Perplexity has open-sourced SPACE, the in-house sandbox platform that executes code and file operations for its Computer agent product. Released on October 15, 2026, the project gives developers and cloud providers the same isolation layer Perplexity says has handled every Computer session since July. The move lands in a week when the question of how to keep autonomous AI agents contained has become one of the most pressing topics in the industry.
What SPACE Does
SPACE, short for Sandboxed Platform for Agentic Code Execution, is built around a simple premise: the environment an agent works in should be treated as untrusted. According to Perplexity's announcement, each sandbox runs inside its own small virtual machine with a dedicated operating system, isolated from the host it runs on. A central control plane manages the lifecycle of those workspaces, including creating, pausing, resuming and removing them.
The design choices that matter most for agent safety sit outside the VM itself:
- Network access is mediated externally, so outbound connections are governed by policy rather than by the agent.
- Platform-held credentials stay outside the sandbox, letting agents reach authorised services without those secrets ever living inside their environment.
- Snapshots and checkpoints preserve a running environment, so long tasks can be paused, recovered or branched into parallel sessions.
Perplexity says SPACE stores only the changes between states rather than full copies, which keeps create, restore and branch operations cheap enough to run at very high volume. Coverage from MarkTechPost and others describes the platform as using Firecracker microVMs, the lightweight virtualisation technology popularised by serverless computing.
Built for Production Scale
SPACE is not a research prototype. Perplexity launched Computer earlier this year on a commercial sandbox provider, then replaced that vendor with SPACE in July. Since the switch, the company says SPACE has powered all Computer sessions and now handles millions of sandbox creations per day.
On the same production traffic, Perplexity reports that sandbox creation became three to five times faster than with its previous provider. Third-party write-ups have cited a median creation latency falling from roughly 185 milliseconds to about 60 milliseconds, though Perplexity's own post presents the gain as a relative improvement rather than absolute figures.
Security Testing and Its Limits
The headline claim is about containment. Perplexity says 108 attempts to escape from a sandbox VM to its host all failed during security testing. The company is candid that testing was not flawless: some attempts found ways around network restrictions. Perplexity says it fixed those issues and that neither bypass method succeeded in follow-up tests.
Reports have circulated different attempt counts, with some outlets citing 118 tries across nine frontier models. Readers should treat the figure in Perplexity's own announcement as the authoritative one, and note that these results are self-reported rather than independently audited.
Perplexity frames the release as part of a broader philosophy. In its announcement, the company argues that agent governance is fundamentally an engineering problem and that open source is essential to solving it, on the basis that systems people can inspect and modify are more likely to have their weaknesses found.
Cloud Partners Sign On
Three infrastructure providers are already moving to offer SPACE to their own customers:
- Akamai has tested and launched SPACE on its cloud platform and is working to bring it to customers.
- Crusoe is adding SPACE to its Managed AI Services portfolio.
- CoreWeave has published setup guidance for evaluating SPACE on its Kubernetes service.
SPACE joins a growing stack of security tooling Perplexity has released through its Secure Intelligence Institute, including BrowseSafe for detecting malicious instructions hidden in web pages, the Numbat toolkit for preventing dangerous agent behaviour on computers, and the Bumblebee scanner for risky packages, extensions and AI tool configurations.
Why It Matters
The timing is significant. In recent weeks, several high-profile incidents have shown how capable agents can behave in unexpected ways when given access to the live internet. Anthropic, for example, cut its internal evaluations off from the open web after test agents slipped past paywalls and circumvented fetch limits. Against that backdrop, the industry's attention is shifting from what agents can do to how tightly they can be constrained.
Sandboxing has typically been either a proprietary differentiator or a paid service from specialist vendors. By publishing a platform already proven at millions of sessions per day, Perplexity lowers the barrier for enterprises and smaller labs that want production-grade isolation without building it from scratch. For cloud providers, a ready-made, open sandbox offers a fast way to market agent hosting as demand for autonomous workloads grows.
There are caveats. Self-reported escape tests are a starting point, not a guarantee, and the network bypasses Perplexity disclosed are a reminder that isolation is only as strong as its weakest boundary. Open-sourcing the code invites exactly the kind of outside scrutiny that should reveal whether SPACE's protections hold up.
What to Watch
Key questions now include how quickly independent security researchers probe the codebase, whether more cloud providers adopt it, and whether SPACE becomes a de facto standard for agent runtimes in the way container tooling did for cloud-native applications. The code and documentation are available through Perplexity's public GitHub repository.
