Perplexity open-sources SPACE, its AI agent sandbox

What SPACE is

The name stands for Sandboxed Platform for Agentic Code Execution. According to the project README, it runs agent or user code in isolated Firecracker microVMs. Applications use an HTTP API to create Linux environments, run commands, collect output and manage sandbox lifecycles (GitHub).

A template supplies the starting environment, and each sandbox built from it gets its own VM and writable filesystem. SPACE is written in Rust, but you do not need to embed a Rust library: the API runs over HTTP and server-sent events. For local testing, the docs describe a Kind-based Kubernetes setup, though the architecture can also run without Kubernetes (SPACE Guide).

Source: Perplexity. Blog post announcing the open-sourcing of SPACE.

How it protects

Perplexity says SPACE treats the sandbox as untrusted from the start. Each sandbox runs in a small virtual machine with its own operating system, which separates the agent's work from the host. Network access and platform-held credentials are managed outside the sandbox, so the agent can reach authorized services without the keys being stored in its working environment (Perplexity).

The system takes frequent file snapshots and full runtime checkpoints but stores only the changes. That keeps pause, resume, recovery and session branching fast. Branching lets an agent try two approaches in separate copies of its workspace, for example.

How well it holds up

In Perplexity's published security evaluation, there was no escape from the virtual machine to the host in 108 attempts. Some attempts did find ways around network restrictions. Perplexity says it fixed those weaknesses and neither identified attack method worked in follow-up testing. It also disclosed weaknesses found in other sandbox platforms to their vendors.

Semafor reports that Perplexity instructed nine frontier models to try to break out. Partners CoreWeave, Akamai and Crusoe have agreed to offer SPACE to their customers (Semafor). The blog says Akamai has already launched it on its cloud and CoreWeave has published setup guidance for CKS.

Why now

SPACE replaced Perplexity's previous third-party sandbox provider in July. It has powered every Computer session since then, handling millions of sandbox creations per day. Perplexity says sandbox creation was three to five times faster than with its previous provider on the same traffic. The timing matters too. Semafor notes that sandboxes became a hot topic after several AI labs reported models escaping their constraints and attacking real systems. We covered the US investigation into such incidents in our FTC piece.

Perplexity is not alone: Semafor points out that NVIDIA OpenShell is another open-source tool that runs agents in a sandbox and limits what they can reach.

Who it is for

Teams building their own agent platforms that do not want to depend on a closed sandbox provider. The license is permissive, and the design already answers key management and outbound traffic filtering. Before production use, test it against your own threat model, since the published security results are Perplexity's own.