Perplexity open-sources SPACE, the Firecracker sandbox behind its Computer agent

What Perplexity released on 15 October

Perplexity announced the release in a thread on X and a blog post titled Open-sourcing SPACE on 15 October 2026. The code is in a public GitHub repository under the Apache License 2.0, with a hosted guide and API reference. SPACE stands for Sandboxed Platform for Agentic Code Execution.

The company frames the release around agent safety rather than developer convenience. Perplexity launched Computer, its personal agent, in February. The blog says it initially used a commercial sandbox provider and replaced it in July with an in-house system it named SPACE. According to Unite.AI's summary of the announcement, Perplexity says SPACE has powered every Computer session since then, handles millions of sandbox creations per day, and created sandboxes three to five times faster than the previous provider on the same production traffic. Those are Perplexity's own figures; AI Lookout has not measured them.

Perplexity's stated reason for opening the code is that agent governance is an engineering problem and that systems people can inspect get stronger. The X thread calls SPACE the first component of what it calls its Agentic Runtime Platform, which suggests more pieces may follow, though the company has not said which.

How SPACE works: templates, microVMs and a separate data plane

The repository README and the SPACE introduction describe a simple model. A template supplies the starting filesystem and runtime configuration. A sandbox is an instance of that template with its own virtual machine and writable filesystem. Several commands can run inside the same sandbox, and they share its environment and files.

Each sandbox is a Firecracker microVM. Firecracker is the lightweight virtual machine monitor that creates small VMs with their own kernel, which is a stronger boundary than a container that shares the host kernel. That matters for agents, because an agent with a shell can install packages, run arbitrary code and try things its developer never expected.

The architecture guide separates three things that are easy to blur: the sandbox, the lifecycle operation that created or changed it, and the command stream carrying its output. The API records desired state in PostgreSQL, and controllers and worker services reconcile the running system with that state, so an accepted request is not a readiness signal. Lifecycle changes are asynchronous: the API returns an operation ID that the caller polls.

Command output travels on a separate data-plane connection. Management requests use an API bearer token, while each command stream uses its own session-scoped attachment token, and the guide stresses that the two are not interchangeable. SPACE itself is written in Rust, but applications talk to it over HTTP and server-sent events, so there is no Rust library to embed.

Pause, suspend and branch: why agent sandboxes need state

Perplexity's thread makes the point that agent work in Computer is long-running, stateful and branching, and has to survive restarts. A SPACE sandbox outlives the request that created it and the connection carrying its output.

The architecture guide spells out the lifecycle states. A running sandbox can execute processes. A paused sandbox keeps its VM memory resident and its filesystem on the worker, which is fast to resume but is not a durable snapshot. A suspended sandbox stores a snapshot of VM memory, runtime state and root filesystem and releases active VM resources; waking it restores that state. By default, sandboxes created through the SPACE API suspend after six hours without access or command activity, which the docs describe as an idle limit, not a maximum lifetime.

The blog gives practical examples of what this enables in Computer: an assistant that cleans a spreadsheet and builds charts in its own workspace, pauses so a person can review a draft or add missing information, then resumes with files and running state intact; or one that tries two ways to clean a dataset in separate copies of a workspace and restores an earlier file after a mistake. Perplexity says SPACE stores changes rather than copying whole environments, which keeps creating, restoring and branching sandboxes cheap.

Credentials and network access stay outside the VM

The security design treats the sandbox as untrusted. Perplexity's thread says agents in Computer run commands, install packages and call external services with root access inside the sandbox, while the host stays outside the guest's control. A per-sandbox gateway enforces egress policy on every outbound connection.

Platform-held credentials are also managed outside the VM, so an agent can reach services it is authorised to use without the secrets sitting in its working environment. That addresses a common failure in agent setups, where an API key copied into the workspace can be read, logged or exfiltrated by whatever code the agent runs.

In the local Kind deployment the guide documents, sandbox pods run in their own namespace, apart from the control plane. Network policies admit only the API and cluster controller on the port they use, and limit sandbox egress to the public IPv4 internet and cluster DNS. Operators can also restrict which storage buckets new template artifacts may come from.

Perplexity's blog argues that agents pursuing legitimate tasks can still cross security boundaries when they try to work around missing files, failed requests or permission errors. Its answer is to pair model safeguards with independent controls in the surrounding system, so the damage is contained if the model safeguards fail.

The security test: 108 escape attempts

Perplexity tested SPACE by attacking it with frontier models. In research it calls Escaping SPACE: Part I, the company says nine model configurations with root inside the VM made 108 escape attempts and none reached the host.

The result is not a clean sweep on every boundary. Unite.AI's report says some attempts found ways around network restrictions, that Perplexity says it fixed those weaknesses, and that neither identified method succeeded in follow-up testing. Perplexity also says it disclosed related weaknesses it found in other sandbox platforms to their vendors, without naming them in the material we read.

This is a vendor-run evaluation. It is useful because it tests the right thing, capable models deliberately trying to break out, but it is not an independent audit, and 108 attempts is a modest sample. Open code is what makes outside verification possible, and that is the part to watch.

How to try it, and who is hosting it

The installation guide deploys SPACE into a local Kind cluster (Kubernetes in Docker), publishes a starter template called seed:latest and walks through authentication. The first-sandbox walkthrough then creates a sandbox, runs a command, reads its output and deletes it using a Python example that needs only the standard library: no SDK and no virtual environment.

Kubernetes is not mandatory. The architecture guide describes a direct adapter that calls worker services without creating Kubernetes sandbox pods, and the repository includes a reference AWS EKS deployment. There is also an E2B compatibility wrapper, a separate API surface that translates E2B-style requests, so teams already using the tested E2B Python SDK can point it at their own SPACE deployment. The wrapper uses different lifecycle names: its pause maps to SPACE suspend.

On hosting, Perplexity says CoreWeave and Akamai have tested and launched SPACE on their clouds and are working to offer it to customers, and that Crusoe is partnering to bring it to its Managed AI Services portfolio, according to Unite.AI's account of the announcement. We have not seen those providers' own product pages.

Where SPACE fits among agent sandboxes

SPACE lands in a crowded month for agent isolation. AWS opened Strands Box, a Dogwood-powered agent sandbox for Apple silicon, GitHub made Copilot local sandboxing generally available, and NVIDIA released OpenShell for agent runtime controls. Our explainer on agent sandboxing covers why limiting what automated code can reach matters.

What sets SPACE apart is scale of prior use and the server-side focus. It is not a desktop sandbox for one developer; it is the multi-tenant platform a consumer agent product says it runs at millions of sandboxes a day, now published with its control plane, workers and deployment recipes. For teams building their own agent products, that is an alternative to renting sandboxes from a commercial provider.

It is also part of a pattern at Perplexity of releasing infrastructure. Earlier this month it shipped MIT-licensed ColBERT embedders, and Unite.AI notes earlier security releases through its Secure Intelligence Institute, including BrowseSafe, Numbat and Bumblebee.

Limits and open questions

Running SPACE yourself is real infrastructure work. The local path needs a Linux host with virtualisation support for Firecracker, a Kind cluster and several services; production means Kubernetes or the direct adapter, object storage for templates and snapshots, and PostgreSQL. The docs mark some schema fields as incubating and outside the supported contract.

Several claims rest on Perplexity's word for now: the speed comparison with its former provider, the daily sandbox volume and the escape-test results. The blog page also blocked our direct fetch, so parts of this article rely on the company's X thread, its documentation and Unite.AI's detailed report. The open questions are which other Agentic Runtime Platform components Perplexity will release, whether outside researchers reproduce the escape results, and how the hosted offerings from cloud partners are priced.