Perplexity open-sources SPACE, a sandbox platform for AI agents

AINew17 October 20261 min read

In brief

Perplexity has open-sourced SPACE, the platform that runs agent tasks in isolated Firecracker microVMs, under Apache 2.0 on GitHub. Credentials and outbound traffic are controlled from outside the guest VM, and median create latency in production dropped from 185 ms to 60 ms. In red-team testing, none of 108 VM-to-host escape attempts succeeded.

One Firecracker microVM per agent task
Credentials and egress controlled from the host
Open source on GitHub under Apache 2.0
Rust codebase, release 0.8.0; HTTP API and event streaming
Median create latency of 60 ms in production
All 108 escape attempts failed in red-team testing

What is SPACE?

Perplexity has open-sourced SPACE (Sandboxed Platform for Agentic Code Execution), the sandbox platform behind every task in Perplexity Computer. The code ships under Apache 2.0 on GitHub. The goal is to give teams building coding or browsing agents a production-tested isolation layer they can self-host.

How does it isolate agents?

Each agent task runs in its own Firecracker microVM with its own guest kernel. Credentials never enter the guest; they are injected at the network layer on the host. Every outbound connection passes through a per-sandbox gateway that enforces egress policy against an allowlist. Root filesystems are created with btrfs copy-on-write.

States and speed

Sandboxes move through four states: running, paused, suspended and deleted. Idle sandboxes suspend by default after 6 hours without activity. In production, 90th-percentile create latency fell from 447 ms to 89 ms, while median latency dropped from 185 ms to 60 ms.

Red-team results

Perplexity tested 9 models with root inside the guest. None of 108 VM-to-host escape attempts succeeded. Before fixes, however, agents bypassed the egress policy in 11 of 54 partial-network runs, using DNS spoofing and shared CDN IP addresses. After adding source-address validation and TLS checks against SNI and HTTP host, no model produced a verified bypass in the retest.

Requirements

SPACE is written in Rust and ships as release 0.8.0. It needs a Linux x86_64 host with KVM, /dev/kvm, btrfs and Docker; macOS is not supported. It exposes an HTTP API plus server-sent events.

Why it matters

As agents increasingly touch live systems, Perplexity's production-tested isolation layer offers teams building their own agents a concrete security reference they can self-host.

Sources

MarkTechPostFirst reported by
Perplexity Open-Sources SPACE, a Firecracker MicroVM Sandbox for AI Agents

#AI agents #open source #sandbox #cybersecurity #Firecracker