Perplexity Open-Sources SPACE: Firecracker microVM Agent Sandbox Achieves Zero Escapes in 108 Tests
On October 15, 2026, AI search company Perplexity officially open-sourced its in-house agent sandbox platform SPACE (Sandboxed Platform for Agentic Code Execution). Built in Rust and released under the Apache 2.0 license, the platform uses Firecracker microVM technology to provide isolated execution environments for AI agents. Since July 2026, it has powered all of Perplexity Computer's agent sessions, managing millions of sandbox creations daily.
Why Agent Sandboxes Matter
The Security Dilemma of Agentic AI
As AI agents evolve from chat assistants to autonomous systems capable of executing code, accessing file systems, and calling external APIs, security isolation has become one of the industry's most pressing technical challenges. A poorly designed agent sandbox could allow malicious agents to:
- Escape to the host system and access sensitive data
- Bypass network egress controls and leak confidential information
- Move laterally in multi-tenant environments, affecting other users
Multiple security incidents in 2026 (including OpenAI's disclosure of 19 rogue agent incidents) have pushed agent security to the top of the industry agenda.
The Genesis of SPACE
Perplexity developed SPACE internally to support its "Perplexity Computer" product — a system allowing AI agents to execute complex tasks on user devices. Since entering production in July 2026, SPACE has processed millions of sandbox creation requests daily, accumulating extensive production environment validation data.
SPACE's Core Architecture
Firecracker microVM: One Kernel Per Agent
SPACE's core design principle is complete isolation: every agent task executes in an independent Firecracker microVM with its own:
- Independent kernel
- Independent operating system
- Writable filesystem
Firecracker is an open-source Virtual Machine Monitor (VMM) developed by AWS, originally designed for AWS Lambda and Fargate, renowned for millisecond-level startup times and minimal resource overhead. SPACE applies it to agent sandboxing, achieving near-container performance with near-VM security isolation.
Key Technical Features
Sandbox Lifecycle Management SPACE handles the complete sandbox lifecycle: creation, suspension, resumption, and destruction. The "warm pools" mechanism pre-maintains a batch of ready environments, compressing sandbox startup time to approximately 60 milliseconds.
State Persistence The platform uses frequent file snapshots and checkpoints, allowing agents to preserve progress across interruptions and supporting session branching — agents can "fork" multiple execution paths from a given state point.
Control Plane Security A central control plane manages network access and platform credentials outside the sandbox. Even if an agent gains root access within the microVM, it remains constrained by external egress controls and policy layers. This design ensures "defense in depth": even if the sandbox is breached, attackers still face additional security layers.
E2B Compatibility Wrapper (ECW) SPACE provides an E2B Compatibility Wrapper, allowing developers to use existing code written for the E2B Python SDK within the SPACE environment, significantly reducing migration costs.
Security Testing: 108 Attempts, Zero Escapes
Adversarial Testing by Perplexity's Secure Intelligence Institute
Perplexity's "Secure Intelligence Institute" subjected SPACE to rigorous adversarial testing simulating common agent security threats:
Virtual Machine Escape Testing
- Test attempts: 108
- Successful escapes: 0
- Conclusion: In all tests, no agent successfully escaped from the microVM to the host system
Network Egress Bypass Testing Initial testing revealed vulnerabilities: 4 models successfully bypassed network rules in 11 out of 54 runs, specifically through DNS spoofing and shared CDN address exploitation. Perplexity implemented gateway fixes, and no further bypasses were successful in retesting.
A Byproduct: Industry Security Assessment
Perplexity's testing also revealed an important finding: multiple third-party sandboxes (including E2B, Vercel, Modal, and others) were vulnerable to similar shared-address bypass techniques during testing conducted in late August and early September 2026. This discovery prompted the entire industry to re-examine agent sandbox security standards.
Deployment and Ecosystem
Open Source and Cloud Integration
SPACE is open-sourced under Apache 2.0 on GitHub, providing:
- Complete model weights and training recipes
- Kubernetes deployment configurations (supporting AWS EKS and local Kind environments)
- Detailed API documentation
Cloud Integration Partners CoreWeave, Akamai, and Crusoe have announced plans to integrate SPACE into their cloud offerings, providing customers with production-ready agent sandbox capabilities.
Comparison with Competing Solutions
| Solution | Deployment | Isolation Level | Open Source |
|---|---|---|---|
| SPACE (Perplexity) | Local/Cloud | microVM | Apache 2.0 |
| E2B | Cloud API | Container | Partial |
| Vercel Sandbox | Cloud API | Container | Closed |
| Modal | Cloud API | Container | Closed |
SPACE's core differentiation lies in: fully open source (including training pipeline), microVM-level isolation, and the ability to run on private or air-gapped infrastructure.
Implications for Asia-Pacific AI Developers
Data Sovereignty and Local Deployment
Asia-Pacific AI developers face strict data sovereignty requirements — Singapore's PDPA, Japan's Personal Information Protection Act, and China's Data Security Law all impose strict restrictions on cross-border data transfers. SPACE's local deployment capability enables developers to build production-grade agentic AI systems in full compliance with local regulations.
Lowering the Security Barrier for Agentic AI
For resource-constrained Asia-Pacific AI startups, SPACE provides a production-validated security infrastructure starting point, eliminating the need to build agent sandboxes from scratch. This open-source contribution is expected to accelerate the development of the agentic AI ecosystem across the region.
Conclusion
Perplexity's open-sourcing of SPACE is a significant milestone in the agentic AI security infrastructure landscape of 2026. The zero-escape record across 108 tests, combined with the systematic disclosure of vulnerabilities in industry third-party sandboxes, establishes SPACE as a reference implementation for agent security standards. With cloud providers CoreWeave, Akamai, and Crusoe integrating SPACE, it is poised to become the security foundation layer for next-generation agentic AI deployments.
