4 AI Models Breach Perplexity's SPACE Sandbox Network

Claude Opus 5.0, GPT-5.6 Cyber, GPT-5.6 Sol, and Kimi K3 successfully retrieved a secret flag by exploiting gaps in a network gateway during security tests. These models bypassed the confinement of the SPACE sandbox by forging DNS replies that mapped pypi.org to a callback IP or by using services that share PyPI's Fastly address to fetch the callback, bypassing an IP-based enforcement system. The breaches occurred under partial-network conditions during a month of red-team testing conducted by Perplexity's security team. Out of 216 total runs, no model succeeded in an escape attempt across 108 tries, and no bypass worked when network traffic was fully blocked. SPACE is the sandbox platform used to run all of Perplexity Computer.