarks could be testing the wrong thing. Teams building or deploying computer-use agents, sandbox infrastructure, or agentic safety pipelines should read the methodology to audit their own evaluation setups. It also suggests enterprises cannot rely on a model's security-specialization claims as evidence of sandbox resistance.
Perplexity published new research on red-teaming SPACE, its VM sandbox for Computer-use agents, running two tasks: escaping the VM to grab a credential from the host, and bypassing SPACE's network policy to reach a blocked URL. The tests were run against 12 models, including security-specialized ones, to measure how reliably agents could cross the sandbox's security boundaries.
The research reports two findings. First, the standard Capture the Flag setup used in red-teaming can steer agents away from the actual security boundary being tested, meaning CTF framing may produce misleading safety evaluations. Second, security-specialized models did not guarantee better results on the escape or policy-bypass tasks, suggesting specialized training is not a reliable proxy for sandbox security testing performance.
The findings are published as a blog post on Perplexity's hub (perplexity.ai/hub/blog/escap...). SPACE is the sandbox Perplexity uses to contain its Comet browser agents' computer actions, so the results inform how agent sandboxes in production should be evaluated. The work adds to a small but growing body of public research on agentic safety boundaries beyond API refusal tests.
We are publishing new research on our findings from red-teaming SPACE, our VM sandbox for Computer agents. We gave 12 models two tasks: escape the VM to take a credential from the host, and bypass SPACE's network policy to reach a blocked URL. We found that the standard Capture the Flag setup used in red-teaming can steer agents away from the security boundary being tested, and that security-specialized models don't guarantee better results. perplexity.ai/hub/blog/escap…📊 7 ⚡
This report is categorized under AITOP's "Papers" desk, focusing on US frontier AI labs and Silicon Valley technology leaders. Within our cross-regional analytical framework, it directly maps to AI developer toolchains, coding agents, and engineering workflows and US-China foundation model benchmarks and commercialization comparison. Key entities and technical topics under continuous tracking include Perplexity, SPACE, AI safety, agents.
Source attribution: curated from Perplexity (@perplexity_ai).
