Perplexity's Red-Team Study of SPACE Sandbox Finds CTF-Style Tests Can Mislead AI Agents

Perplexity published red-team research on SPACE, the VM sandbox for its AI Computer agent, assigning 12 models two tasks: steal credentials from the host machine to escape the VM, and bypass SPACE network policies to access blocked URLs. The core finding: the industry-standard CTF "find the flag" style of red-teaming can steer agents away from the actual security boundary under test, and safety-tuned models do not guarantee safer real-world behavior. Vulnerabilities found during the study have been fixed.

Confirmed

• The subject was Perplexity's Computer agents VM sandbox SPACE, tested across 12 models with tasks including escaping the VM to steal host credentials and bypassing network policies to reach blocked URLs.
• In the CTF task the flag existed only on the host, so agents had to break through the VM isolation layer to reach it—but most spent their effort rummaging through files and probing services inside the VM; only 3 of the 12 models seriously attempted to breach isolation.
• The team found that safety-tuned training did not guarantee better red-team performance—these models actually underperformed general-purpose ones (full benchmark table in a follow-up post).
• Perplexity has fixed the vulnerabilities identified in the research.

Why it matters

• The study suggests red-team methodology itself can fail: if a task doesn't focus on the target security boundary, models waste compute on irrelevant steps and results don't reflect real risk.
• The finding that safety-tuned models were weaker challenges the intuition of judging safety by model positioning, offering a useful reference for security evaluation and model selection in agent products.

2026-11-12 ~ 2026-11-12 · 5 related posts

Full story(2 episodes)→

• Episode 1: Perplexity's Red-Team Study of SPACE Sandbox Finds CTF-Style Tests Can Mislead AI Agents(2026-11-12, 5 posts)
• Episode 2: Perplexity Red-Team: Boundary-Focused Prompts Boost Agent Security Effort(2026-11-12, 2 posts)

• [source] Perplexity red-teams its SPACE VM sandbox: CTF prompts mislead agent security testing — perplexity_ai · 2026-11-12
• Perplexity red-teaming: security-specific agents can underperform general models — perplexity_ai · 2026-11-12
• [source] Perplexity's SPACE research: CTF-style red-teaming may miss real security boundaries, patches applied — perplexity_ai · 2026-11-12

2 near-duplicate retellings: perplexity_ai · perplexity_ai