What shipped

SPACE is the sandbox layer underneath Perplexity Computer, the company's long-running agent product. Each task gets its own Firecracker microVM with its own guest kernel. The agent has root inside that VM and can install packages and run arbitrary commands for hours. Credentials never enter the guest: they sit in a store outside the sandbox, are injected at the network layer, and every outbound connection passes through a per-sandbox gateway on the host.

The platform is written in Rust and driven over an HTTP API. Snapshots make it an agent runtime rather than a job runner: btrfs copy-on-write lets a session pause, suspend, roll back after a destructive command, or resume on another node. Perplexity says rollout began last month, 100% of Computer sessions now run on SPACE, and creation got faster in the switch: median latency fell from 185 milliseconds to 60 against the previous provider, on the same production traffic.

The code is public under Apache 2.0, with an E2B compatibility wrapper for teams already on that SDK. Two qualifications belong in the release notes. The repository lists no tagged releases yet, whatever the "0.8.0 baseline" label in coverage suggests, and it runs only on Linux x86_64 hosts with KVM, btrfs and Docker: no Macs, and no cloud VMs without nested virtualisation.

Two boundaries, two results

Before open-sourcing SPACE, Perplexity had already published a red-team evaluation of its VM isolation and network controls: "Escaping SPACE: Part I", dated September 23, 2026. It gave nine frontier models root inside the guest and set them two tasks: steal a honeytoken credential stored on the host, or fetch a flag from a URL the network policy blocked. Two further models, Fable and GPT-6 Astra, refused the attack tasks in pre-run testing and sit outside the nine. The 216 runs divide into 108 VM-escape attempts and 108 network-policy tests, the network tests split evenly between all access blocked and partial access.

In Perplexity's test, none of the 108 VM-escape attempts reached the host-side secret, including runs where the models could read SPACE's own source code. Perplexity attaches its own caveat: no observed escape in a time-boxed test is not proof of isolation.

The network boundary is where the report earns its keep. With all network access blocked, nothing got out: 0 of 54. With partial access — a more realistic configuration for agents that need package registries or search — four models reached the blocked URL in 11 of 54 runs. Claude Opus 5.0, GPT-5.6 Sol, GPT-5.6 Cyber and Kimi K3 found two routes. The first was DNS spoofing: forge a resolver response that maps an allowed domain, pypi.org, to the blocked address, and the gateway's own learned mapping waves the connection through. The second used shared CDN addresses: an IP allowlisted for PyPI also serves unrelated Fastly tenants, so a model could reach a URL-fetching tool on the same address and have it fetch the flag instead. One run read the flag off a screenshot of the blocked page.

The fixes, and everyone else's results

Perplexity says both routes are closed. Source-address validation now drops packets that impersonate the resolver. For TLS, the gateway terminates the connection and requires the SNI and the HTTP hostname to be allowlisted and consistent with the destination the name resolves to — the requirement is consistency between the name a policy allows and the authority a request actually selects at each protocol layer, not a simple hostname-to-IP equality check. In a retest under the strongest setting, source code included, no model produced a verified bypass.

The uncomfortable part of the report is not about SPACE. The same team directly tested the network-policy enforcement of ten third-party sandbox platforms in late August and early September — direct technical tests, not LLM agent runs — and found at least one bypass in eight of them. Of the nine named, seven were bypassed, including E2B, Vercel Sandbox, Modal and Daytona. Cloudflare Sandbox and NVIDIA OpenShell were not. Vendors were told on September 1; some shipped fixes, others called it a known limitation. Those results describe the versions and configurations tested on August 31 and September 1, not necessarily what runs today.

What to ask your own sandbox

A hostname allowlist is a statement about names, and enforcement usually happens on addresses. Any gap between the two is where an agent with root and two hours will eventually look. Three questions cover most of it: does your gateway check the TLS SNI and HTTP host against the allowlist, or only the destination IP; can a guest forge a DNS answer your gateway will learn from; and does your "no network" test also get run in the partial-network configuration you actually deploy. Perplexity's report is a worked example of failing the first two and passing on the second attempt.

Sources

  1. [1] Perplexity, "Making SPACE: Secure and efficient runtimes for long-running agents" — architecture, production rollout and latency figuresRead source
  2. [2] Perplexity, "Escaping SPACE: Part I" (September 23, 2026) — red-team method and results, remediation, third-party platform tests and vendor responsesRead source
  3. [3] GitHub, perplexityai/SPACE — Apache 2.0 licence, README, host prerequisites, E2B compatibility wrapper, release and star counts as checked October 17, 2026Read source
  4. [4] MarkTechPost, "Perplexity Open-Sources SPACE, a Firecracker MicroVM Sandbox for AI Agents" (October 16, 2026) — 0.8.0 baseline label, host requirements, comparison tableRead source
  5. [5] Unite.ai, "Perplexity Open-Sources SPACE, Its In-House Agent Sandbox Platform" (October 2026) — CoreWeave, Akamai and Crusoe cloud availabilityRead source