Perplexity launches open-source sandbox for AI agent security

Perplexity has released SPACE, an open-source sandbox platform designed to securely run AI agent tasks in isolated microVMs. The platform, available under Apache 2.0 on GitHub, provides a production-tested isolation layer for teams developing coding or browsing agents. SPACE uses Firecracker microVMs, with each sandbox having its own guest kernel and network gateway to enforce egress policies. Secrets are kept outside the guest, with credentials injected at the network layer, offering hierarchical scoping, rate limits, and audit logging. The system is divided into four components: a PostgreSQL-backed API, controllers, worker services, and a data plane. Worker services manage VMs, networking, volumes, templates, and credentials, with btrfs copy-on-write creating root filesystems. Sandboxes can be in four states: running, paused, suspended, or deleted. Kubernetes deployments use warm pools for fast creation, while single-node setups use base snapshots. Perplexity reported that 100% of Computer sessions run on SPACE, with latency reduced to 89 ms from 447 ms. A security report tested nine models, finding bypasses in four, including Claude Opus 5.0 and GPT-5.6 Sol. Perplex, the company, added source-address validation through nftables, and subsequent tests showed no verified bypasses. The team also tested ten third-party platforms, with eight showing network-policy bypasses, and disclosed results to affected vendors.