Perplexity open-sources SPACE, its sandbox for AI agents

Perplexity published the code for SPACE on Oct. 15, the system that keeps apart the code run by the agents in its Computer product, according to the company's blog. The GitHub repository uses the Apache 2.0 license, which allows anyone to use and modify it, including for commercial purposes.

A sandbox is a closed box where a program runs without access to the rest of the system. With agents that run code and browse on their own, it is what keeps a mistake or an attack from reaching the real machine. Each SPACE task runs inside a lightweight virtual machine with its own operating system. They are built with Firecracker, AWS's microVM technology. Credentials and the network are managed outside the sandbox.

All the security and performance figures come from Perplexity itself. In its September report, Escaping SPACE: Part I, the company tested nine AI models across 216 runs. None of the 108 attempts to break out of the virtual machine onto the host succeeded. Semafor cites 118 attempts, a difference that is not explained.

There were flaws in the network restrictions. In a test with partial network access, 11 of 54 runs managed to get out before the fix, through DNS spoofing and IP addresses shared on a content delivery network. Perplexity says it has fixed them.

According to the company, SPACE has carried all Computer sessions since July, and creating a sandbox is three to five times faster than with its previous provider, at the same traffic. That comparison has not been measured independently either. Akamai already offers it on its cloud, Crusoe will add it to its catalog and CoreWeave published setup guides.

For end users, little changes: SPACE is infrastructure deployed on Kubernetes, not an app. For teams putting agents into production, it is an open alternative they can audit. Still pending is someone outside Perplexity repeating the escape tests.