What changed
Perplexity published a second red-team study of its SPACE virtual-machine sandbox. It reports that no tested model escaped the VM, but several exploited partial-network paths before fixes; follow-up work found standard capture-the-flag wording diverted agents from the security boundary being evaluated.
Why it matters
The result is actionable for agent-sandbox evaluation: a clean CTF score may reflect task framing rather than isolation strength. Security-specialized models also did not consistently outperform general models in Perplexity's runs.
What to do
Red-team the boundary directly as well as with hidden flags, vary source and network access, preserve agent traces, and rerun every exploit after remediation. Treat model rankings as scenario-specific.
Caveat
This is first-party research on Perplexity's sandbox and a small number of runs. The authors disclosed similar issues to third parties, but the public article does not independently validate every affected platform or generalize capability rankings.