Perplexity publishes red-team results for SPACE, its VM sandbox for Computer agents
Perplexity said on 11 November that it red-teamed SPACE, its VM sandbox for Computer agents, with 12 models. It says the standard Capture the Flag setup can steer agents off the boundary under test.
If you test agent sandboxes, the test design can skew what you learn. Perplexity also says a security-specialized model is not guaranteed to do better, so check the model you are using rather than assume.
Perplexity published new red-teaming research on 11 November about SPACE, its VM sandbox for Computer agents. The company says it gave 12 models two tasks, and found that the standard Capture the Flag setup can steer agents away from the security boundary being tested.
What happened
Perplexity announced the research in a post on X. The post is the company's own account of its work, and the details below come from it. The full write-up is on Perplexity's blog.
SPACE is the virtual machine sandbox Perplexity uses for its Computer agents. The team tried to break out of it using AI models as the attackers.
The X post gives no results per model. It does not say whether any model succeeded at either task.
Key details
- Models tested: 12.
- Task one: escape the VM and take a credential from the host.
- Task two: bypass SPACE's network policy to reach a blocked URL.
- Finding one: the standard Capture the Flag (CTF) setup used in red-teaming can steer agents away from the security boundary being tested.
- Finding two: security-specialized models do not guarantee better results.
- Source: Perplexity's own post, dated 11 November 2026.
Why it matters
Many teams now run agents inside VMs or behind network policies. Those controls only count if they have been tested well.
Perplexity's first finding is about the test itself. In a CTF-style setup, an agent can chase the flag instead of probing the boundary you care about. A pass or fail may then say little about the sandbox.
The second finding is about model choice. According to Perplexity, a model built for security work did not guarantee a better result. If you use models for red-teaming, compare them on your own tasks. For a separate example of a security-focused model, see OpenAI's GPT-6 Cyber release. It is not part of Perplexity's study as far as the source shows.
This post rests on Perplexity's short X summary. For more detail, use the blog link above.
FAQ
What is SPACE? SPACE is Perplexity's VM sandbox for its Computer agents. Perplexity red-teamed it with 12 models.
What tasks did the models get? They were asked to escape the VM and take a credential from the host. They were also asked to bypass SPACE's network policy to reach a blocked URL.
Do security-specialized models do better at red-teaming? Not necessarily. Perplexity says security-specialized models do not guarantee better results.
Checked claims
| Claim | Status | Evidence |
|---|---|---|
| Perplexity published new research from red-teaming SPACE, its VM sandbox for Computer agents. | confirmed | We are publishing new research on our findings from red-teaming SPACE, our VM sandbox for Computer agents. |
| Perplexity gave 12 models two tasks: escape the VM to take a host credential, and bypass the network policy to reach a blocked URL. | unsupported | We gave 12 models two tasks, and the first was to escape the VM to take a credential from the host |
| The second task was to bypass SPACE's network policy to reach a blocked URL. | confirmed | bypass SPACE's network policy to reach a blocked URL |
| Perplexity says the standard CTF setup can steer agents away from the security boundary being tested. | confirmed | the standard Capture the Flag setup used in red-teaming can steer agents away from the security boundary being tested |
| Perplexity says security-specialized models do not guarantee better results. | confirmed | security-specialized models don't guarantee better results |
Found a mistake? Use Report above; an editor reads every one. Editorial policy
Question for readersHow do you test the sandboxes your agents run in, and has the test setup ever misled you about what was actually secure?
Discussion · 0
No comments yet. Start the discussion.
Sign in to join the discussion.