Perplexity announced on October 15, 2026 that it is open-sourcing SPACE, the sandbox platform behind Computer, its personal agent product, in a post on its official Hub blog. When Computer launched in February, it ran on a commercial sandbox service; in July that was replaced by the in-house SPACE, which has powered every Computer session since and now creates millions of sandboxes a day. Perplexity's stated reasoning is direct: agent governance is an engineering problem, model good behaviour alone is not enough, and the runtime itself should be inspectable, adaptable and hardenable by others. What shipped is not a paper but production-tested runtime code, with the repository and deployment documentation public from day one.
How it isolates: every agent lives in its own virtual machine
SPACE's basic unit is a small virtual machine with its own operating system. Code and files the agent generates stay inside that machine, while a central control plane manages creating, pausing, resuming and removing sandboxes. Two design details stand out. First, the sandbox is treated as untrusted: network access and platform-held credentials are managed outside it, so an agent can reach authorised services while the credentials themselves never sit in its working environment; the keys, in effect, stay outside the door. Second, progress is kept through frequent file snapshots and full-environment checkpoints that store only changes rather than copying everything, so a paused session resumes with its files and running state intact, and a session can branch into two copies that try different approaches. We previously covered Perplexity turning Projects into rollback-friendly workspaces; SPACE addresses the lower half of that problem: where the code actually runs, and who contains it when it runs off the rails.
108 escape attempts, zero successes: how to read that result
In Perplexity's published security evaluation, agents were deliberately set loose against the boundary: none of 108 attempts escaped from the virtual machine to the host, although some did find ways around network restrictions. Perplexity says it fixed those weaknesses and that neither identified attack method succeeded in follow-up testing. The company also says SPACE creates sandboxes three to five times faster than its previous commercial provider on the same production traffic, and that it disclosed related weaknesses it found in other sandbox platforms to their vendors. Read these numbers with care: Perplexity designed and ran the tests itself, and the sample is limited. They show the system went through serious adversarial testing, but they are not a substitute for an external audit. The real value of the open release is exactly that outsiders can now rerun the experiment with their own attacks.
Which teams should pull SPACE down and try it
Teams adding code execution to an agent should look first: rather than building isolation, snapshots and credential handling from zero, compare your gaps against SPACE's implementation, especially credentials staying outside the sandbox and recoverable session state. Cloud providers suggest this is more than a showcase: CoreWeave and Akamai have tested and launched SPACE on their platforms, and Crusoe is bringing it into its managed AI services. Teams whose agents never execute code, or that rely entirely on a vendor's fully hosted environment, can sit this one out. At this point the agent race is no longer only about how smart the model is, but about who manages to box in the cost of losing control in advance, and what SPACE open-sources is the blueprint of the box.
