Perplexity Open-Sources SPACE, the Sandbox Behind Its Computer Agent

Quick Facts

• Perplexity open-sourced SPACE on October 15, 2026 under the Apache License 2.0, giving developers access to the sandbox platform behind its Computer agent product.
• Since replacing its third-party sandbox provider in July, SPACE has handled millions of sandbox creations per day, with median creation latency dropping from 185 ms to 60 ms.
• A September 2026 red-team exercise made 108 exploitation attempts against SPACE and achieved zero successful escapes from the sandboxed environment.

Perplexity AI released SPACE, its in-house sandbox platform for AI agents, to the public on October 15, 2026. The code is available on GitHub under the Apache License 2.0.

SPACE stands for Sandboxed Platform for Agentic Code Execution. Perplexity built SPACE to power Computer, its personal agent product launched in February 2026. The company initially used a commercial sandbox provider and replaced it with SPACE in July after building the platform in-house.

The platform runs code inside isolated Firecracker microVMs. Each sandbox gets its own virtual machine and writable filesystem. Developers interact with SPACE through an HTTP API and server-sent events rather than a language-specific library. The project is written in Rust and includes an E2B compatibility wrapper tested against the E2B Python SDK.

Production Numbers

SPACE went into production in June 2026. Since July, it has processed millions of sandbox creations per day and tens of millions of reconnect events. Compared to the prior commercial provider on the same production traffic, sandbox creation is three to five times faster.

Median creation latency fell from 185 ms to 60 ms. The 90th-percentile latency dropped from 447 ms to 89 ms. Early tests on the NVIDIA Vera CPU showed up to 1.9x faster sandbox starts, according to NVIDIA AI Infrastructure.

Security Architecture

SPACE treats every sandbox as untrusted by design. Network access and platform credentials are managed outside the sandbox. Credentials are injected only when needed and are never stored inside the VM.

The platform supports bring-your-own-key encryption. It uses two snapshot types: disk snapshots that run frequently without pausing the VM, and full checkpoints that capture paused VM state including memory and running processes. When a session suspends, Perplexity uploads the full checkpoint to object storage and marks it restorable only after every artifact has transferred.

Perplexity ran a red-team exercise in September 2026 in which testers made 108 attempts to break out of the sandbox. None succeeded. A small number of network-policy issues surfaced during the exercise and were patched.

Perplexity also evaluated nine large language models as autonomous agents on escape tasks. No model succeeded in breaking out of SPACE, even when given access to the platform's source code, web search tools, and the ability to install software packages. Four models bypassed network rules in 11 of 54 runs before Perplexity fixed a gateway vulnerability.

The company tested the same attack methods against third-party sandboxes. A shared-address exploit bypassed seven of nine commercial sandboxes tested, including E2B, Vercel, Modal, and Daytona. Cloudflare and NVIDIA OpenShell held.

Why It Matters for Developers

Zibi Braniecki, a member of technical staff at Perplexity, has described the open-source release as a foundation-building effort. "A lot of companies are thinking about how to build secure AI agents, and in many cases they hit a wall," Braniecki said. "We have a solution."

Braniecki compared the move to the early development of web browsers, where companies built shared security infrastructure to enable safe browsing and commerce at scale. "Right now, we're thinking too small," he said.

Perplexity's blog framed the release as an industry contribution: "Today, we're open-sourcing SPACE to give developers a foundation for building safer agent systems and contributing to stronger protections across the industry."

For software companies building or evaluating agentic products, SPACE offers a tested alternative to commercial sandboxes with published performance benchmarks and a documented security record. The Apache 2.0 license allows commercial use without royalties.