Perplexity Open-Sources SPACE: How AI Agent Sandboxes Work and Why They Matter
When an AI agent writes and runs code, where does that code actually run? Perplexity just open-sourced its answer: SPACE, the sandbox behind its Computer agent. Here’s a plain-English guide to agent sandboxes and what SPACE does differently.
What’s in this guide
What Perplexity Released
In mid-October 2026, Perplexity open-sourced SPACE, the sandbox platform it uses to run every task in Perplexity Computer. As MarkTechPost reports, it’s written in Rust, self-hosted and released under the Apache 2.0 license.
Applications call a simple HTTP API to create Linux environments, run commands and stream output back to the agent.
Why AI Agents Need Sandboxes
Agents increasingly run code, install packages, browse sites and handle files. If that happened directly on your servers, one bad instruction — or a malicious web page tricking the agent — could damage real systems or leak secrets. A sandbox gives each task its own disposable computer, walled off from everything else.
A sandbox gives every agent task its own disposable computer, walled off from everything else.
How SPACE Works
MicroVM per task
Each sandbox runs in its own Firecracker microVM with a separate kernel — stronger isolation than a shared container.
Secrets stay outside
Credentials are injected at the network layer, so they never enter the sandbox.
Egress gateway
A per-sandbox network gateway enforces which sites the agent may reach.
Pause & resume
Sandboxes can be paused, suspended to a snapshot, and restored later.
A template defines the starting filesystem; a sandbox is a running copy with its own VM and disk. Idle sandboxes suspend after six hours by default. Perplexity says median creation time dropped from 185 ms to 60 ms compared with its previous provider.
What the Red-Team Tests Found
Perplexity published security results from 216 runs across 9 AI models that had root access inside the sandbox:
| Test | Result |
|---|---|
| Escape from VM to host (108 runs) | No successful escape |
| Network policy bypass, before fixes | 11 of 54 partial-network runs bypassed egress rules (DNS spoofing, shared CDN IPs) |
| Network policy bypass, after fixes | No verified bypass in retest |
| Third-party sandboxes tested | 8 of 10 had at least one network-policy bypass |
Perplexity’s own testing; not independently verified.
The lesson is instructive: AI models with root access actively probed for ways out, and the weak point wasn’t the VM — it was the network rules. Perplexity fixed this with source-address validation and TLS termination with hostname checks.
SPACE vs Other Agent Sandboxes
SPACE joins other open sandbox projects such as E2B, microsandbox and Daytona, most of which also rely on microVMs. Its standout feature is the per-sandbox gateway with TLS termination, and it offers an E2B-compatible wrapper to ease migration.
Requirements: a Linux x86_64 host with KVM, btrfs and Docker. macOS isn’t supported, and running inside a VM needs nested virtualization. A reference AWS EKS deployment is included.
Who Should Use It
- Teams building agents that execute code and want to self-host instead of paying per sandbox.
- Security-sensitive companies that need secrets to stay outside the agent’s environment.
- Platform engineers who already run Kubernetes and Linux infrastructure.
If you just use agents rather than build them, SPACE matters indirectly: it’s a sign that strong isolation is becoming standard — and a good question to ask any agent vendor is “where does my agent’s code run, and what can it reach?”
FAQ
What is Perplexity SPACE?
An open-source, self-hosted sandbox platform that runs AI agent tasks in isolated Firecracker microVMs. It powers Perplexity Computer.
Is SPACE free?
Yes, it’s released under the Apache 2.0 license. You pay only for the infrastructure you run it on.
Does SPACE run on a Mac?
No. It needs a Linux x86_64 host with KVM.
Why not just use Docker containers?
Containers share the host kernel; microVMs give each task its own kernel, which offers stronger isolation for untrusted, AI-generated code.
Related Reading on FutureLume
- Computer-Use AI Agents in 2026: Which Tools Can Actually Control Your Screen
- OpenAI’s Agents API Explained: What It Means for Teams Building AI Agents
SPACE is a useful, free building block for anyone running AI agents that execute code. Its red-team results also carry a broader lesson: agents will probe their boundaries, and network controls deserve as much attention as the sandbox itself.
Sources: MarkTechPost · Crypto Briefing
