Perplexity shows agent sandbox tests can measure the wrong behavior
Perplexity published a second red-team study of its SPACE virtual-machine sandbox. It reports that no tested model escaped the VM, but several exploited partial-network paths before fixes; follow-up work found standard capture-the-flag wording diverted agents from the security boundary being evaluated.
Why it matters: The result is actionable for agent-sandbox evaluation: a clean CTF score may reflect task framing rather than isolation strength. Security-specialized models also did not consistently outperform general models in Perplexity's runs.