Perplexity Opens SPACE, Its Sandbox Platform for AI Agents

Perplexity has released SPACE, the sandbox platform behind its Computer agent, as an open-source project. Announced on October 15, the code is intended to give developers a starting point for running agent-generated code and file operations inside isolated environments instead of trusting a language model to respect every boundary on its own.

The project is notable because AI agents increasingly need to run scripts, manipulate files, call external services and resume work over time. Those capabilities are useful, but they also create opportunities for mistakes or malicious instructions to affect a host machine or expose credentials. A sandbox cannot make an agent harmless, yet it can limit the resources the agent can reach and provide a separate place to inspect its work.

What SPACE does

SPACE stands for Sandboxed Platform for Agentic Code Execution. Perplexity says each sandbox runs in a small virtual machine with its own operating system, creating a boundary between the agent's workspace and the host. A central control plane manages the creation, pause, resume and removal of those environments.

The platform includes several practical controls:

• Isolation: code and files are handled inside a separate virtual machine rather than directly on the host.
• Network and credential controls: Perplexity says authorised network access and platform-held credentials are managed outside the sandbox, so secrets do not need to be stored in the agent's working environment.
• Snapshots and recovery: checkpoints preserve a running environment so work can resume after an interruption.
• Pause, resume and branching: developers can pause a task for review, continue it later or test an alternative in a separate workspace.

For example, an agent could clean a spreadsheet and generate charts inside a disposable workspace. A human could review the result, resume the task with new instructions or branch into another approach without giving the agent unrestricted access to the developer's main environment.

Why Perplexity released it

Perplexity says SPACE replaced its previous commercial sandbox provider in July and has since powered all Computer sessions, handling millions of sandbox creations per day. In a comparison using the same production traffic, the company reports that creation was three to five times faster than its previous provider. Those are company-reported operational figures, not an independent benchmark across every deployment.

The project is available in the verified Perplexity SPACE repository, which lists the Apache 2.0 license. That license gives developers permission to inspect, modify and redistribute the code under its terms. Open sourcing also lets outside engineers review the implementation, report weaknesses and adapt it to their own infrastructure instead of rebuilding the entire sandbox layer.

Perplexity says Akamai and Crusoe are working with it to make SPACE available through their cloud or managed AI services, while CoreWeave has published setup guidance for evaluation. That partner activity suggests the project is aimed at real infrastructure deployments, not only local experiments.

What the security results do and do not prove

Perplexity's published security evaluation reports no virtual-machine escape in 108 attempts. The same evaluation also found ways around network restrictions. The company says it fixed the weaknesses and that the identified attack methods failed in follow-up testing. That distinction matters: the test did not show that every boundary was perfect on the first attempt, and the result is not a universal guarantee that SPACE or any agent using it is immune to attack.

A sandbox is one layer in a larger security design. Teams still need to limit permissions, review network egress rules, protect credentials, patch the host and monitor what an agent does. They should also decide which files and services a task genuinely needs, rather than granting broad access simply because the sandbox exists. A compromised agent may still perform harmful actions inside the permissions it has been given.

What it means for developers in the Philippines

For Filipino developers and IT teams experimenting with agents, SPACE could reduce the amount of custom infrastructure needed to run code in a controlled workspace. The repository and documentation are public, but deploying a secure sandbox still requires familiarity with virtual machines, networking, Linux administration and operational monitoring. Running it at scale also means paying for compute and storage, even though the code itself is open source.

A sensible evaluation starts with a non-sensitive test environment. Read the setup and security guidance, check the supported configurations, define outbound network rules and test how credentials are injected before connecting the sandbox to production data. Do not treat a successful quick-start demo as a complete security review.

The broader point is that agent safety is not just a question of choosing a better model. The environment around the model needs its own isolation, recovery and access controls. By releasing SPACE, Perplexity is inviting developers to inspect and build on one part of that infrastructure, while leaving each team responsible for configuring it safely.