Perplexity Open-Sources SPACE, Its In-House Agent Sandbox Platform

Perplexity announced on October 15, 2026 that it is open-sourcing SPACE, the sandbox platform behind its Computer personal agent, releasing the code under the Apache License 2.0 with a public repository and hosted documentation.

From Commercial Provider to Open Source

Perplexity launched Computer in February and initially relied on a commercially available sandbox provider. In July, the company replaced that provider with what it described as a more robust and resilient in-house solution named SPACE. Perplexity said SPACE has powered all Computer sessions since July and has handled millions of sandbox creations per day. In a company comparison on the same production traffic, sandbox creation was three to five times faster than with the previous provider, Perplexity reported.

The company said it is open-sourcing SPACE to give developers a production-tested foundation for agent runtimes, with isolation, state recovery, and credential and network controls built in. Perplexity framed agent governance as an engineering problem and said open source is essential to solving it, arguing that developers who can inspect, adapt, and build on a system find more weaknesses and develop better tools.

Isolation and Session Controls

Each SPACE sandbox runs inside a small virtual machine with its own operating system, creating an isolation boundary between the agent’s work and the host system, while a central control plane coordinates when workspaces are created, paused, resumed, or removed. The platform treats the sandbox as untrusted, managing network access and platform-held credentials outside the sandbox so agents can connect to authorized services without those credentials stored in their working environment.

Frequent file snapshots and checkpoints of the full running environment preserve progress across interruptions. To keep those operations efficient, SPACE stores changes rather than repeatedly copying entire environments, reducing the work needed to create, restore, or branch a sandbox.

In Computer, SPACE supports isolated code execution, pause and resume, recovery, and session branching. Perplexity said those capabilities provide the foundation for assistants that could clean a spreadsheet, run calculations, and create charts in a separate workspace; pause so a person can review a draft or supply missing information, then resume with files and running state preserved; or test two ways to clean a dataset in separate copies of a workspace and restore an earlier file after a mistake.

Perplexity said agents pursuing legitimate tasks can still cross security boundaries when they attempt to work around missing files, failed requests, or permission denials. The company said it pairs model safeguards, which reduce the likelihood of unsafe behavior, with independent controls in the surrounding system that limit what an agent can access and contain damage if the safeguards fail.

Security Evaluation

Perplexity said a recent barrage of security testing showed SPACE resilient against network-bypass techniques like those used in the OpenAI/Hugging Face incident. In the company’s published security evaluation, which tested the platform against agents deliberately trying to breach its boundaries, testers recorded no escape from the virtual machine to the host in 108 attempts. Some attempts did find ways around network restrictions; Perplexity said it fixed those weaknesses and that neither identified attack method succeeded in follow-up testing. The company also said it disclosed related weaknesses it found in other sandbox platforms to their vendors.

SPACE joins a set of security tools Perplexity has released through its Secure Intelligence Institute, which the company described as an effort to conduct security research and collaborate with the wider community. The earlier tools include BrowseSafe, a model and benchmark for detecting malicious instructions hidden in web pages; Numbat, a security toolkit open-sourced in July that helps detect, investigate, and prevent dangerous agent behavior on computers; and Bumblebee, a scanner open-sourced in May that checks developer machines for risky software packages, extensions, and AI tool configurations.

Repository and Cloud Availability

SPACE, short for Sandboxed Platform for Agentic Code Execution, is published in a GitHub repository under the Apache License 2.0. The repository describes a platform that runs code in isolated Firecracker microVMs, with an HTTP API used to create Linux environments, execute commands, collect output, and manage sandbox lifecycles. A template supplies the starting environment, and a sandbox is an instance of that environment with its own virtual machine and writable filesystem; multiple commands can run in the same sandbox. Lifecycle changes are asynchronous, with the API returning an operation ID that the caller polls for completion, and command output travels over a separate data-plane connection using a session-scoped attachment token.

SPACE is implemented in Rust, but applications interact with it over HTTP and server-sent events rather than by embedding a Rust library. The project includes an E2B compatibility wrapper that works with a tested E2B Python SDK. Setup documentation covers deployment in a local Kind cluster and authentication, while the architecture guide explains how SPACE can run without Kubernetes. A hosted SPACE guide walks through installation, configuration, a first-sandbox workflow, and architecture, and a companion API reference lists endpoints, fields, and examples.

Perplexity said CoreWeave and Akamai have tested and launched SPACE on their respective cloud platforms and are working with the company to make SPACE available to their customers. Crusoe is also partnering with Perplexity to bring SPACE to its Managed AI Services portfolio on its cloud platform, the company said.