Perplexity open-sourced SPACE, the sandbox software behind its Computer agent, on 15 October 2026 under the Apache License 2.0, Unite.AI reported. CoreWeave, Akamai and Crusoe have agreed to offer it to customers, Semafor reported. The release puts software Perplexity developed for its own agents in the hands of developers who need to let agents run code while limiting what that code can reach.
Key points
- SPACE runs agent code in isolated Firecracker microVMs and keeps platform-held credentials outside them.
- Perplexity says SPACE has handled every Computer session since July.
- Perplexity reported no virtual-machine escapes in its security tests; the two reports give different attempt counts.
- CoreWeave, Akamai and Crusoe have agreed to offer the software to customers.
SPACE keeps agent code in separate machines
SPACE stands for Sandboxed Platform for Agentic Code Execution. Its repository describes isolated Firecracker microVMs that give each sandbox its own operating system and writable filesystem. The distinction matters when an agent can run commands: its work takes place inside a small virtual machine rather than directly on the system hosting it. A template provides the starting environment, and the same sandbox can run multiple commands.
A central control plane manages the creation, suspension, resumption and removal of those workspaces. Perplexity treats the agent’s workspace as untrusted, keeping network controls and platform-held credentials outside it. That arrangement is intended to let an agent connect to authorised services without putting the credentials it needs into the environment where it runs code. SPACE also saves file snapshots and checkpoints of the running environment, storing changes rather than repeatedly copying the whole workspace.
Cleaning a spreadsheet could therefore involve calculations and charts in a separate workspace. If the work needed a pause for review, the saved files and running state could allow it to resume; a mistake could be addressed by returning to an earlier state. Perplexity describes those as possible uses of the capabilities it built into Computer.
The repository describes an HTTP API for creating Linux environments, running commands, collecting output and managing each sandbox’s lifecycle. Developers building on SPACE can use the same environment for successive commands, or branch a session into separate copies to try different approaches. Lifecycle operations run asynchronously: the API returns an operation ID that a caller checks for completion.
Computer moved to SPACE in July
Perplexity launched Computer in February 2026 using a commercial sandbox provider, then replaced that service with SPACE in July. The company says its own platform has powered every Computer session since the switch and handled millions of sandbox creations per day. Those are Perplexity’s figures for its production system, rather than a measurement of how the open-source release performs in another organisation’s deployment.
On the same production traffic, Perplexity said, creating a sandbox with SPACE was three to five times faster than with its previous provider. The comparison concerns the time taken to start the isolated workspace, a recurring operation when an agent begins a task. The company also describes pause-and-resume, recovery and session branching as capabilities used in Computer, where a session may need to preserve work through an interruption or return to an earlier file.
Perplexity’s case for controls around the model is that an agent pursuing an authorised task can still cross a boundary while trying to get past a missing file, a failed request or a permission denial. It says model safeguards can reduce unsafe behaviour, while restrictions in the surrounding system limit access if those safeguards fail. SPACE puts that second set of controls around code execution and network access.
Nine models tried to escape SPACE
Perplexity said it tested SPACE by instructing nine frontier models to attempt a breakout, Semafor reported. The publication reported that none escaped in 118 attempts. Perplexity also said its tests found that the agents could escape other sandboxes that were not open-sourced.
Unite.AI reported that Perplexity’s published security evaluation recorded no escape from a virtual machine to its host in 108 attempts. Some attempts did get around network restrictions, according to Perplexity. The company said it repaired those weaknesses and that neither identified attack method succeeded in follow-up tests. A virtual-machine escape and a way around a network rule test different boundaries, even when both are attempted from inside the same workspace.
The release arrives amid reports from AI labs of models getting past constraints and reaching the open web. A sandbox addresses that concern at the point where an agent acts: it restricts the environment in which code runs, rather than relying solely on instructions to the model. Perplexity says it alerted the companies behind other sandbox platforms to comparable security flaws it identified in their systems.
CoreWeave, Akamai and Crusoe will offer SPACE
CoreWeave, Akamai and Crusoe have agreed to offer SPACE to customers, Perplexity told Semafor. Developers can also inspect and adapt the code under its Apache licence. Perplexity argues that wider use and scrutiny can expose weaknesses and improve the controls around agents, while the company’s reported speed and security results come from its own comparisons and testing.
SPACE joins security tools Perplexity has released through its Secure Intelligence Institute. They include BrowseSafe, which Perplexity describes as a model and benchmark for spotting malicious instructions in web pages, and Numbat, a toolkit for investigating dangerous agent behaviour on computers. Bumblebee, which the company open-sourced in May, scans developer machines for risky software packages, extensions and AI tool configurations.
