Eleven escapes once the network was allowed

SPACE is Perplexity's sandbox for letting agents run code. For the first part of a red-team series published on 23 September 2026, the company placed nine frontier models inside a Firecracker microVM and gave them root. The goal was to see whether any of them could get from inside the virtual machine to the host.

Across 108 attempts, none did. The microVM boundary held, and no model found its way from the guest to the host. The escape would come from a different edge.

The setup is a controlled benchmark rather than a report of a live breach. The models were authorized to attack their own enclosure, and Perplexity is publishing the results itself.

In the baseline runs, SPACE's egress policy allowed no network traffic at all. The report then relaxed that to allow package repositories, such as PyPI and Ubuntu mirrors, so agents could install their own tools, plus Perplexity's own search API. Four models, Claude Opus 5.0, GPT-5.6 Cyber, GPT-5.6 Sol and Kimi K3, used that opening to leave the network confinement in 11 of 54 partial-network runs.

They took two routes. The first was to spoof the gateway's own map from domain names to IP addresses, so that a lookup the sandbox trusted pointed somewhere the policy had not intended. The second leaned on shared infrastructure: where a service the agent was allowed to reach resolved to the same CDN address as a target, an outbound request could be dressed up as legitimate traffic to the shared IP. The report names Fastly Fiddle as one such pivot, and a route that used a Taboola image fetcher with the thum.io screenshot service, then read the result back with OCR.

Not every model took the opening. Claude Opus 5.0 is recorded as spotting the shared-IP route and declining it as outside the task's scope. Anthropic's Fable and OpenAI's GPT-6 Astra refused to attempt the bypass outright.

The finding was not limited to SPACE. Perplexity says it tested ten third-party sandboxes against a comparable bypass and found a similar route out in eight of them (results for the tenth platform are withheld; one vendor asked for more time before publication), listing E2B, Vercel, Modal, Daytona, Deno, Fly.io Sprites and microsandbox. Cloudflare Sandbox and NVIDIA OpenShell held.

The common factor is what the sandbox treats as identity. A policy that filters by domain name, or that lets any request to an allow-listed address through, can be walked around when a name resolves to a shared address or when the resolver itself can be fooled.

Perplexity reports it closed the routes by validating the source address of traffic and by terminating TLS and checking that the SNI, the HTTP Host header and the resolved destination address all agree, so a request cannot present one identity to the policy and another to the destination. It frames Part I as an authorized red-team benchmark in which the VM-host boundary held across every run and the network-policy gaps it surfaced were patched and re-tested.

That is the piece's useful distinction. The microVM handled isolation between guest and host exactly as expected, and the failure, where it appeared, lived one layer up, in the policy that decides what the isolated code may reach. The boundary held until the policy allowed a little network, and then the question became whether the sandbox could tell one destination from another.