Perplexity Open-Sources Its SPACE Agent Sandbox

Perplexity has released release 0.8.0 of SPACE (Sandboxed Platform for Agentic Code Execution), open-sourcing the infrastructure underlying 100% of Perplexity Computer sessions under the Apache 2.0 license. Built as a Rust codebase, SPACE places each agent task inside a dedicated Firecracker microVM on a Linux x86_64 host requiring KVM, /dev/kvm, /dev/net/tun, loop devices, btrfs, and Docker. The platform features an HTTP API with server-sent events backed by PostgreSQL, controllers, worker services, and a btrfs copy-on-write data plane. In production, median sandbox creation latency dropped from 185 ms to 60 ms compared to Perplexity's prior provider, while 90th-percentile creation latency fell from 447 ms to 89 ms.

The system manages environments across four operational states: running, paused with unpersisted worker memory, suspended with snapshotted state, and deleted. Unattended sandboxes suspend automatically after a 6-hour idle default. For deployment, Kubernetes environments leverage warm pools of pre-booted microVMs, single-node setups utilize base snapshots, and an included AWS EKS reference deployment provides production blueprints. Teams migrating from existing setups can use the built-in E2B Compatibility Wrapper, which targets a baseline of the e2b==2.21.1 Python package.

Security evaluations published in Perplexity's red-team report evaluated 9 frontier models across 216 test runs covering 2 tasks and 4 settings. In tests for VM-to-host escapes, 0 of 108 attempts reached host secrets, and 0 of 54 runs succeeded in bypassing no-network constraints. However, before architectural fixes, 11 of 54 partial-network runs yielded egress bypasses across 4 models: Claude Opus 5.0, GPT-5.6 Sol, GPT-5.6 Cyber, and Kimi K3, using DNS spoofing and shared CDN IP addresses. Perplexity addressed these vectors by introducing nftables source-address validation and host-level TLS termination that inspects SNI and HTTP host headers against allowlists, resulting in 0 verified bypasses during retests. Comparative analysis of 10 third-party platforms revealed that 8 contained at least one network-policy bypass.