Perplexity SPACE sandbox for AI agents goes open source

Perplexity released SPACE, the sandbox platform that runs its Computer agent, as open-source code on October 15, 2026. The code is on GitHub under the Apache 2.0 license, which allows commercial use. Any team that lets an AI agent run code can now host the same isolation layer Perplexity uses in production, instead of building or renting one.

SPACE stands for "Sandboxed Platform for Agentic Code Execution," according to Crypto Briefing. An AI agent is a program that uses a language model to take actions, such as writing and running code. A sandbox is a sealed-off space where that code can run without reaching anything it should not touch.

What SPACE does

The project's GitHub page describes SPACE as "a sandbox platform for running code in isolated Firecracker microVMs" in its README. Firecracker is open-source software developed by Amazon Web Services. It runs very small virtual machines, called microVMs, side by side on one host. Each one boots its own Linux kernel, so code inside it is walled off from the host machine, according to Techstrong.ai.

Programs talk to SPACE through an HTTP API, a web interface for creating Linux environments, running commands and managing their lifecycles. The README says SPACE is written in Rust. It also lists:

Part	What it does
HTTP API	Creates sandboxes, runs commands, streams output
space-admin-cli	An operator tool for running the platform
E2B Compatibility Wrapper	Lets code written for the E2B Python SDK use SPACE
Node warm pools	Keep machines ready so sandboxes start fast

The installation guide starts with a local Kind cluster. Kind runs Kubernetes, the popular container platform, inside Docker on one computer. The architecture guide says SPACE can also run without Kubernetes. Schema fields marked "incubating" sit outside the supported contract, so they may change.

How it keeps agents contained

Perplexity first described SPACE in a July 15 blog post. It said it built its own system because no ready-made option balanced features, speed and security.

Three ideas carry the design, according to that post:

• Throwaway machines. "SPACE spins up ephemeral sandboxes which only live as long as they're needed," the post says. A sandbox is destroyed when its task ends.
• Secrets stay outside. Passwords and access tokens are kept off the sandbox and supplied only when needed. "A compromised agent has no path to platform-managed credentials by default," Perplexity writes.
• Snapshots. Rolling snapshots save a session's memory and files as often as every minute. A session can be paused, resumed or split into several copies. Perplexity calls it "essentially a built-in time machine."

Enterprise customers can also bring their own encryption keys. If a customer revokes its key, new sandboxes cannot boot and stored data cannot be read.

The numbers Perplexity reports

The figures below come from Perplexity, as reported by the two outlets. No outside group has checked them yet.

Lapaas Voice reports that in Perplexity's security tests, nine AI models were given root access inside a sandbox. They then tried to reach a secret held on the host machine. None of 108 attempts escaped. The network rules fared worse at first: testers got around them with DNS spoofing and shared-IP routing. Perplexity fixed both, and neither worked in follow-up tests, Lapaas Voice says. Crypto Briefing dates the red-team exercise to September 2026.

On speed, the two reports give different measures. Crypto Briefing cites a median sandbox start of about 60 milliseconds, down from 185 milliseconds before. Lapaas Voice says sandboxes start three to five times faster than with Perplexity's previous commercial provider, which it does not name.

Lapaas Voice also names three early backers. Akamai has launched SPACE on its cloud, Crusoe is adding it to its managed AI services, and CoreWeave has published setup guidance. Crypto Briefing reports that Perplexity plans to expand SPACE as part of a broader "Agentic Runtime Platform."

What this means for developers

If your product runs code that an AI model wrote, SPACE is now a free option to test against paid sandbox services. Start with the Kind setup on one machine. Measure start times and cost on your own workload, not Perplexity's.

Teams already on E2B's Python SDK have the shortest path. The compatibility wrapper means you can point existing code at SPACE and compare. Check which calls the wrapper covers before you plan a full switch.

Check your hosts before you commit. Firecracker runs on KVM, the virtualization feature built into Linux, Techstrong.ai notes, so the machines you run SPACE on must offer it.

Copy the credential design even if you never install SPACE. Keeping tokens outside the sandbox and injecting them per request limits what a hijacked agent can steal. The same idea shows up in Microsoft Execution Containers, which reached general availability on October 7. That system confines agents on Windows, macOS and Linux machines, while SPACE runs fleets of them on servers.

Run your own attack tests. Perplexity's results are its own, and Lapaas Voice puts it plainly: "These are results from Perplexity's disclosed tests, not proof that SPACE is immune to every possible attack." The network rules were the weak point in those tests, so test outbound traffic limits first.