Perplexity Open-Sources SPACE: The Firecracker Sandbox Behind Perplexity Computer, Under Apache 2.0

Perplexity has open-sourced SPACE, the sandbox platform that runs every task in Perplexity Computer. The code is on GitHub under the Apache License 2.0. In the company's words on X, "SPACE gives each agent task its own Firecracker microVM and controls credentials and outbound traffic from outside the VM." If you build agents that execute code, this is a production-tested reference you can read, run and fork.

We covered SPACE twice before: when Perplexity joined the Rust Foundation to back it, and when its red-team report "Escaping SPACE: Part I" described how nine models tried to break out. What changed today is that you can now inspect the code.

Quick reference

What the repository contains

According to the repository README, SPACE "is a sandbox platform for running code in isolated Firecracker microVMs. Applications use its HTTP API to create Linux environments, execute commands, collect output, and manage sandbox lifecycles."

The model has three nouns. A template supplies the starting environment. A sandbox is an instance of that template with its own VM and writable filesystem, and multiple commands can run inside it. A command session streams output over a separate data-plane connection using a session-scoped attachment token. Lifecycle changes such as create, pause, suspend and delete are asynchronous: the API returns an operation ID that you poll.

Your application decides what to run and what results to keep. SPACE manages the sandbox, the processes and the connection carrying output. The repo is organized around Rust crates for services and libraries, gRPC protobuf definitions, Firecracker template recipes, a Kubernetes-based local development setup using Kind, and a reference EKS deployment. Documentation covers installation, an operator CLI, warm pools that keep booted sandboxes ready so creates skip a cold boot, base snapshots, egress profiles and observability.

Notably, the repository ships with CLAUDE.md, AGENTS.md and Claude skill folders, a sign that the project itself is developed with coding agents.

How SPACE keeps an agent contained

A mechanical gripper working inside a transparent dome, picturing an agent task running in an isolated microVM

Unite.AI's summary of the announcement reports Perplexity's design points:

• A VM per task. Each sandbox runs inside a small virtual machine with its own operating system, so the boundary between the agent and the host is a hypervisor, not a container namespace.
• The sandbox is untrusted. Network access and platform-held credentials are managed outside the sandbox, so an agent can reach authorized services without secrets sitting in its working environment.
• Snapshots and checkpoints. The platform stores changes rather than repeatedly copying whole environments, which supports pause, resume, recovery and branching. Perplexity gives examples such as pausing so a person can review a draft, or testing two ways to clean a dataset in separate copies.
• Layered controls. Perplexity says model safeguards reduce unsafe behavior but that independent controls in the surrounding system limit what an agent can reach if the safeguards fail. It also notes that agents pursuing legitimate tasks can still cross boundaries while working around missing files, failed requests or permission denials.

That last point is the core argument for putting the control plane outside the VM. Unite.AI also reports that Perplexity tested SPACE against network-bypass techniques like those used in the OpenAI and Hugging Face incident, which we covered in the post-mortem.

What the numbers are, and who said them

All figures below are Perplexity's own, as reported by Perplexity or by Unite.AI summarizing its announcement. We have not independently reproduced them.

• Scale: SPACE has powered all Computer sessions since July and handles millions of sandbox creations a day. Perplexity wrote on X on October 14 that SPACE has an error rate below 0.0002%.
• Speed: in a company comparison on the same production traffic, sandbox creation was three to five times faster than with the commercial provider it replaced.
• Security: nine frontier model configurations were given root inside the guest VM; no escape to the host in 108 attempts. Four configurations, with limited network access, bypassed restrictions through DNS spoofing or shared-IP routing; Perplexity says it fixed both and that neither technique worked in follow-up testing. The company also says it disclosed related weaknesses it found in other sandbox platforms to their vendors.

Two caveats are worth keeping in mind. First, 108 failed attempts by model-driven attackers is useful evidence but not proof of no escape, since it reflects what those agents tried. Second, one outlet reported a different attempt count in early coverage; the primary report says 108.

How it compares with what you may already use

SPACE lands in a crowded field. If you are choosing a sandbox for agents, the questions that matter are the isolation boundary, who controls credentials and egress, snapshot and branching support, and whether you can self-host.

• Container-based sandboxes are cheaper and faster to start but share a kernel with the host, which is exactly what the recent Vercel KVM zero-day reminded everyone to weigh. A microVM adds a guest kernel in between; it does not remove host-kernel risk.
• Managed offerings such as the Cloudflare Sandbox SDK trade control for convenience.
• Local VM approaches such as Capsem target developer machines rather than multi-tenant fleets.
• SPACE aims at the operator who needs to run many tenants' agent tasks and wants Apache-licensed code, an HTTP API, warm pools and an E2B-compatible surface.

For the larger picture of where sandboxes sit in an agent stack, see our guide to the agent harness.

Build, buy or self-host: what this changes

Perplexity's own history is the most useful data point here. Per Unite.AI, Computer launched in February on a commercially available sandbox provider, and in July the company replaced it with the in-house SPACE, citing robustness and resilience. A company that runs millions of sandbox creations a day found renting no longer fit. Most teams are nowhere near that scale, so the lesson is about trade-offs, not a recommendation to switch.

Running your own sandbox fleet shifts cost from per-execution fees to engineering time, hosts that support nested virtualization or bare metal, and on-call. The Vercel episode shows why that burden is real: host kernels need patching quickly when a network-stack bug turns into a guest-to-host escape. If you self-host, budget for kernel updates, for disabling features you do not need, and for continuous red-teaming rather than a one-off test.

A final point on trust. An open repository lets outsiders review the isolation design, but the 108-attempt result describes Perplexity's deployment and configuration, not every way you might run the code. Treat the published test as a starting point for your own threat model.

How to try it

1. Read the docs first. The hosted guide and API reference are linked from the repo. Start with Versioning and compatibility, then Architecture.
2. Run the local path. The README says to follow "Installation and configuration" to deploy SPACE in a local Kind cluster and authenticate, then "Your first sandbox" to run a command and collect its output. Check the host prerequisites in that guide before you start, since Firecracker needs a suitable host.
3. Use the Python example. The first-sandbox walkthrough uses a standard-library-only Python script against the HTTP API, so you do not need to embed Rust.
4. Test the E2B wrapper if you have existing E2B-based code. Read the supported-behavior and limitations section before trusting it.
5. Threat-model it yourself. Check what the template exposes, which egress profile applies, and what a compromised guest could reach.

What to watch

• Independent reviews of the code and the egress policy, now that outsiders can read it.
• Whether the "Agentic Runtime Platform" components that Perplexity says will follow SPACE are also released.
• Stability of the API: the README says fields marked incubating are outside the supported contract.
• How cloud partners price and package it.

If you run agents that execute code, the explainx.ai team's AgentBeam stops AI agents before they take dangerous actions.

Related reading

• Perplexity joins the Rust Foundation to back SPACE
• Escaping SPACE, Part I: the red-team report
• Vercel's KVM zero-day and agent sandboxes
• Cloudflare Sandbox SDK 1.0 for agents
• Capsem: VM sandbox for coding agents
• What is an agent harness?
• OpenAI and Hugging Face incident post-mortem

Details are accurate as of October 15, 2026, based on Perplexity's announcement, the GitHub README and reporting by Unite.AI. Performance and security figures are Perplexity's own.