Perplexity Open-Sources SPACE Agent Sandbox: Firecracker microVM Achieves Zero VM Escapes, Handles Millions of Daily Sandbox Creations
A Major Open-Source Milestone
On October 15, 2026, AI search company Perplexity officially open-sourced its internal agent execution platform SPACE (Sandboxed Platform for Agentic Code Execution) under the Apache 2.0 license. This decision marks an important milestone in the AI agent security infrastructure space, providing the industry with a production-tested open-source solution.
SPACE has been powering all Perplexity Computer sessions since July 2026, handling millions of sandbox creations daily and achieving zero VM escapes across 108 red-team attempts.
Core Architecture: Firecracker microVM
SPACE is implemented in Rust and uses AWS's open-source Firecracker microVM technology as its isolation foundation:
Isolation Mechanism
Each sandbox is a dedicated Firecracker microVM with its own guest kernel, completely separating the agent's execution environment from the host system. This design ensures that even malicious agent code cannot affect the host system or other sandboxes.
Performance
In production, SPACE achieves a median sandbox creation latency of approximately 60 milliseconds, significantly faster than Perplexity's previous commercial provider. This performance level makes on-demand sandbox creation practically viable rather than requiring pre-allocated resources.
State Management
The platform supports persistent, stateful sessions by allowing sandboxes to be paused, suspended, and resumed. Using filesystem snapshot technology, long-running tasks can maintain progress without requiring full re-initialization.
Security Design: Credential and Network Controls
SPACE's security architecture is built around two core principles:
Credential Security
Credentials and egress policy controls are managed outside the guest VM. Secrets are injected via the network layer as needed and are never stored within the sandbox environment. This design prevents agent code from directly accessing sensitive credentials.
Network Egress Control
Egress traffic is strictly controlled through a gateway that performs TLS termination and enforces allowlists (SNI and HTTP host validation) to prevent network policy bypasses.
Red-Team Testing Results
Perplexity conducted extensive security evaluations in September 2026:
| Test Type | Attempts | Successful Attacks |
|---|---|---|
| VM escape attempts | 108 (9 frontier models) | 0 |
| Network policy bypasses (pre-patch) | 54 | 11 (20.4%) |
| Network policy bypasses (post-patch) | Ongoing monitoring | 0 |
Initial testing revealed that 11 of 54 runs resulted in network policy bypasses (e.g., via DNS spoofing or exploiting shared CDN IP addresses). These vulnerabilities were subsequently patched with source-address validation and strict TLS/HTTP host checking.
Notably, Perplexity's testing of other third-party sandboxes during the same period found that 7 out of 9 platforms were susceptible to similar shared-infrastructure network bypass attacks.
Industry Partnerships and Deployment
SPACE is designed for cloud-native environments with reference support for Kubernetes/Kind and AWS EKS. Perplexity is collaborating with the following providers to offer managed instances of the SPACE platform:
- CoreWeave: High-performance GPU cloud computing
- Akamai: Global edge network
- Crusoe: Sustainable energy data centers
E2B Compatibility Wrapper
To facilitate adoption, the SPACE project includes an E2B Compatibility Wrapper (ECW), enabling developers currently using the E2B SDK to transition their code to SPACE, significantly reducing migration costs.
Significance for Asia-Pacific AI Agent Ecosystem
SPACE's open-sourcing carries important implications for AI agent developers and enterprises in the Asia-Pacific region:
Data Sovereignty Compliance
For markets with strict data sovereignty requirements such as Japan, Singapore, and South Korea, SPACE allows enterprises to run AI agents on local infrastructure, ensuring sensitive data doesn't cross borders.
Elevated Security Standards
Financial institutions, healthcare organizations, and government agencies in APAC face strict security compliance requirements when deploying AI agents. SPACE's VM-level isolation and zero-escape record provide a trustworthy security foundation for these organizations.
Open-Source Ecosystem Building
The Apache 2.0 license allows developers across APAC to freely use, modify, and distribute SPACE, helping build localized AI agent security ecosystems.
Technical Comparison: SPACE vs Traditional Sandbox Solutions
| Feature | SPACE | Traditional Container Sandbox | Commercial Sandbox Service |
|---|---|---|---|
| Isolation Level | VM-level | Container-level | Varies |
| Creation Latency | ~60ms | ~10-30ms | 100-500ms |
| VM Escape Protection | Zero escape record | Known vulnerabilities | Opaque |
| License | Apache 2.0 | Varies | Commercial |
| State Persistence | Supported | Limited | Varies |
Conclusion
Perplexity's open-sourcing of SPACE represents a significant advancement in AI agent security infrastructure. As AI agents increasingly access enterprise systems and handle sensitive data, a production-validated, open-source sandbox platform with a zero VM escape record has profound implications for the entire industry. For enterprises in the Asia-Pacific region, SPACE provides an AI agent execution environment that meets both security requirements and supports local deployment.
