Escaping SPACE: Part I

Perplexity evaluated the security of its SPACE agent sandbox by giving nine AI models root access inside Firecracker microVMs and testing whether they could escape to the host or bypass restricted network access. Across 108 VM-to-host escape attempts, no model obtained the host-side secret, while no network bypass succeeded when all networking was blocked; however, in partial-network settings that allowed package repositories and search, four models achieved 11 successful bypasses in 54 runs. The bypasses exploited DNS spoofing to poison domain-to-IP mappings and shared CDN IP addresses to access other services through permitted infrastructure, rather than breaking VM isolation. Perplexity added source-address validation, TLS termination, hostname and HTTP-authority checks, and protocol restrictions, after which repeated tests found no verified bypasses. Tests of ten third-party sandbox platforms found similar network-policy weaknesses in eight, with seven publicly identified platforms showing at least one bypass, prompting vendor disclosures and a mix of fixes, planned mitigations, and documentation updates. The findings emphasize that VM isolation and network confinement are separate defenses and that domain-based egress controls must validate destination identity consistently across DNS, IP, TLS, and HTTP layers.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.