Perplexity SPACE

SPACE (Sandboxed Platform for Agentic Code Execution) is the infrastructure that has run every Perplexity Computer session since July 2026. Perplexity open-sourced it under Apache 2.0 on October 15, 2026. The design is simple: each sandbox is a Firecracker microVM with its own guest kernel. Applications talk to it over HTTP and server-sent events with no SDK required. In production, SPACE generates millions of sandboxes per day at a median create latency of around 60 ms.

The security model is what makes SPACE interesting to builders beyond the Perplexity ecosystem. Credentials and outbound traffic are controlled from outside the VM, so agent code that runs as root inside the sandbox cannot read secrets or make unauthorized network calls. Perplexity ran a red-team test before releasing the code: nine frontier models with root access made 108 breakout attempts and none reached the host, though four models bypassed egress network rules before Perplexity patched the gateway.

For teams building coding agents or browser agents, SPACE offers a production-tested isolation layer they can self-host on a Linux x86_64 host with KVM. It is also compatible with the E2B API, which means existing code targeting E2B can route to a self-hosted SPACE instance. The release matters because sandbox escape is one of the more concrete agentic security risks, and this is a rare case of a vendor publishing their actual red-team results alongside the code.