Perplexity has open-sourced the sandbox technology behind its Computer AI agent, giving developers access to the infrastructure it uses to isolate autonomous AI agents while they execute commands, install packages, and interact with external services.
The company released SPACE on October 15 under the Apache 2.0 license, saying the move will help developers build safer autonomous AI systems.
SPACE, which stands for Sandboxed Platform for Agentic Code Execution, was developed by Perplexity as an in-house replacement for the commercial sandbox provider previously used by Computer. According to the company, SPACE has powered every Computer session since July and has handled millions of sandbox creations per day.
Perplexity also describes SPACE as the first component of its Agentic Runtime Platform, which is being developed to provide infrastructure for running autonomous AI agents.
How Perplexity’s SPACE Sandbox Works
Each SPACE environment runs inside a Firecracker microVM, giving every agent task its own virtual machine and operating system. The agent can have root access inside that environment, while the host system remains outside its control. Perplexity also manages network access and platform credentials outside the virtual machine, allowing the company to control what an agent can reach.
The sandbox is built for long-running AI tasks, as a SPACE environment can remain active after the request that created it has ended. It can be paused, resumed, suspended or restored from a snapshot, and this allows an agent to continue working without starting a new environment each time it needs to perform another task.
SPACE is implemented in Rust, while applications interact with it through an HTTP API and server-sent events. The platform also includes an E2B Compatibility Wrapper that allows existing E2B clients to use SPACE as their sandbox backend.
Perplexity Tested SPACE Against AI Models
Security testing was a major part of Perplexity’s development of SPACE. The company said it asked nine frontier AI model configurations to attempt to escape their virtual environments and reach the host system. Across 108 escape attempts, none of the models successfully reached the host, according to Perplexity’s published research.
However, the testing did uncover problems with network restrictions. Perplexity reported that some models were able to bypass a partial network policy through techniques involving forged DNS responses and IP addresses shared with other services. And the company said it fixed the issues and repeated the tests.
SPACE Will Be Available Beyond Perplexity
Cloud providers are also working with Perplexity to make SPACE available to their customers, but they are at different stages. Akamai has already launched SPACE on its cloud platform, while Crusoe is bringing it to its Managed AI Services portfolio. CoreWeave has published a deployment guide for SPACE, but its installation path is described as a development and evaluation setup rather than a production deployment.
The release comes as AI agents are being given more ability to execute code and perform tasks with less direct human involvement. As such, Perplexity’s decision puts the security layer used by its own Computer agent into the hands of developers and security researchers who can inspect, test, and contribute to the project.
