Perplexity open-sourced SPACE on October 15, 2026. It is the sandbox platform that has run every session of its Computer agent since July, and the code is now on GitHub under Apache 2.0.
The announcement is short. The useful part is in the security report Perplexity published a month earlier, and in the repo's install guide. Here is what happened, why people care, and what most of the coverage skipped.
What happened (facts)
- What it is. SPACE stands for Sandboxed Platform for Agentic Code Execution. Each sandbox is a Firecracker microVM with its own OS. A central control plane creates, pauses, resumes and removes sandboxes.
- Trust model. The sandbox is treated as untrusted. Network access and platform-held credentials are managed outside it, so an agent can call authorized services without the keys ever living in its workspace.
- State. Frequent file snapshots plus checkpoints of the full running environment. It stores diffs instead of copying whole environments, which is what makes pause, resume and branching cheap.
- Scale claims. Perplexity says it handles millions of sandbox creations per day, and that creation was 3 to 5 times faster than its previous provider on the same production traffic.
- Interface. Written in Rust, used over HTTP and server-sent events. Lifecycle calls return an operation ID you poll.
- Early adopters. Akamai has launched it on its cloud, Crusoe is adding it to Managed AI Services, and CoreWeave published setup guidance for CKS.
Why people care
Agents that run code need somewhere to run it. Until now most teams rented that from a hosted sandbox provider or glued together containers. A production sandbox with recovery and egress control built in, under a permissive license, is a real option to self-host.
What the coverage skipped
1. The VM was not the weak point. The network was. In "Escaping SPACE: Part I", nine models got root inside a guest VM. Across 108 escape runs, none reached the host. But with partial network access (package mirrors allowed), four models got past the egress policy in 11 of 54 runs. Two tricks: forging a DNS reply so an allowed hostname mapped to a blocked IP, and using a shared CDN IP to reach a different service behind it. Perplexity fixed both (source-address validation, plus TLS termination that checks SNI and Host against the allowlist), and neither worked in the retest.
2. It is not just Perplexity's problem. The same report tested ten other sandbox platforms. Eight had at least one network-policy bypass. Vendors responded with fixes, documentation changes, or both.
3. You need real hardware access to run it. The install guide asks for a Linux x86_64 host with /dev/kvm, /dev/net/tun, loop devices, btrfs and Docker with privileged containers. It does not run directly on macOS, and a cloud VM must support nested virtualization.
4. The E2B compatibility wrapper is partial. There is an E2B-compatible API, but create options like mcp, volumeMounts and iam are listed as unsupported, and unsupported endpoints return 501. Fields marked "incubating" sit outside the supported contract.
What it could change (prediction, not fact)
Our read: the biggest effect is on how people judge sandboxes, not on who hosts them. "Is it a microVM?" stops being enough. The question becomes "what does your egress gateway trust, and has anyone attacked it with an agent?" Expect more vendors to publish agent red-team results, because Perplexity just set that bar.
A practical check for your own setup
If your agents run with a domain allowlist, test this today:
# from inside the sandbox: allowed host as SNI, different Host header
curl -sv https://pypi.org/ -H "Host: some-other-tenant.example" -o /dev/null
If the gateway only checks the destination IP, a request like this can reach a tenant you never allowed. Pass/fail tells you whether you need TLS-aware egress rules.
Sources
- Perplexity, Open-sourcing SPACE (Oct 15, 2026): https://www.perplexity.ai/hub/blog/open-sourcing-space
- Repository: https://github.com/perplexityai/SPACE
- Escaping SPACE: Part I (Sep 23, 2026): https://www.perplexity.ai/hub/blog/escaping-space-part-i
- Install guide: https://github.com/perplexityai/SPACE/blob/main/docs/installation.md
Which boundary does your agent setup trust more today: the VM or the network rules?
This post was drafted with AI assistance and edited and fact-checked against the sources above by the Clydara team.
Top comments (0)