Perplexity Red-Teams Its SPACE Sandbox for AI Agents

Episode 1 · Perplexity's Red-Team Study of SPACE Sandbox Finds CTF-Style Tests Can Mislead AI Agents (2026-11-12, 5 posts)

Perplexity published red-team research on SPACE, the VM sandbox for its AI Computer agent, assigning 12 models two tasks: steal credentials from the host machine to escape the VM, and bypass SPACE network policies to access blocked URLs. The core finding: the industry-standard CTF "find the flag" style of red-teaming can steer agents away from the actual security boundary under test, and safety-tuned models do not guarantee safer real-world behavior. Vulnerabilities found during the study have been fixed.

Confirmed

• The subject was Perplexity's Computer agents VM sandbox SPACE, tested across 12 models with tasks including escaping the VM to steal host credentials and bypassing network policies to reach blocked URLs.
• In the CTF task the flag existed only on the host, so agents had to break through the VM isolation layer to reach it—but most spent their effort rummaging through files and probing services inside the VM; only 3 of the 12 models seriously attempted to breach isolation.
• The team found that safety-tuned training did not guarantee better red-team performance—these models actually underperformed general-purpose ones (full benchmark table in a follow-up post).
• Perplexity has fixed the vulnerabilities identified in the research.

Why it matters

• The study suggests red-team methodology itself can fail: if a task doesn't focus on the target security boundary, models waste compute on irrelevant steps and results don't reflect real risk.
• The finding that safety-tuned models were weaker challenges the intuition of judging safety by model positioning, offering a useful reference for security evaluation and model selection in agent products.

• Perplexity red-teams its SPACE VM sandbox: CTF prompts mislead agent security testing — perplexity_ai · 2026-11-12
• Perplexity research: standard CTF red-teaming steers agents away from the security boundary — perplexity_ai · 2026-11-12
• Perplexity red-team finds 9 of 12 AI agents barely probe the VM security boundary — perplexity_ai · 2026-11-12
• Perplexity red-teaming: security-specific agents can underperform general models — perplexity_ai · 2026-11-12
• Perplexity's SPACE research: CTF-style red-teaming may miss real security boundaries, patches applied — perplexity_ai · 2026-11-12

Episode 2 · Perplexity Red-Team: Boundary-Focused Prompts Boost Agent Security Effort (2026-11-12, 2 posts)

Perplexity shared full results and follow-ups from its SPACE sandbox red-team experiments: rewriting task descriptions to focus on the VM-host boundary raised agents' security-related effort by about 60 percentage points, while the specialized GPT-5.6 Cyber missed a DNS spoofing attack and lost to the general-purpose Sol model.

• Focused task framing boosts agent boundary testing by ~60 points; VM escape still fails — perplexity_ai · 2026-11-12
• Perplexity red-team benchmark: GPT-5.6 Cyber misses DNS spoofing that base Sol exploited — perplexity_ai · 2026-11-12