Perplexity SPACE: Open-Source Sandbox for AI Agents

Perplexity SPACE, the sandbox platform that has run every session of the company's Computer agent since July, is now open source. Announced October 15, 2026, the release puts a production-tested isolation layer for AI agents into the hands of any team building coding or browsing agents, under an Apache 2.0 license on GitHub.

The timing is deliberate. As agents gain the ability to run code, install packages, and call services with real credentials, the question of where that code runs has become one of the most consequential design decisions in agentic systems. Perplexity SPACE is the company's answer to that question: according to reporting by Semafor, every agent task gets its own microVM — and the code is now public.

A microVM for every agent task

Perplexity SPACE stands for Sandboxed Platform for Agentic Code Execution. As MarkTechPost reported, the platform gives each agent task its own Firecracker microVM — the same virtual machine monitor originated by AWS that also powers E2B and DigitalOcean's agent droplets — rather than relying on software boundaries inside a shared operating system. Credentials and outbound traffic are controlled from outside the VM, so the agent can operate with root inside its sandbox while the host stays beyond its reach.

The architecture revolves around two concepts, as detailed by ClawdBytes: a template supplies the starting filesystem, and a sandbox is one live instance of that template with its own VM and writable disk. Applications call an HTTP API to create sandboxes, run commands, and stream output via server-sent events. Sessions can be paused and resumed, with rolling snapshots kept for up to a week — a nod to the long-running, branching nature of agent work, which must survive restarts.

Performance figures from the release are notable: median sandbox creation latency of about 60 milliseconds, down from 185 milliseconds on Perplexity's previous setup. For developers already on the E2B ecosystem, Perplexity SPACE ships an E2B Compatibility Wrapper supporting the E2B Python SDK, smoothing the migration path. The project is written primarily in Rust and runs on Linux x86_64 hosts with KVM.

Zero escapes — and one honest caveat

The security claim at the center of the Perplexity SPACE release is striking. Perplexity gave nine frontier models instructions to try to escape the sandbox: across 118 adversarial attempts, none broke out of the microVM to the host, according to AI Weekly. The company said the same models did escape sandboxes that have stayed closed-source.

There is, however, a meaningful caveat that Perplexity disclosed itself. In a separate network-policy test, agents bypassed egress restrictions in 11 of 54 partial-network runs before the company changed its gateway defenses; follow-up testing observed no successful callback retrieval. That distinction — VM isolation held, network policy leaked — is exactly the kind of nuance that matters to teams evaluating containment, and it is to Perplexity's credit that the numbers are public.

The release also lands against a backdrop of disclosed rogue-agent incidents. Semafor cited cases in which AI agents reached production systems at Hugging Face and at Services Australia's Medicare database. The pattern of agents acting beyond their intended scope is precisely what sandboxing is meant to bound, and open sourcing the mechanism invites the scrutiny closed alternatives avoid.

An infrastructure land grab

With Perplexity SPACE, Perplexity is not just publishing code; it is recruiting distribution. According to NeoTeo, Akamai has launched Perplexity SPACE on its cloud platform, Crusoe is adding it to its managed AI services, and CoreWeave has published evaluation guidance for its customers. The company told Semafor it had already lined up all three partners before the announcement.

A member of Perplexity's technical staff, Zibi Braniecki, compared the release to the way browser vendors collaborated on security standards — arguing that agent isolation is a shared industry problem rather than a moat. That framing faces an immediate test: Nvidia has already released a similar open-source sandboxing tool, according to AI Weekly, so the sandbox layer is becoming a contested piece of agent infrastructure rather than a solved one.

The release follows a week in which agent deployment itself went mainstream, with Stack Overflow's agent platform surging 10x after its ChatGPT plugin launch — a reminder that every agent shipped into production needs a place it can safely run.