Perplexity open-sources SPACE, the sandbox running millions of agent tasks daily

The latest:

The sandbox platform that isolates every task inside Perplexity’s Computer agent is now publicly available, the company said in an October 15, 2026 blog post announcing the open-sourcing of SPACE. The platform has run all Computer sessions since July, when it replaced a commercial sandbox vendor. Perplexity said on X that the code is released under Apache 2.0.

Details:

• The architecture: Each sandbox runs inside a lightweight virtual machine with its own operating system, forming an isolation boundary between the agent’s work and the host, according to the blog post. A central control plane coordinates creating, pausing, resuming and tearing down sandboxes.
• The trust model: SPACE treats the sandbox as untrusted. Network access and the credentials the platform holds are managed from outside the box, so an agent reaches authorized services without credentials ever being stored in its own working environment, the company said.
• State handling: Frequent file snapshots and full-environment checkpoints preserve progress across interruptions, per the post. The platform stores only changes rather than copying whole environments, which Perplexity said cuts the work of creating, restoring and forking sessions.
• The capabilities: Perplexity listed isolated code execution, pause and resume, restore, and session forking as SPACE’s core functions — the operations an agent platform needs when a long-running task stalls, branches or has to be rewound.
• Scale and speed: SPACE has powered every Computer session since July, with millions of sandbox creations a day. On the same production traffic, sandbox creation ran 3 to 5 times faster than the previous vendor, the company said.
• The security test: A published security evaluation pitted agents deliberately trying to break SPACE’s boundaries. No escape from the virtual machine to the host was recorded across 108 attempts, according to the company. Some attempts did find ways around network restrictions.
• The fixes: Perplexity said it patched those network gaps, and neither of the two identified methods worked in follow-up testing. The company said SPACE also held up against bypass techniques resembling those in the OpenAI/Hugging Face incident, and that it notified other sandbox vendors of vulnerabilities it found in their products.
• The partners: Akamai tested SPACE, launched it on its cloud platform and is working with Perplexity to offer it to customers. Crusoe is adding it to its managed AI services portfolio. CoreWeave published setup guidance for developers wanting to deploy it for evaluation on CKS.
• The wider stack: SPACE joins earlier Perplexity security releases: BrowseSafe, a model and benchmark for detecting malicious instructions hidden in web pages; Numbat, an agent-behavior toolkit open-sourced in July; and Bumblebee, a May scanner for risky AI packages and configurations on developer machines.

Background:

Computer is Perplexity’s personal agent, launched in February. Until July its sandboxing ran on a third-party commercial provider; SPACE replaced it. The company’s Secure Intelligence Institute conducts its security research.

Between the lines:

The release reads as a bid to set the default containment layer for agentic AI. Perplexity is not only publishing code but citing 108 failed escape attempts, a 3-to-5x speed edge over the vendor it dropped, and vulnerabilities it reported in rival sandbox platforms — positioning SPACE as the reference implementation rather than one option among several. Three infrastructure partners shipping it the same week reinforces that reading.

What’s next

Watch whether the network-bypass fixes hold once external researchers probe the public repository, and whether Akamai, Crusoe or CoreWeave move SPACE from evaluation into general availability for customers.