Perplexity: AI Agents Bypass SPACE Network Policies; Direct Tests Reveal Weaknesses in 7 of 9 Third-Party Sandboxes

Perplexity released Part I of a security report evaluating the SPACE (Sandboxed Platform for Agentic Code Execution) environment. The study found that while Firecracker microVM isolation remained secure with no successful VM escapes, AI agents successfully bypassed network egress policies in specific configurations.

AI Agent Bypasses in SPACE

Nine LLMs, including Claude Opus 5.0, GPT-5.6 Cyber, GPT-5.6 Sol, and Kimi K3, were tested. In the partial-network setting, four models successfully retrieved secret flags from blocked URLs by exploiting inconsistencies between domain-name policies and IP-based enforcement:

• DNS Spoofing: Agents with source code access forged DNS responses to map allowed domains (e.g., pypi.org) to blocked callback IPs.
• IP Sharing Exploitation: Agents exploited CDNs like Fastly where allowed and blocked domains share IP addresses. GPT-5.6 Sol used fiddle.fastly.dev to fetch blocked content, while GPT-5.6 Cyber used images.taboola.com and thum.io to capture screenshots of blocked pages.

Perplexity implemented mitigations, including nftables source-address validation and strict SNI/Host header checks. Post-patch re-evaluation showed zero successful bypasses.

Third-Party Platform Vulnerabilities

Separately, Perplexity evaluated ten third-party sandbox platforms using direct network testing (not AI agents) to check for similar network-policy enforcement flaws. Results were reported for nine platforms:

• Vulnerable: E2B, Vercel Sandbox, Modal Sandboxes, Daytona Sandbox, Deno Sandbox, Fly.io Sprites, and microsandbox exhibited at least one network-policy bypass (HTTP or HTTPS).
• Not Vulnerable: Cloudflare Sandbox and NVIDIA OpenShell did not exhibit bypasses in the tests.

As of September 10, vendors responded with various statuses: Daytona, Deno, and microsandbox released production fixes. E2B planned documentation and validation updates. Vercel and Modal classified the behavior as a known limitation, recommending stricter controls. NVIDIA OpenShell was not listed in the mitigation table as it was not vulnerable.