Egress

Perplexity's Open-Source Sandbox Leaves Half the Fix Off

Perplexity's 23 September red-team report on its SPACE agent sandbox found 0 of 108 VM escapes but 11 of 54 network-policy bypasses by four models, through forged DNS replies and CDN IPs PyPI shares on Fastly, and fixed both by validating source addresses and checking SNI and the HTTP Host against the allowlist. In the code Perplexity open-sourced on 15 October, the plain-HTTP half of that fix always runs, but the HTTPS half only runs when a policy sets tls_interception to on; an unset value and the E2B wrapper both default to off, where the gateway checks SNI and DNS attribution and relays the encrypted stream opaquely, the same check the report showed failing on seven other sandbox platforms through domain fronting.