Perplexity open-sources SPACE, the sandbox platform behind Computer Other

Perplexity has open-sourced SPACE, the sandbox platform that runs code for its Computer agent. The code is on GitHub under the Apache 2.0 license, with hosted documentation. SPACE stands for Sandboxed Platform for Agentic Code Execution. It gives each agent its own isolated virtual machine for running code and working with files.

Perplexity announced the release on October 15, 2026. In July it replaced its "commercially available sandbox provider" with SPACE, built in-house. Since then, Perplexity says, SPACE has powered all Computer sessions and handled millions of sandbox creations per day.

What it is

• A sandbox platform that runs code in isolated Firecracker microVMs. Each sandbox has its own operating system.
• An HTTP API to create Linux environments, run commands, collect output and manage the sandbox lifecycle. SPACE is written in Rust, but apps talk to it over HTTP and server-sent events.
• Lifecycle features: pause and resume, recovery and session branching. An agent can try two approaches in separate copies of its workspace, or restore an earlier file after a mistake.
• The repo includes the Rust services and CLI tools, Firecracker template recipes, a local Kubernetes (Kind) setup, a reference AWS EKS deployment, warm pools, base snapshots and an E2B compatibility wrapper.

How it works

• Three layers. A control plane decides when sandboxes are created, paused, resumed or removed. Node-local services start sandboxes and handle storage and networking. The sandbox itself is a VM.
• Untrusted by default. SPACE treats the sandbox as untrusted. Network access and credentials are managed outside it: a network gateway enforces each sandbox's egress policy, and credentials never sit inside the agent's environment.
• Changes, not copies. SPACE stores changes (btrfs copy-on-write snapshots) instead of copying a whole machine image to create, pause or branch a sandbox.

Perplexity's numbers

In the same tests, four models got around network restrictions using DNS spoofing or shared-IP routing. Perplexity says it fixed both weaknesses and neither method worked in follow-up testing. It also notes that no observed escape is not proof of isolation.

Sources

• Perplexity: Open-sourcing SPACE
• Perplexity: Making SPACE, secure and efficient runtimes for long-running agents
• Perplexity: Escaping SPACE, Part I
• GitHub: perplexityai/SPACE
• SPACE documentation