TL;DR — Key Takeaways
– Perplexity open-sources SPACE: The Apache 2.0-licensed platform runs agent code in isolated Firecracker microVMs.
– Root access with boundaries: Agents can install software and run commands inside sandboxes, while external controls manage credentials and network access.
– Security testing found network weaknesses: Perplexity reported no successful VM escapes in 108 attempts, but identified and patched network policy bypasses.
Linux users have a new secure and fast option for running AI agents.
AI-based search company Perplexity has released as open source, under the Apache 2.0 license, its own agent sandbox for general use, called SPACE (Sandboxed Platform for Agentic Code Execution).
Within this sandbox, agents can run commands, install packages, and call external services with root access. Any network activity outside the sandbox is tightly scoped.
“The host stays outside the guest’s control, and a per-sandbox gateway enforces egress policy on every outbound connection,” the Perplexity X account explained in a series of messages.
Built on Firecracker
Perplexity built SPACE in Rust as a component for its Perplexity Computer, a digital coworker service the company launched in February.
Originally, the service relied on a commercial provider to create the millions of sandboxes its customers required each day. The company migrated off that third-party platform in July, when it finished work on SPACE. SPACE cut the median time to create a sandbox from 185 milliseconds down to 60 milliseconds.
SPACE is built on the Firecracker microVM format. Developed by Amazon Web Services and released in 2018, Firecracker is a lightweight, fast-start virtual machine monitor (VMM). It is written in Rust as well.
A microVM can be spun up even faster than a container, even though a container shares the operating system kernel with other containers. A microVM is a regular VM, with its own dedicated OS kernel, which is usually slower to start than a container, though in this case, the kernel is stripped down to just the essentials for running its app, so it can run as fast as a container, but with the stronger security boundaries of a VM.
AWS developed Firecracker for the company’s serverless Lambda service. As it turns out, the microVM format is also perfect for hosting agents, which tend to be ephemeral, ramping up and shutting down frequently as the tasks demand.
Road-Testing SPACE
Perplexity’s SPACE tackles one of the most difficult issues with managing agents: Giving them root access to an operating environment where they can do their work – such as writing code and notes, installing software, and running tests – while not compromising the rest of the system being used.
Perplexity runs its own security testing operation, called the Secure Intelligence Institute, which evaluated the SPACE sandbox across 216 runs. It covered how nine frontier models – including Claude Opus 5.0, GPT-5.6 Sol and Kimi K3 – worked within the Firecracker format. On 108 occasions, the models tried to escape their sandbox environments. Zero models breached the virtual machine boundary, even with access to the SPACE source code.
Perplexity reported that four models did manage to bypass some network checkpoints by exploiting DNS spoofing and shared CDN routing, though the company upgraded the host gateway to validate source addresses, which shut down any further forays onto the networks.
As far as allowing agents to access external resources, the SPACE platform handles the challenge of giving agents credentials by keeping all credentials out of the sandbox.
The agent doesn’t get access to any sensitive log-in or access credential information. Instead, ephemeral credential tokens are injected outside the sandbox when requested, and are heavily scoped, given strict rate limits, and comprehensively logged. Outbound connections from the sandbox are monitored by the gateway through strict egress policies.
For long-running or iterative jobs, a SPACE sandbox can be paused in memory, or suspended to disk. The data plane records incremental file deltas so agents can quickly recover from mistakes or try different approaches.
SPACE Requirements
Because it is built on Firecracker, SPACE requires an x86_64 host running Linux with KVM virtualization and storage running on the btrfs file system.
SPACE can run on a single server, within a Kubernetes deployment, or within a nested virtualization mode. Akamai has signed on to support SPACE, and AI cloud provider Crusoe is ramping up managed instances of SPACE. CoreWeave has published documentation on how to run SPACE on the CoreWeave Kubernetes Service (CKS).
And of course, SPACE is also hosted within Perplexity’s Computer service. Perplexity offers an E2B compatibility wrapper for those who wish to bring their agents over from E2B format.
Recently, container security company Chainguard released its own secure agent platform, called Workspaces, which was also built on microVMs and deployed similar security measures. Rivaling containers or full-fledged VMs, microVMs are making the case for being the best format for agentic work.
