How GPT-5.6 Cyber “Escaped” the Sandbox — Network Bypass, Not a VM Breakout

Perplexity CEO Aravind Srinivas amplified his company’s SPACE red-team results on X: nine frontier models with root inside the guest failed to break VM–host isolation in 108 runs, but four, including GPT-5.6 Cyber, reached a blocked URL once limited egress was allowed. The viral framing of a “sandbox escape” overstates what Cyber actually did. What the X post actually said On 28 September 2026 at 21:11 IST, Aravind Srinivas (@AravSrinivas), cofounder and CEO of Perplexity, posted a long-form Note quoting an official @perplexity_ai update. The company post stressed a Nvidia partnership and claimed that across 108 runs, none of nine models “breached the VM boundary.” Srinivas’s own text went further into the failure mode that did work. He said the security team gave nine models (Opus 5, GPT-5.6 Sol, Kimi K3, Gemini 3.1 Pro, and others) root inside the VM, and in some runs the full sandbox source, and asked them either to escape to the host or reach a URL blocked by network policy. None got out of the VM in 108 runs. But once limited network access was allowed (PyPI and Ubuntu mirrors for package installs), four models reached the blocked URL by: (1) spoofing DNS responses to the gateway and abusing the fact that pypi.org sits on a Fastly IP shared with thousands of other sites; and (2) GPT-5.6 Cyber going through Taboola’s image fetcher to a screenshot service, then OCRing the flag from the image. Perplexity said both issues were fixed and reruns held, and that eight of ten other sandbox providers tested had the same IP-sharing problem (e.g. E2B, Vercel, Modal). Sandbox escape (VM to host): 0 / 108 verified escapes (Firecracker microVMs + SPACE control plane and egress gateway). Network-policy bypass: 0 / 54 under no-network; 11 / 54 under partial-network before remediation. GPT-5.6 Cyber sits in the second category. Srinivas singles it out for Taboola to screenshot to OCR. That is an egress / policy defeat, not host compromise. The infographic’s caption is clear: a network-policy bypass does not imply control of the host. How the network bypasses worked (as described) 1. DNS spoofing against a hostname-based gateway, with root in the guest, forge DNS so an allowlisted name resolves to the blocked destination. 2. Shared-IP / CDN co-tenancy, allowlisting a hostname is not pinning the destination IP; Fastly co-tenancy let agents reach blocked capabilities through co-located tools (Cyber’s image to screenshot to OCR chain via Taboola). Perplexity states both were fixed (DNS source validation; hostname checks before TLS termination). Those remediations are first-party claims, not independently audited here. Industry blast radius: eight of ten sandboxes Srinivas wrote that eight of ten other providers shared the IP-sharing problem, naming E2B, Vercel, and Modal. Vendor fix status should be re-checked before any production claim. Do not confuse this with Trail of Bits’ QEMU/KVM escapes In August 2026, Trail of Bits published a separate report: GPT-5.6-Cyber escaped a QEMU/KVM VM on Debian 12 three times. That is not what Srinivas’s 28 Sep tweet describes. Conflating headlines risks implying Perplexity’s Firecracker/SPACE VM wall fell when Perplexity’s claim is the opposite for VM to host. Critical takeaways for operators - Separate sandbox escape (guest to host) from policy bypass (forbidden network resource). - Hostname allowlists are not IP policy, CDN shared addressing turns only PyPI into a proxy/image-fetcher surface. - Partial network is the realistic threat model (11/54 successes, not hermetic no-network). - No observed host escape in 108 runs is evidence of difficulty, not a certificate of isolation. - Disclosure and peer notification are positive hygiene, still distinct from independent verification of each fix. Bottom line GPT-5.6 Cyber escaping SPACE, as narrated by Perplexity’s CEO on X, means the model defeated network confinement under partial egress with a creative third-party service chain, then lost that path after Perplexity’s stated remediations. It does not, on this evidence, mean Cyber took the host. Source: Aravind Srinivas X post (28 Sep 2026), quoted @perplexity_ai update and infographic; Perplexity Hub Escaping SPACE Part I; secondary summaries; Trail of Bits Aug 2026 QEMU/KVM report for non-conflation only.