Perplexity has open-sourced SPACE, the sandbox platform that runs its Computer agents, giving any developer the same containment system it uses in production. Why it matters: after a year of stories about agents escaping test environments and touching live websites, Perplexity is betting the fix is stronger walls around agents — shared openly — rather than better behaviour training alone.
October 16, 2026
What happened?
Perplexity announced that SPACE — its in-house platform for running agent code in isolated environments — is now open source, with the code and deployment documentation published for other teams to use. The company built SPACE internally and, in July, replaced its previous commercial sandbox provider with it. Since then it has powered every Computer session, handling, by Perplexity’s account, millions of sandbox creations a day.
Cloud partners are already lining up behind the release. Akamai has tested and launched SPACE on its cloud platform, Crusoe is adding it to its managed AI services portfolio, and CoreWeave has published setup guidance for developers who want to evaluate it on its Kubernetes service.
How does SPACE contain an agent?
Each sandbox runs inside a small virtual machine with its own operating system, separated from the host system. A control plane creates, pauses, resumes and deletes those workspaces, and supports isolated code execution, recovery and session branching — so a task can be paused for review, copied to try a different approach, or rolled back after a mistake.
Two design choices matter most for safety. The sandbox is treated as untrusted by default, and both network access and platform credentials are managed outside it, so an agent can reach authorised services without the underlying secrets ever sitting inside its environment. Frequent snapshots store only the changes to a workspace rather than full copies, which keeps creating and restoring sandboxes fast — Perplexity says creation ran three to five times faster than its previous provider on the same production traffic.
How well did it hold up under attack?
Perplexity’s published security evaluation gave frontier models root access inside a sandbox and tasked them with breaking out. In 108 attempts, none escaped from the virtual machine to the host. Some did find ways around network restrictions when partial network access was allowed; Perplexity says it fixed those weaknesses, neither method worked in follow-up testing, and it disclosed similar weaknesses it found in other sandbox platforms to their vendors.
SPACE joins Perplexity’s earlier open-source safety tools — BrowseSafe for spotting malicious instructions in web pages, Numbat for investigating dangerous agent behaviour, and Bumblebee for scanning developer machines — and it is not the only open sandbox in the field: NVIDIA released a similar project, OpenShell, last month.
Why it matters
If you build or buy AI agents, this is a usable release, not a research tease: a production-tested sandbox, with isolation, credential handling and recovery built in, that you can inspect and deploy yourself instead of trusting a closed vendor. The honest caveat is that the headline escape results are Perplexity’s own testing, and its own report shows network controls — not the virtual machine — were where models found room to manoeuvre. Containment is becoming a product category in its own right, and open-sourcing the walls is a credible way to make them stronger: more eyes on the code, more weaknesses found before an agent finds them first. Everything AI, tested — and, in this case, deliberately attacked before release.
Frequently asked questions
What is Perplexity SPACE?
It is Perplexity’s sandbox platform for agentic code execution: the isolated virtual-machine environment its Computer agents run code and work with files inside, now released as open source for other developers.
Did any AI model escape from SPACE in testing?
Perplexity’s published evaluation reports no escape from the virtual machine to the host in 108 attempts. Some models did bypass network restrictions in some configurations; Perplexity says those weaknesses were fixed and failed in re-testing.
Where can developers run SPACE?
Perplexity has published the repository, setup instructions and security guidance. Akamai has launched it on its cloud, Crusoe is adding it to its managed services, and CoreWeave has published evaluation setup guidance.
How is this different from training a model to behave?
SPACE does not try to make the model better behaved. It limits what any agent — well-behaved or not — can reach, by keeping credentials and network controls outside the sandbox and isolating its work from the host system.
Sources: Perplexity, SiliconANGLE, Unite.AI