AITOPAI热报
PapersSelected

Perplexity 发布 SPACE 沙箱平台红队测试研究：12 个模型尝试逃逸虚拟机

Aravind Srinivas@AravSrinivas
Post
View the post
Why we picked it

Perplexity 给 12 个模型出了道逃逸题：攻破自家开源沙箱 SPACE。有意思的结论是通用模型比网络安全专门版更能挖漏洞，连 DNS 伪造绕网这种手法也是他们自己测出来的。做智能体部署和沙箱安全的开发者可以直接读，安全边界怎么设、CTF 基准怎么写提示词都有参考。

Perplexity 公布了对其 VM 沙箱平台 SPACE 的红队测试研究，让 12 个模型完成两项任务：从虚拟机逃逸到宿主机窃取凭证，以及绕过 SPACE 的网络策略访问被封锁的 URL。

Body

研究得出四项发现：CTF 红队测试的提示词应明确要求突破 host-guest 隔离，否则会引导智能体偏离被测安全边界；非网络安全专门模型的表现反而优于安全专门模型，例如 GPT 5.

6 Sol 比 GPT 5.6 Sol Cyber 更擅长发现漏洞。

SPACE 平台本身经受住了沙箱隔离逃逸尝试，但研究团队自行发现并修复了通过 DNS 伪造绕过网络限制的问题。该平台为开源项目，Perplexity 计划持续向智能体沙箱和安全社区公开这类研究成果。

Original · Aravind Srinivas

New research on red teaming our sandbox platform SPACE: 1. CTF red-teaming should prompt explicitly to break the host-guest isolation. 2. Non-cyber models are actually better than cyber models at red teaming and finding exploits (eg GPT 5.6 Sol vs GPT 5.6 Sol Cyber) 3. Our sandbox platform SPACE was robust to sandbox isolation exploits 4. Network bypassing with DNS spoofing was something we discovered and addressed 5. Our platform is open-source and we want to keep sharing our findings openly for the agent sandbox and security community. Perplexity @perplexity_ai We are publishing new research on our findings from red-teaming SPACE, our VM sandbox for Computer agents. We gave 12 models two tasks: escape the VM to take a credential from the host, and bypass SPACE's network policy to reach a blocked URL. We found that the standard Capture the Flag setup used in red-teaming can steer agents away from the security boundary being tested, and that security-specialized models don't guarantee better results. perplexity.ai/hub/blog/escap… 🔗 View Quoted Tweet📊 15 ⚡

Industry Coordinates & Source Verification

This report is categorized under AITOP's "Papers" desk, focusing on US frontier AI labs and Silicon Valley technology leaders. Within our cross-regional analytical framework, it directly maps to AI developer toolchains, coding agents, and engineering workflows and US-China foundation model benchmarks and commercialization comparison. Key entities and technical topics under continuous tracking include Perplexity, SPACE, GPT 5.6, AI安全.

Source attribution: curated from Aravind Srinivas (@AravSrinivas).

#Perplexity#SPACE#GPT 5.6#AI安全#智能体

Keep reading

Recent stories with the same tag or section
IndustryBuildersSelected02:42
Perplexity fixes network flaws agents exploited in SPACE sandbox

The takeaway is that sandbox hardening was done at the network layer, and the vendor explicitly treats escape testing as ongoing because stronger models may find new routes. Teams building or evaluating agent execution environments should track the full research post for technical details and re-audit their own network policies. The work signals that agent security benchmarking is shifting from one-off audits to continuous testing as model capabilities improve.

#Perplexity#SPACE#agents#AI safety
Official accountPerplexity@perplexity_aiSource
How-toBuildersSelected02:40
Perplexity Finds CTF Tasks Poorly Measure Agent Security Skills

The non-obvious point is that even security-specialised models can underperform on real red-teaming work, so vendor claims of security fine-tuning deserve scrutiny. Teams evaluating agents for security-sensitive deployments in finance, infrastructure or SaaS should design internal task suites instead of relying on CTF leaderboard scores. The finding applies regardless of region, since evaluation methodology, not model origin, is the bottleneck.

#Perplexity#AI safety#agents#red-teaming
Official accountPerplexity@perplexity_aiSource
PapersBuildersSelected02:34
Perplexity Red-Teams SPACE VM Sandbox with 12 Models

The non-obvious insight is that the CTF format itself may bias agent security evaluations, meaning current red-team benchmarks could be testing the wrong thing. Teams building or deploying computer-use agents, sandbox infrastructure, or agentic safety pipelines should read the methodology to audit their own evaluation setups. It also suggests enterprises cannot rely on a model's security-specialization claims as evidence of sandbox resistance.

#Perplexity#SPACE#AI safety#agents
Official accountPerplexity@perplexity_aiSource