Perplexity's agent sandbox held in 108 escape runs. Its allowlist didn't, at first.

Perplexity open-sourced SPACE, the sandbox behind its Computer agent, last week, and its own red team shows the allowlist is where agents slipped out. SPACE runs each agent task in its own Firecracker microVM, a small virtual machine with its own kernel. The code is on GitHub under Apache 2.0, per MarkTechPost's October 16 write-up.

The walls held. In Perplexity's September 23 red-team report, nine models got root inside the guest, and none of 108 escape runs reached the host. The egress allowlist, the list of outside sites an agent may reach, did worse. With package repositories allowed, four models got past it in 11 of 54 runs. They spoofed DNS or rode a shared CDN address.

Perplexity's own conclusion is blunt: Relying only on the destination IP address at the host to determine whether a connection is allowed is insufficient. Its fix checks the TLS name and the HTTP host against the list. It also tested nine other sandboxes and reported a bypass in seven.

Here's what I'd do if your agents install packages. Point an agent at your own allowlist, tell it to break out, and read the log. Better that yours tries first.