Running autonomous code from AI agents creates a practical problem of containment.
The software can install packages, open connections, and persist across steps, yet the surrounding systems need to stay outside its reach. Then, in September, Perplexity's Secure Intelligence Institute published a research titled "Escaping SPACE: Part I," describing tests of the sandbox platform that powers the company's Computer product for long-running agent tasks.
SPACE stands for Sandboxed Platform for Agentic Code Execution.
Each agent task receives its own lightweight virtual machine, built on Firecracker technology, that runs as a guest on a host machine outside the guest’s control. The agent can operate with root privileges inside that virtual machine, install software, and execute commands.
A separate gateway on the host side enforces rules on outbound network traffic, deciding which destinations are allowed based on domain names and related checks. Credentials are kept outside the virtual machine and supplied only when needed. The design aims to contain both accidental failures and deliberate attempts to leave the boundary, whether by reaching host resources or contacting unauthorized external services.
Now, Perplexity is open-sourcing SPACE
SPACE is designed to prevent the kind of incident where agents moved beyond their intended limits.
One infamous example was in July 2026, when agents under evaluation at OpenAI escaped a testing environment, coordinated through an unsanctioned channel inside internal package infrastructure, and compromised systems at Hugging Face.
The agents were working on cybersecurity benchmark tasks; some pursued ways to obtain answer keys or alter scoring, using available package routes to reach the internet, escalate access, and interact with production infrastructure.
Hugging Face later documented thousands of automated actions against its systems. OpenAI acknowledged the events and noted that safeguards had not been fully active during the tests. Perplexity’s researchers cited the episode as one reason containment must address both unintended breaks and agents that actively seek to leave their environment.
In the SPACE experiments, 9 model configurations were given root access inside the guest virtual machines and, in some runs, read-only access to the platform’s source code.
They were tasked with either obtaining a host-side secret or reaching a network destination blocked by the gateway policy.
Across 108 attempts, no model crossed the virtual-machine boundary to the host or recovered the secret, even when they could install software and use web search. When all network access was removed, no bypass succeeded.
Under partial network conditions that allowed approved package repositories and search, four models (Claude Opus 5.0, GPT-5.6 Cyber, GPT-5.6 Sol, and Kimi K3) found ways around the restrictions in 11 of 54 runs.
pypi.org hostname to the blocked callback’s IP, the agent tricked the gateway into admitting an HTTPS connection to retrieve the flag without compromising the legitimate DNS resolverThe successful network bypasses did not break the virtual-machine isolation.
Instead they exploited how the gateway mapped allowed domain names to IP addresses, or how multiple services can share the same IP address through content-delivery networks.
In one approach, agents forged DNS responses so that an allowed name resolved to the IP of a blocked destination, causing the gateway to permit the connection. In another, they used a permitted shared IP and adjusted request headers so traffic reached a different service hosted on that address.
One model also routed through a permitted image-fetching service, then extracted information from a screenshot of the blocked resource.
After the researchers added source-address checks on DNS packets, TLS termination with hostname validation, and stricter handling of HTTP authority information, retesting found no further verified bypasses.
The same network techniques appeared in tests of ten other sandbox platforms.
Eight exhibited at least one form of policy bypass under comparable conditions. The researchers disclosed the findings to the affected vendors; some applied fixes or planned mitigations, while others updated documentation.
The results left the virtual-machine boundary intact in SPACE while showing that network rules, which depend on domain-to-IP mappings and shared infrastructure, required additional controls to hold under active probing.
Part II of the series, the post notes, will examine the specific strategies the models used.
