Nine Models Tried to Break Perplexity’s Agent Sandbox. Here Is Where It Cracked

Perplexity has open-sourced SPACE, the sandbox platform that runs code for its Computer agent, and published the escape test behind it.

• Each sandbox is its own Firecracker microVM with a guest kernel, so a compromised workload does not share a kernel with its neighbors.
• Credentials live outside the sandbox and are injected at the network layer, never stored where the agent can read them.
• Nine models, given root and the source code, failed to reach the host in 108 attempts.
• The network policy was the soft spot. With package repos allowed, four models reached a blocked address by poisoning DNS or riding a shared IP.
• The fix validates the source address on every packet and pins TLS to an allowlisted hostname.

The lesson for anyone running agents in production is that containment is a stack, and egress policy is the layer that tends to break first. Read the full analysis.