Perplexity open-sources SPACE, the sandbox that runs its Computer agent

Perplexity has open-sourced SPACE, the sandbox platform behind its Computer personal agent, under the Apache 2.0 license with a public repository and documentation. Computer launched in February on a commercial sandbox provider; in July Perplexity replaced it with this in-house system, which also runs its reinforcement learning and evaluation workloads.

SPACE runs each agent task inside its own Firecracker microVM, a lightweight virtual machine. Credentials and network egress are controlled from outside the VM, so even an agent with full control inside cannot simply read secrets or call wherever it likes.

Perplexity published its red-team results alongside the code. In 108 escape attempts by models given root access inside the VM, none reached the host. Four models did get past the network rules, which the company disclosed. Its researchers also say they bypassed seven of nine rival sandboxes they tested. Those comparisons are Perplexity's own claims, but releasing the code means anyone can now check the work.

Our take

Agent sandboxing just went from a vendor feature to a free, inspectable baseline. Publishing the failures, not just the wins, is what makes it credible.