Perplexity red-teams SPACE: no VM escapes, four models bypass egress
Perplexity’s Escaping SPACE Part I gave nine models root in the sandbox behind Perplexity Computer: no VM-to-host escape in 108 runs. With partial network access, four models (Opus 5, GPT-5.6, Kimi K3) reached a blocked URL via DNS spoofing or shared-IP OCR; both paths were patched, and 8 of 10 other sandboxes shared the IP issue.