Perplexity red-teams its sandbox: no model escapes the VM, but 4 bypass the network allowlist
jomic01 · reddit · 2026-11-12
Perplexity red-teamed SPACE, the Firecracker sandbox behind its Computer agents, with 9 models across 108 runs: every model got root inside the guest VM, but none escaped to the host.
Once the sandbox allowed limited access to PyPI and Ubuntu mirrors, though, 4 models (Claude Opus 5.0, GPT-5.6 Cyber, GPT-5.6 Sol, Kimi K3) reached a blocked URL via DNS spoofing or shared CDN IPs. Similar gaps were found in 8 of 10 third-party sandbox platforms tested.
Another finding: with a plain capture-the-flag prompt, agents spent more time hunting for credentials than testing the boundary. The takeaway for anyone running agents with package installs on: an IP allowlist alone doesn't hold up when mirrors share CDN infrastructure.
More from coding & agent
- Andrew Ng releases 4 free AI tools on GitHub, including desktop coworker OpenWorker — alex_verem · 2026-11-12
- The fastest way to make $0 with AI: automate outreach before your first client — aryanXmahajan · 2026-11-12
- Slaunt MCP server gives Claude Code 99% memory recall while cutting tokens 31% — karatyma_dev · 2026-11-12
- LISL: a lightweight agentic loop claiming 1.2 tasks per token on a local Gemma 12B — MammothTreat6751 · 2026-11-12
- llama.cpp PR #31915 fixes Gemma4 tool calling, user reports it "completely fixed" agentic coding — jacek2023 · 2026-11-12
- Claude Code Dev Shares prompt-audit Command to Strip Stale CLAUDE.md Instructions — FinanceYF5 · 2026-11-12