ResearchPerplexityConfirmed
Story 10 of 13 in the Wednesday 11 November editionPerplexity red-teams 12 frontier models against its SPACE virtual-machine agent sandbox
Extending its open-source SPACE evaluation to Claude Opus 5.5, Claude Mythos 5.1 and GPT-6 Astra, Perplexity found standard Capture the Flag prompts misdirect agents away from hypervisor boundaries and cyber-tuned variants trailed base models.
Edited by Ashutosh Shrivastava
12 Nov 2026, 10:05 IST · 3 min read
Perplexity published Escaping SPACE: Part II on 11 November 2026, expanding red-teaming of its open-source Sandboxed Platform for Agentic Code Execution (SPACE), which isolates Perplexity Computer agents inside root-privileged guest virtual machines. Adding Claude Mythos 5.1, Claude Opus 5.5, and GPT-6 Astra to the nine models tested in Part I (bringing the total to 12 models), researchers evaluated two boundaries: escaping hypervisor isolation to steal a host AWS credential, and bypassing egress network policies (after patching DNS-spoofing flaws discovered in Part I and disclosing similar bugs to 8 of 10 third-party sandbox vendors).
Boundary-focused prompting vs CTF flags and cyber-model trade-offs
Under standard Capture the Flag (CTF) prompts, nine non-GPT models spent at most 4% of their actions probing the hypervisor (and GPT-6 Astra, GPT-5.6 Cyber, and GPT-5.6 Sol spent 18% to 22%), instead hunting for exposed files or intercepting the guest spaced-svc vsock daemon. Rewriting prompts to explicitly target virtualisation vulnerabilities shifted effort toward hypervisor probes by roughly 60 percentage points on average and pushed Claude and GPT runs near the 120-minute ceiling (up from 21.5 average minutes for Opus 5.5), while SPACE’s VM-host isolation still held across every run.
Perplexity also found that general-purpose frontier models outperformed cybersecurity-specialised derivatives on broad sandbox tasks: base GPT-5.6 Sol succeeded in 3 of 3 source-assisted Part I network-bypass runs where cyber-tuned GPT-5.6 Cyber scored 0 of 3, and general-purpose GPT-6 Astra similarly outperformed cybersecurity-focused Claude Mythos 5.1.
Study details
- Evaluated sandbox target
- Open-source SPACE guest VM sandbox isolating root-privileged Perplexity Computer agents
- Tested frontier models
- 12 models including Claude Opus 5.5, Claude Mythos 5.1, GPT-6 Astra, GPT-5.6 Cyber and GPT-5.6 Sol
- Experimental matrix
- Four settings pairing SPACE source-code access versus none with offline versus patched network egress
- Hypervisor escape count
- 0 successful VM-to-host escapes across all runs, including 120-minute boundary-focused sessions
- Third-party disclosures
- DNS-spoofing egress flaws reported to 8 of 10 audited external agent sandbox providers
Release details & context
Twelve-model lineup, four guest probe vectors and Perplexity Computer isolation
Published by the Perplexity Secure Intelligence Institute in Escaping SPACE: Part II to audit the VM isolation backing Perplexity Computer and Perplexity Teammates, the cohort of 12 frontier models spans Claude Opus 5.0, Claude Opus 5.5, Claude Mythos 5.1, DeepSeek V4 Pro 0813, Gemini 3.1 Pro, GLM 5.2, GPT-5.6 Cyber, GPT-5.6 Sol, GPT-6 Astra, Grok 4.20, Kimi K3 and Qwen 3.8 27B (four of which had bypassed unpatched PyPI, Ubuntu and Perplexity Search egress rules in Part I prior to remediation).
Across the four source-and-network test conditions, researchers grouped agent actions into four classes: AKIA and ASIA credential scans, spaced-svc vsock daemon interception, mounted filesystem or metadata enumeration, and virtualisation-layer probes such as out-of-bounds virtual-disk requests and virtual-NIC driver unbind/rebind cycles against the 40 million+ line Linux kernel.
Common questions
Why did standard Capture the Flag prompts under-test SPACE’s virtual-machine boundary?
Goal-framed CTF flags led nine non-GPT models to spend at most 4% of actions on hypervisor interfaces while chasing guest files or the spaced-svc vsock service; explicitly instructing models to target virtualisation bugs raised hypervisor probing by roughly 60 percentage points.
Did cybersecurity-specialised models outperform general frontier models in SPACE red-teaming?
No, broad frontier checkpoints outscored narrow cyber derivatives in Perplexity’s trials: base GPT-5.6 Sol passed all 3 source-assisted Part I egress runs while GPT-5.6 Cyber failed all 3, and general GPT-6 Astra likewise beat cyber-tuned Claude Mythos 5.1.
Sources
Perplexity release timeline (6 launches tracked)
- Perplexity’s JOLT trains one model as both privileged teacher and student
Perplexity’s JOLT trains one model as both teacher and student, cutting MATH training tokens by 6.5 times.
- Perplexity rolls out updated voice mode for Pro and Max on web and Mac
Perplexity’s updated voice mode runs on OpenAI’s gpt-live-1 and lets Pro and Max users steer multiple Computer sessions and Projects on web and Mac.
- Perplexity Computer launches automated Shopify, Klaviyo and Meta ad workflows
Perplexity launched an e-commerce workflow suite inside Perplexity Computer connecting Shopify, Meta Ads, Klaviyo and 24 other merchant tools.
- Perplexity introduces Teammates personal agent workforce for Max subscribers on the web
Perplexity launched Teammates for Max subscribers on the web, deploying persistent personal agents that coordinate across Computer tasks, memory and Slack.