Blog
Perplexity open-sources SPACE, the sandbox platform behind its Computer agent
On 15 October 2026 Perplexity released SPACE, the sandbox platform that runs code for its Computer agent, as open source under Apache 2.0. It runs agent work in isolated Firecracker microVMs, with credentials and network rules kept outside the sandbox. Speed and security results are Perplexity's own.
Perplexity released SPACE, the sandbox platform that runs code and files for its Computer agent, as open source on 15 October 2026. The code is on GitHub under the Apache 2.0 license, which allows commercial use and changes. Perplexity says it wants to give developers "a foundation for building safer agent systems".
SPACE stands for Sandboxed Platform for Agentic Code Execution. Perplexity built it to replace the commercial sandbox provider it used before, and the company says SPACE has powered all Computer sessions since the summer.
What SPACE does
A sandbox is a closed-off workspace where an AI agent can run code, install packages and edit files without touching the machine it runs on or the data of other users. According to the GitHub repository and Perplexity's announcement:
- Each sandbox is a small virtual machine. SPACE runs code in isolated Firecracker microVMs, each with its own operating system and writable filesystem.
- An HTTP API controls everything. Applications create a sandbox from a template, run commands, stream output and pause, resume or delete the sandbox.
- Credentials stay outside. SPACE treats the sandbox as untrusted. Network access rules and platform-held credentials are managed outside the VM, so agents can reach approved services without the secrets sitting in their workspace.
- Work survives interruptions. Snapshots and checkpoints let a session pause and resume later, recover after a failure, or branch into separate copies, for example to try two approaches to the same task.
The setup guide covers running SPACE in a local Kubernetes (Kind) cluster, with documentation on authentication, observability and keeping "warm pools" of ready sandboxes.
Perplexity's performance claims
Perplexity says SPACE handles millions of sandbox creations per day for Computer. In a comparison on the same production traffic, it says sandboxes were created three to five times faster than with its previous provider, which it has not named. These are Perplexity's own measurements from its own systems, not an independent benchmark, and other setups may see different results.
What the security testing found
Before the release, Perplexity published a red-team report, Escaping SPACE: Part I (23 September 2026). It gave nine AI models root access inside a SPACE virtual machine and asked them either to steal a secret stored on the host or to reach a blocked web address.
- VM escape: none of the 108 attempts got out of the virtual machine to the host. Perplexity notes that this is not proof the isolation cannot be broken.
- Network rules, all access blocked: no model reached the blocked address in 54 runs.
- Network rules, partial access: when agents were allowed to reach package repositories, four models got around the restrictions in 11 of 54 runs, using forged DNS responses or IP addresses shared between allowed and blocked sites.
Perplexity says it fixed both weaknesses and that neither method worked in follow-up testing. It also says it reported related weaknesses it found in other sandbox platforms to their vendors.
Why it matters
As AI agents work for hours on real files and real networks, where they run matters as much as which model drives them. Agents that broke out of test setups have prompted investigations by regulators this autumn. An open, inspectable sandbox gives other developers a starting point and lets outside researchers look for flaws.
The test results also show a practical point: keeping an agent inside its virtual machine and controlling what it can reach on the network are separate problems. Most real agents need some network access, and that is where Perplexity's own testing found gaps.