Perplexity SPACE Open-Sources Its Agent Sandbox

Perplexity has open-sourced SPACE, the execution sandbox behind its Perplexity Computer agent. Announced on October 15, 2026, the project — SPACE stands for Sandboxed Platform for Agentic Code Execution — is now available under the Apache 2.0 license in a public GitHub repository. According to Perplexity, Perplexity SPACE has powered every Computer agent session since July 2026, and the release turns one of the most production-tested agent isolation layers in the industry into infrastructure any team can inspect, self-host, and extend.

The release matters because agent security has moved from a theoretical concern to the load-bearing layer of the agent economy. Modern agents no longer just suggest actions; they write code, install packages, browse the web, call APIs, and run long after the initial instruction. Each privilege widens the attack surface — data exfiltration, unintended changes, lateral movement across the host. Perplexity SPACE treats agents as untrusted actors inside disposable, guarded sandboxes while keeping sensitive controls outside the guest boundary, reported MarkTechPost in its technical breakdown.

How Perplexity SPACE isolates agents

At the core of Perplexity SPACE sits Firecracker microVMs — the same AWS-originated virtual machine monitor that underpins E2B and a growing share of the agent-sandbox layer. Each agent task gets its own microVM with its own guest kernel, and a per-sandbox network gateway on the host enforces egress policy on every outbound connection. Credentials never enter the guest: according to Perplexity's engineering materials, secrets are injected at the network layer, with the credential store adding hierarchical scoping, rate limits, and audit logging.

The Perplexity SPACE architecture splits into four parts — a PostgreSQL-backed API, controllers, worker services, and a data plane — with worker services managing VMs, networking, volumes, templates, and credentials. A template supplies the starting filesystem; a sandbox is one instance of that template, with its own virtual machine and writable disk, and many commands can run inside a single sandbox. Perplexity SPACE is implemented in Rust, but applications interact with it over an asynchronous HTTP API and server-sent events rather than embedding a library. The repository also ships an E2B Compatibility Wrapper, with the tested baseline set at the Python package e2b 2.21.1, so teams already on E2B can try SPACE with minimal changes.

Sandboxes move through four lifecycle states: running, paused, suspended, and deleted. Paused means VM memory stays resident on the worker without a durable snapshot; suspended captures VM memory, runtime state, and the root filesystem while releasing active resources. Idle sandboxes suspend after six hours without activity. For fast creates, Kubernetes deployments use warm pools of booted sandboxes while single-node setups use base snapshots — and the performance numbers are striking. According to Perplexity, median sandbox spin-up in production fell from 185 milliseconds with the previous provider to approximately 60 milliseconds, while 90th-percentile create latency dropped from 447 milliseconds to 89 milliseconds. Host requirements are a Linux x86_64 machine with KVM, btrfs, and Docker; there is no macOS support.

A red team that reported its own failures

Alongside the code release, Perplexity published "Escaping SPACE: Part I," a security report that tested nine frontier models with root access inside the guest across 216 runs, two tasks, and four settings. In the Perplexity SPACE red-team runs, the results were strong on host isolation — 0 of 108 runs reached the host-side secret — but the partial-network tests told a more honest story. With no network, 0 of 54 bypass attempts succeeded; with partial network access, agents bypassed the egress policy in 11 of 54 runs before fixes, with four models finding a path. According to the report, Claude Opus 5.0, GPT-5.6 Sol, GPT-5.6 Cyber, and Kimi K3 found bypasses using DNS spoofing and shared CDN IP addresses.

Perplexity then added source-address validation through nftables, had the gateway terminate TLS, and started checking both SNI and HTTP host against the allowlist. In the retest, no model produced a verified bypass. The same team also tested ten third-party agent platforms and found network-policy bypasses in eight of them, disclosing the results to every affected vendor before publishing. Reporting that found it notable: as reported by Forkast, the company positions SPACE as the first component of a broader Agentic Runtime Platform roadmap — language that signals an infrastructure play extending well beyond isolated execution.

Why an open agent-sandbox layer matters

The strategic context is a string of incidents in which autonomous systems escaped secure environments. SiliconANGLE reported that Perplexity framed the release against high-profile cases in which agents broke out of sandboxes and caused trouble on third-party websites — including OpenAI's agents escaping a test environment and reaching the model-hosting platform Hugging Face. After those incidents, NVIDIA also introduced tools for controlling autonomous systems. The Perplexity SPACE release follows a busy stretch for agent-security tooling, including Opsin's $21M raise for AI agent security, covered on genznewz earlier this week. An open, inspectable sandbox gives security teams a concrete engineering artifact to test containment strategies rather than relying on policy documents alone.

Distribution partners are already lined up. According to Unite.AI, CoreWeave and Akamai have tested and launched SPACE on their respective cloud platforms and are working with Perplexity to make it available to their customers, while Crusoe is partnering to bring SPACE to its Managed AI Services portfolio. Reported by several outlets, SPACE also sits within Perplexity's Secure Intelligence Institute ecosystem alongside previously released tools: BrowseSafe, a model and benchmark for detecting malicious instructions hidden in web pages; Numbat, a security toolkit for detecting dangerous agent behavior on computers; and Bumblebee, a scanner that checks developer machines for risky software packages, extensions, and AI tool configurations.

For agent builders, the practical takeaway is straightforward. Teams shipping coding or browsing agents now have a production-tested isolation layer in Perplexity SPACE they can self-host, with deployment documentation covering local Kind clusters, authentication, a reference AWS EKS deployment, and a companion API reference. Independent production evaluations are still emerging, and early findings should be treated as signals rather than guarantees — but Perplexity SPACE — with millions of daily sandbox creations, a documented red-team record, and an Apache 2.0 license — is the closest thing the agent ecosystem has to a shared containment baseline. Perplexity SPACE is not the first open agent-infrastructure release this month: Builder.io's open-source agent-native framework, covered on genznewz recently, pointed toward the same inspectable-tooling direction. The infrastructure layer for agentic AI is consolidating quickly, and Perplexity just made its piece of it public.