Perplexity Open-Sources SPACE, a Firecracker MicroVM Sandbox for AI Agents

Why it matters

Perplexity has released SPACE, its sandbox platform for agentic code execution, as open source under Apache 2.0 on GitHub. The system underpins Perplexity Computer and gives each agent task its own Firecracker microVM, with credentials and outbound traffic policy enforced outside the guest so that secrets never enter the VM. The Rust codebase exposes an HTTP API with server-sent events and requires a Linux x86_64 host with KVM, btrfs and Docker; macOS is not supported. Sandboxes can be paused or suspended, with warm pools and base snapshots used to speed creation. In Perplexity's red-team testing, no sandbox escape attempts reached host-side secrets, though several frontier models found egress-policy bypasses through DNS spoofing and shared CDN addresses before fixes were applied. Perplexity responded with source-address validation and gateway-level TLS termination, after which no model produced a verified bypass. The company also tested third-party sandbox platforms and disclosed bypass findings to affected vendors. The release gives teams building coding or browsing agents a production-tested isolation layer they can self-host.