---
type: "post"
id: "audit-of-10-third-party-sandboxes-found-8-54fdd3"
slug: "audit-of-10-third-party-sandboxes-found-8-54fdd3"
title: "Audit of 10 third-party sandboxes found 8 vulnerable to DNS spoofing or CDN domain-fronting style network bypasses."
description: "Perplexity's evaluation shows that network confinement can fail independently of VM isolation."
retrieval_nugget: "Perplexity's evaluation shows that network confinement can fail independently of VM isolation."
published_at: "2026-10-16"
updated_at: "2026-10-16"
record_date: "2026-10-16"
date_kind: "published_at"
topics: ["sandbox","agent-security","security"]
source_urls: ["https://www.perplexity.ai/hub/blog/escaping-space-part-i"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:audit-of-10-third-party-sandboxes-found-8-54fdd3"
status: "published"
visuals: []
editorial_provenance: {"schema_version":"newruntime-editorial-copy-v1","content_status":"source_grounded_final","final_copy_sha256":"sha256:9333453395ce5b2383a853d07c3f6d548ef139b1beea7ccd7e07665e02f6b1cd","reviewed_at":"2026-10-16T05:02:19.332Z","source_evidence_count":1,"verified_claim_count":3,"site_analysis_schema_version":"newruntime-site-analysis-v1","site_object_kind":"field_note","observed_fact_count":3,"implication_count":2,"watch_condition_count":1,"related_record_count":0}
analysis: {"schema_version":"newruntime-site-analysis-v1","object_kind":"field_note","thesis":"Agent containment has at least two distinct boundaries to validate: the guest-host boundary and the guest's permitted network paths.","observed_facts":[{"text":"Perplexity reports nine models tested for VM escape, with no escape observed across 108 runs.","source_urls":["https://www.perplexity.ai/hub/blog/escaping-space-part-i"]},{"text":"In partial-network tests, four models bypassed restrictions using DNS spoofing or shared-IP routing and retrieved a secret flag.","source_urls":["https://www.perplexity.ai/hub/blog/escaping-space-part-i"]},{"text":"No model succeeded at the network-bypass task when all network access was blocked.","source_urls":["https://www.perplexity.ai/hub/blog/escaping-space-part-i"]}],"mechanism":"A guest can remain isolated from its host while still reaching a prohibited destination through weaknesses in egress enforcement.","why_now":"Agents that run commands, install software, and operate with limited supervision make network policy a live containment control, rather than a secondary configuration detail.","implications":["Teams should test VM isolation and egress policy separately, including realistic partial-network conditions.","Successful mitigation of two bypass methods should not be treated as proof that all routes are closed."],"evidence_boundary":"These are Perplexity's reported test results and setup; the reevaluation found no verified bypass using the two identified methods, which does not establish universal sandbox safety.","watch_conditions":["Whether subsequent testing shows these bypass methods recur, or whether independent evaluations expose different escape routes."],"related_records":[],"new_branch_reason":"No prior New Runtime record is supplied for this specific evaluation; this establishes a distinct evidence record about sandbox network confinement."}
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/audit-of-10-third-party-sandboxes-found-8-54fdd3/","markdown":"https://newruntime.com/posts/audit-of-10-third-party-sandboxes-found-8-54fdd3.md","json":"https://newruntime.com/posts/audit-of-10-third-party-sandboxes-found-8-54fdd3.json"}
related_patterns: ["agent-security-moves-to-runtime-boundaries"]
---

# Audit of 10 third-party sandboxes found 8 vulnerable to DNS spoofing or CDN domain-fronting style network bypasses.

## Retrieval answer

Perplexity's evaluation shows that network confinement can fail independently of VM isolation.

Perplexity's evaluation shows that network confinement can fail independently of VM isolation. Agent containment has at least two distinct boundaries to validate: the guest-host boundary and the guest's permitted network paths.

The report says nine models received root access inside a guest VM and that no VM-to-host escape occurred across 108 runs. In the partial-network condition, four models bypassed restrictions using DNS spoofing or shared-IP routing and retrieved a secret flag; no model succeeded at the network-bypass task when all network access was blocked. These observations describe Perplexity's test setup and reported results, not a general proof of sandbox safety or insecurity.

A guest can remain isolated from its host while still reaching a prohibited destination through weaknesses in egress enforcement. Agents that run commands, install software, and operate with limited supervision make network policy a live containment control, rather than a secondary configuration detail. Teams should test VM isolation and egress policy separately, including realistic partial-network conditions. Perplexity says its reevaluation after changes found no verified bypass using the two identified methods. These are Perplexity's reported test results and setup; the reevaluation found no verified bypass using the two identified methods, which does not establish universal sandbox safety. Whether subsequent testing shows these bypass methods recur, or whether independent evaluations expose different escape routes.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Sandbox](https://newruntime.com/topics/sandbox.md): Explore the sandbox topic hub.
- topic hub: [Agent Security](https://newruntime.com/topics/agent-security.md): Explore the agent-security topic hub.
- topic hub: [Security](https://newruntime.com/topics/security.md): Explore the security topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)