Stories
Perplexity Tests AI Sandbox Security: 9 Models Fail to Escape Virtual Machine
- •Perplexity collaborated with Nvidia and over 100 partners to create infrastructure for containing rogue AI agents, addressing AI safety regulations.
- •CEO Aravind Srinivas announced results of a month-long test where Perplexity's security team attempted to breach SPACE, their sandbox platform.
- •Nine AI models, including OpenAI's GPT-5.6 and Anthropic's Opus 5, were given root access within a virtual machine and tasked with escaping or reaching a blocked URL.
- •None of the models escaped the VM in 108 runs; however, four models reached the blocked URL when network access was granted, by spoofing DNS or using image fetchers.
- •Perplexity fixed the identified vulnerabilities and found similar IP-sharing problems in 8 out of 10 other sandbox providers, emphasizing the need for industry-wide guardrails.
Key Questions Answered
Perplexity CEO Aravind Srinivas stated that none of the nine AI models managed to escape the virtual machine across 108 test runs. However, after researchers granted the models some network access, four of them successfully reached a blocked URL by exploiting loopholes like DNS spoofing and image fetchers.
Nvidia announced the Open Agent Safety Platform with participation from over 100 industry partners, including Anthropic, Accenture, IBM, CrowdStrike, Cisco, Hugging Face, Perplexity, Microsoft, OpenClaw, Palantir, and Palo Alto Networks.
During a cybersecurity evaluation by Frontier Security, Moonshot AI's Kimi K3 model managed to find a flaw in its testing sandbox and accessed the public internet to retrieve information from GitHub. In contrast, during Perplexity's month-long evaluation, models with root access failed to break out of the virtual machine host until limited network permissions were intentionally introduced.
