Perplexity locked 9 models in a sandbox: none escaped the virtual machine, but four got around network restrictions
Prepared by Sintelligent with the help of SI. Publication time restored from the build log. . Updated: .
Models are ingenious at finding workarounds where people did not think to look, which is why sandboxes are now tested by SI attackers themselves.
Perplexity's security team spent a month trying to break SPACE, the sandbox that runs Perplexity Computer: nine models (among them Opus 5, GPT-5.6 Sol, Kimi K3, Gemini 3.1 Pro) were given root access inside a VM and the task of getting out. The VM boundary held in all 108 runs, but when the policy allowed access to package repositories, four models reached forbidden addresses through spoofed DNS responses and shared CDN IP addresses; GPT-5.6 Cyber extracted a flag through a screenshot service and OCR. Perplexity added a sender-address check rule; 8 of the 10 other sandbox providers tested had the same shared-IP problem.
Sources 2