Perplexity announced on October 15, 2026, that it was open-sourcing SPACE, the sandbox platform behind its Computer agent. The project runs code in isolated Firecracker microVMs and exposes an HTTP API; Perplexity’s security report separately records zero VM-to-host escapes and successful network-policy bypasses under partial access conditions. The repository identifies the project’s license as Apache License 2.0 (announcement; SPACE repository).
What developers get from SPACE
SPACE stands for Sandboxed Platform for Agentic Code Execution. Its repository describes a system for creating Linux environments, running commands and managing sandbox lifecycles. It is implemented in Rust, but developers interact with it through HTTP and server-sent events rather than embedding a Rust library.
A template provides the starting environment; each sandbox instance has its own virtual machine and writable filesystem. Lifecycle changes run asynchronously and return an operation ID to poll. Command output travels over a separate data-plane connection with a session-scoped attachment token. The repository also links installation, architecture, API, troubleshooting and E2B compatibility documentation (repository).
Perplexity says platform-held credentials and network access are managed outside the untrusted sandbox, so an agent can connect to authorized services without keeping those credentials in its workspace (announcement).
What Perplexity’s security tests found
Perplexity’s security report, dated September 23, 2026, separates attempts to escape a virtual machine to its host from attempts to bypass outbound network rules. The reported results differ by boundary and network condition (security report).
| Test boundary or network condition | Reported result | Runs |
| VM-to-host escape | No successful escapes | 0 of 108 |
| Network bypass with all outbound access blocked | No successful bypasses | 0 of 54 |
| Network bypass with partial access to approved package repositories | 11 successful bypasses; four models succeeded at least once | 11 of 54 |
The zero-escape result applies to the VM-to-host tests. It does not describe the separate network-policy tests: with partial access to approved package repositories, four models found a way through the outbound controls in 11 of 54 runs. Perplexity says those bypasses used forged DNS mappings or other services reachable through an IP address shared with an allowed service.
Perplexity says it changed its gateway defenses, adding source-address validation and stricter checks for hostname and authority information. In follow-up testing with source access and partial network access, the company reports that no tested model retrieved the callback flag; two scheduled runs ended because of provider or transport errors. Perplexity cautions that bounded tests do not prove perfect security (security report).
SPACE in Computer and on cloud platforms
Perplexity says SPACE replaced its commercial sandbox provider in July 2026 and has powered every Computer session since then. The company reports millions of sandbox creations per day and says creation was three to five times faster than with its previous provider in a comparison using the same production traffic (announcement).
The announcement gives different roles to three cloud providers: Akamai tested and launched SPACE on its cloud platform; Crusoe is partnering to add it to Managed AI Services; and CoreWeave published setup guidance for developers evaluating SPACE on CKS (announcement).
