A sandbox test can pass even when the agent spent most of its time looking in the wrong place.
Perplexity published Part II of its SPACE red-team study on November 11. The team added Claude Mythos 5.1, Claude Opus 5.5, and GPT-6 Astra to its earlier evaluation. It tested whether agents with root privileges inside a guest virtual machine could cross to the host. A separate exercise tested whether agents could reach a network destination blocked by policy.
In the host exercise, Perplexity says a more specific prompt increased the share of effort spent probing virtualization by about 60 percentage points on average. The team reports no successful guest-to-host escape in the focused runs. Its earlier work had found ways to bypass network controls, which the team says it fixed and retested. Those are first-party results under the study’s conditions.
Record three outcomes before calling the test complete
Set a separate pass condition for host isolation, network restrictions, and emergency shutdown. Use synthetic data and a test destination you control. Record whether the agent accessed a host-only marker, whether an unapproved connection reached the destination, and whether an operator could stop the run from outside the sandbox. A log for each outcome makes it clear which boundary was exercised.
Record the prompt as part of the test. If one run mainly searched for markers, a follow-up can direct attention to the boundary that the first run barely examined. This proposed checklist draws on the study and Australia’s guidance on controlled agent testing.
Abdessalam Alaoui
I'm Abdessalam Alaoui, founder of Musthave.AI. I write practical guides to AI models, tools, generative media.
