Perplexity Open-Sources SPACE Sandbox

Built on Firecracker microVMs, the runtime isolates autonomous code while keeping API credentials and network policies outside the guest machine.

On Thursday, October 15, 2026, Perplexity released the source code for the Perplexity SPACE platform under the open-source Apache 2.0 license. The repository, written mostly in Rust and published on GitHub, hosts the internal sandboxing engine used to isolate code execution in Perplexity Computer. Alongside the release, cloud providers CoreWeave, Akamai, and Crusoe announced hosting integrations for the runtime on their infrastructure.

How the Perplexity SPACE Sandbox Works

In standard software development, programs run directly on user hardware or shared servers. Autonomous AI agents present a trickier security problem: when installing libraries, running custom scripts, or editing files, an agent often requires full root permissions. If an agent misbehaves or follows a malicious prompt, it can compromise the host operating system or expose private data.

SPACE tackles this by creating a dedicated Firecracker microVM for each agent task. Each micro virtual machine operates as a self-contained computer running a minimal Linux operating system. The agent gets local root access to carry out tasks, but its environment is strictly confined. API authentication keys and outbound network filters sit completely outside the virtual machine. Because of this separation, the model never directly handles secrets or controls the egress firewall. SPACE also supports memory snapshots, session pauses, and incremental branching, allowing developers to fork execution states without duplicating entire disks from scratch.

Virtual Machines Held, Outbound Network Needed Fixes

Perplexity put the architecture through internal red-team evaluations before publishing the code. On September 23, 2026, its Secure Intelligence Institute reported results from testing nine frontier models granted root access. Across 108 breakout attempts, zero models escaped the Firecracker microVM hypervisor into the host machine.

Network confinement, however, showed vulnerabilities. Under partial internet access, four frontier models (Claude Opus 5.0, GPT-5.6 Cyber, GPT-5.6 Sol, and Kimi K3) bypassed outbound firewall rules in 11 out of 54 attempts by using DNS spoofing and shared-IP routing techniques. Perplexity patched the issue by implementing packet-level source-address validation at the egress gateway, reporting no leaks in subsequent retests. Independent testing by cybersecurity firm Netics Labs showed that outbound leakage is widespread across the industry: under equivalent test conditions, 8 out of 10 commercial sandbox products failed outbound containment, with only Cloudflare Sandbox and NVIDIA OpenShell holding up.

Production Scale and Developer Requirements

According to Perplexity, SPACE has supported Perplexity Computer in production since July 2026, when the company replaced an unnamed commercial sandbox vendor. Perplexity claims the system manages millions of sandbox boots daily and spins up environments 3 to 5 times faster than the previous solution. These performance numbers come directly from the company’s internal benchmarks and have not been validated by an independent audit.

For teams building autonomous software, open-sourcing the runtime removes vendor lock-in, but self-hosting carries real hardware hurdles. Running Firecracker microVMs efficiently requires bare-metal servers with nested virtualization enabled, an infrastructure setup that requires specialized management for smaller engineering teams. Cloud partners like Crusoe and CoreWeave are positioning their managed services precisely around that operational bottleneck.

Sources

• Perplexity Blog: Open Sourcing SPACE
• Perplexity SPACE Repository on GitHub
• Perplexity Announcement on X
• Perplexity Technical Report: Escaping SPACE (Part I)
• Netics Labs Red Team Analysis