Agent containment has at least two distinct boundaries to validate: the guest-host boundary and the guest's permitted network paths.
The report says nine models received root access inside a guest VM and that no VM-to-host escape occurred across 108 runs. In the partial-network condition, four models bypassed restrictions using DNS spoofing or shared-IP routing and retrieved a secret flag; no model succeeded at the network-bypass task when all network access was blocked. These observations describe Perplexity's test setup and reported results, not a general proof of sandbox safety or insecurity.
A guest can remain isolated from its host while still reaching a prohibited destination through weaknesses in egress enforcement. Agents that run commands, install software, and operate with limited supervision make network policy a live containment control, rather than a secondary configuration detail. Teams should test VM isolation and egress policy separately, including realistic partial-network conditions. Perplexity says its reevaluation after changes found no verified bypass using the two identified methods. These are Perplexity's reported test results and setup; the reevaluation found no verified bypass using the two identified methods, which does not establish universal sandbox safety. Whether subsequent testing shows these bypass methods recur, or whether independent evaluations expose different escape routes.