Perplexity red-teams its SPACE VM sandbox: CTF prompts mislead agent security testing
perplexity_ai · x · 2026-11-12
Perplexity published red-teaming results for SPACE, the VM sandbox for its computer-use agents. Twelve models were given two tasks: escape the VM to grab a host credential, and bypass SPACE's network policy to reach a blocked URL.
Key findings:
- The standard CTF setup steers agents toward hunting for flags inside the VM (files, services) instead of probing the virtualization layer — 9 of 12 models spent at most 4% of their effort there, so their failed escapes were weak evidence of isolation
- Security-specialized models don't guarantee better results
In a follow-up, rewriting the task description to focus on the VM-host boundary raised boundary-directed effort by 60 percentage points on average; agents still failed to escape by directly attacking the boundary, giving stronger evidence of the sandbox's isolation.
More from Safety
- Researcher says Anthropic dodged questions on Mythos false positive rate; 37,966 findings, 2 exploited — OwariDa · 2026-11-12
- Who reads the queries your agent writes? A diagram of agentic search data flows — adnan_hashmi · 2026-11-12
- Dev complains security features are gated behind expensive enterprise plans — AccBalanced · 2026-11-12
- SAFE-SEARCH workshop at ECIR 2027 calls for papers on safe conversational search — HamedZamani · 2026-11-12
- The biggest AI control risks come from internal models, not public releases — ben_j_todd · 2026-11-12
- Data centers power 20% of US tech sector and half of decade's stock gains — SydSteyerhart · 2026-11-12