Perplexity Open-Sources SPACE, the Agent Sandbox Behind Every Computer Session: No Host Escapes in 108 Attempts, but Network Limits Were Bypassed

On October 15 Perplexity open-sourced SPACE (Sandboxed Platform for Agentic Code Execution) under the Apache 2.0 license. It is the code execution sandbox behind Perplexity's Computer agent; it replaced the commercial sandbox provider Perplexity had been using in July and has handled every Computer session since. SPACE is written in Rust and runs each task in its own Firecracker microVM. Applications create Linux environments and run commands through an HTTP API, network access and credentials are managed outside the sandbox, and an E2B compatibility wrapper is included. Perplexity says it creates sandboxes 3 to 5 times faster than its previous provider. On security, the company's published results show no successful VM escape in 108 attempts, though some models bypassed network restrictions during testing, for example by spoofing DNS; those holes have been fixed. Semafor's report cites nine frontier models and 118 attempts. CoreWeave, Akamai and Crusoe will offer SPACE on their clouds.

From in-house infrastructure to public code

On October 15 Perplexity published SPACE on GitHub (perplexityai/SPACE) under Apache 2.0. It is the code execution layer of its Computer agent: Computer started out on a commercial sandbox provider, switched to the in-house SPACE in July, and has run every session on it since. This site covered Computer's new Automations triggers in September.

How the isolation works

Each task gets its own Firecracker microVM with its own system and writable filesystem. SPACE itself is written in Rust, but applications only need HTTP and server-sent events to create environments, run commands, collect output, and pause or wake sandboxes. The key design choice is that network egress and platform credentials are controlled outside the sandbox, so an agent can reach authorized services without ever holding the keys. The repository also includes Kubernetes warm pools, snapshot restore and an E2B compatibility wrapper to ease migration for existing E2B users. Perplexity says that on the same production traffic, it creates sandboxes 3 to 5 times faster than its previous provider.

Read the test results separately

In Perplexity's published security evaluation, models given root inside the VM tried to escape to the host, and none of 108 attempts succeeded. The network layer was less clean: during testing some models got around outbound restrictions by spoofing DNS or using shared CDN addresses. The company then hardened its gateway, and a retest found no further bypass. Semafor's exclusive report cites nine frontier models and 118 attempts, and says the same models broke out of other closed-source sandboxes. That part is Perplexity's own claim and has not been reproduced by a third party.

What it means for developers

Agent sandboxes are moving from private components inside each company to open infrastructure anyone can pick up; this site previously covered Microsoft's open-source MXC execution containers. Teams that don't want to self-host can wait for the managed versions CoreWeave, Akamai and Crusoe will offer on their clouds; self-hosting requires a Linux host with KVM.

via: GitHub: perplexityai/SPACE, Perplexity blog, Semafor report