Perplexity open-sources SPACE: Three boundaries to examine in an agent sandbox

On October 15, 2026, Perplexity released its agent sandbox platform SPACE (Sandboxed Platform for Agentic Code Execution) under the Apache 2.0 license. According to the company, SPACE is an internal system that has run Perplexity Computer tasks since July. It launches a separate Firecracker microVM for each task, while network access and credentials are managed outside the sandbox.

1. Give each sandbox its own operating system

Each SPACE sandbox is a small virtual machine with its own operating system. Even when an agent executes commands and installs packages, a boundary exists between it and the host system. A central control layer handles sandbox creation, suspension, resumption, and deletion.

Perplexity believes model safeguards alone are insufficient. Its design places independent controls outside the system as well, limiting the scope of damage even if safeguards fail.

2. Keep credentials outside the sandbox

The company explains that it treats the sandbox as an untrusted space. An agent can access authorized services, but credentials are not stored inside the work environment. Developers building agents themselves should first check where credentials are placed.

Snapshots and suspension also warrant attention. Because a running environment can be saved and then restored or branched, these features are convenient for long-running agent tasks.

3. Read the published security figures in two categories

Perplexity stated that, in a public security evaluation, none of the 108 attempts by agents to escape the virtual machine and reach the host succeeded. In the same evaluation, some attempts bypassed network restrictions, and the company says it fixed this issue.

Therefore, zero escapes is a result concerning the virtual-machine boundary, while the network policy had cases of actual compromise. The company’s performance comparison—a 3–5× improvement in sandbox creation speed—was not independently measured, so it should be treated only as a reference figure.

4. Checklist to review before adoption

① Confirm that outbound network policies and credentials are managed outside the sandbox.

② Consider whether suspension, snapshot, and branching features are actually necessary for your workflow.

③ Check the original source to see what attack conditions were tested in the security evaluation. Threats outside the test scope must be blocked separately.

Related article: Workday headless AI agents: What to check in a structure that works without login ↗

Sources: Perplexity, Open-sourcing SPACE, the sandbox platform behind Computer (October 15, 2026) ↗, GitHub, perplexityai/SPACE ↗

This English edition was written and translated with AI assistance, with sources provided. For errors or additional information, please request a correction. Editorial policy