Perplexity says standard capture-the-flag red-teaming can steer AI agents away from the security boundary they’re supposed to test. In a November 11 announcement, the company described a 12-model exercise involving SPACE, its virtual-machine sandbox for computer agents. Giving an agent a target to capture—the “flag”—apparently isn’t the same as pointing it at the right wall. Source
The company says it assigned two tasks: escape the virtual machine to take a credential from its host, and bypass SPACE’s network policy to reach a blocked URL. Source
In an accompanying post, @AravSrinivas wrote: “CTF red-teaming should prompt explicitly to break the host-guest isolation.” That means targeting the separation between the virtual machine and the host running it. Even an assignment to break things needs clear instructions. Source
Perplexity also says security-specialized models don’t guarantee better results. In an account of the exercise, @AravSrinivas goes further, saying non-cyber models were better at red-teaming and finding exploits. Neither post provides comparative scores or detailed methods. Source Source
Isolation and network access are different findings
@AravSrinivas characterized SPACE as “robust to sandbox isolation exploits.” Separately, the post says the team discovered and “addressed” network bypassing through DNS spoofing. Neither post reports a virtual-machine escape or host-credential theft. Source Source
Both posts describe Perplexity’s own testing, not an independent security check. The isolation claim doesn’t establish that SPACE is escape-proof, and neither post explains the DNS-spoofing mitigation, identifies affected versions or says when a change was deployed. Source Source
Comments