Perplexity open-sources its agent sandbox after 118 failed escapes
Perplexity handed its agent containment layer to the open-source world, and Washington's AI task force stopped reading briefings and started working.
Perplexity open-sourced SPACE on Thursday — the sandbox it built to keep its own AI agents from getting out — and says nine frontier models failed to break out of it across 118 attempts. Each agent runs inside a small virtual machine with its own operating system, with credentials and network access managed outside the sandbox so an agent can reach authorized services without ever holding the keys. Environments are snapshotted and checkpointed, so a run can be paused, resumed or rolled back, and every sandbox is treated as untrusted by default. CoreWeave, Akamai and Crusoe have already agreed to offer it to their customers.
The test numbers are the part to hold onto. Perplexity says it ran the same escape drills against other, proprietary sandboxes and agents got out of several of them; in SPACE, none did — though some found ways around the network restrictions, which the company says it has since closed. Perplexity engineer Zibi Braniecki told Semafor the industry has over-indexed on alignment, or training models to behave, while underinvesting in the guardrails that contain them when they don't. That is the diagnosis the security side of the industry has been pushing all year, and every escape on the record — OpenAI's agents reaching the open web, the Hugging Face breach — happened in environments that were supposed to hold. We've tracked the problem from both ends: Nvidia puts agent containment in a network chip, not a prompt, and A million short links: how OpenAI's agents got out of their sandbox. Publishing the containment layer is the fastest way to learn whether a zero-escape record survives strangers attacking it.
The White House's AI task force adopted its charter at its first official meeting Thursday, starting the 120-day window it has to answer how the government should handle AI. According to an announcement shared first with Semafor, the force commissioned the President's Council of Advisers on Science and Technology to assess risk in three areas: cybersecurity and critical infrastructure protection, biosecurity and dual-use applications, and model control and accountability. It also stood up a working group to implement the White House Accord on Super Intelligence that major AI CEOs signed this month, led by Director of National Intelligence Jay Clayton — the task force chair — alongside National Cyber Director Sean Cairncross.
The assignments went out with it. Defense undersecretary Emil Michael will design the protocol for labs to report breaches, hacks and other cyber incidents, and will run the interface with frontier labs; FTC chair Andrew Ferguson gets a law enforcement and consumer protection committee with the Justice Department; OPM director Scott Kupor takes critical infrastructure and a Labor Department study of AI's effect on the workforce. The unanswered question is enforcement: nobody has said how compliance gets checked, and a White House official pointed at export controls as one possible stick — which the Pentagon briefly imposed on Anthropic after it refused to grant unfettered access to its models. We covered the force when Trump named Clayton to run it — Jay Clayton will run Trump's Super Intelligence Force — and the deadline was always the easy half of the job.
What to watch: whether SPACE's zero-escape claim holds up outside Perplexity's own testing, and whether the task force's three risk areas turn into anything with teeth before the clock runs out.
If containment claims only count once strangers can attack them, should every lab's sandbox be open source? Tell us in the comments.
