> ## Content Index
> Fetch the complete content index at: https://www.tao.media/llms.txt
> Use this file to discover other available public pages before exploring further.

# Perplexity Releases Firecracker-Based SPACE Agent Sandbox Under Apache 2.0
- URL: https://www.tao.media/perplexity-releases-firecracker-based-space-agent-sandbox-under-apache-2-0/
- Published: 2026-10-16T17:35:31.000Z
- Updated: 2026-10-16T17:35:31.000Z
- Description: The platform behind Perplexity Computer combines isolated code execution with persistent workspaces and host-side security controls.
- Author: Tristan Hillerich
- Tags: Perplexity, AI, News

Perplexity has [open-sourced SPACE](https://x.com/perplexity%5Fai/status/2110778478312481167?ref=tao.media), the sandbox platform powering every task in Perplexity Computer. Available under the [Apache 2.0 license](https://github.com/perplexityai/SPACE?ref=tao.media), the release gives developers infrastructure for running agent-generated code in isolated Firecracker microVMs, with network access and platform-held credentials managed outside the agent’s workspace.

SPACE stands for Sandboxed Platform for Agentic Code Execution. Applications use its [HTTP API](https://github.com/perplexityai/SPACE?ref=tao.media) to create Linux environments, execute commands, collect output, and retain or remove the workspace afterward. Perplexity [replaced its commercial sandbox provider with SPACE in July](https://www.perplexity.ai/hub/blog/open-sourcing-space?ref=tao.media) and says the platform now handles millions of sandbox creations per day.

## Keeping Security Controls Outside the Agent’s Workspace

Agents in Computer have root access inside their sandbox and can install software and run commands. Each sandbox has its own operating system and writable filesystem, while Firecracker separates guest execution from the host machine. A host-side gateway applies the sandbox’s outbound network policy.

SPACE treats the guest as untrusted. Platform-held credentials stay outside the VM, letting agents connect to authorized services without storing those credentials in their working environment. These controls constrain access independently of whether a model follows its instructions.

![Escaping SPACE: Part I](https://storage.ghost.io/c/78/0b/780ba906-b1a7-4bf0-873c-bdd5c32e5331/content/images/2026/10/h86zk5s4.jpg)

Escaping SPACE: Part I | Perplexity research

Perplexity’s security testing found that VM isolation and network restrictions need separate defenses. In its previously published research, nine model configurations received root access and attempted two tasks: obtaining a secret from the host and retrieving a flag from a blocked network destination. Across four experimental settings and three repetitions, the evaluation comprised 216 runs, including 108 VM-escape attempts. None of those 108 attempts reached the host.

The initial network tests did uncover weaknesses. Four models bypassed restrictions in 11 of 54 runs where access to selected package repositories was permitted. They exploited forged DNS responses or shared IP addresses that served both approved and unapproved domains. Perplexity added packet source-address validation and checks on the hostnames used in HTTP and TLS traffic.

## Workspaces That Survive Individual Requests

A SPACE sandbox outlives the request that creates it and the connection carrying command output. Multiple commands can share the same environment, so an application can retain files and running state across a longer workflow rather than start over after each interaction.

Pause and suspend preserve that state differently. Pausing stops execution while keeping VM memory resident on the worker. Suspending saves memory, runtime state, and the root filesystem in a snapshot and releases active VM resources. The environment can later be restored. Session branching also lets developers explore alternative approaches in separate copies of a workspace.

Perplexity uses incremental storage of changes to reduce the work involved in creating, restoring, or branching environments. In a comparison using the same production traffic, the company reported sandbox creation was three to five times faster than with its previous provider.

## Deployment and Developer Integration

The [SPACE repository](https://github.com/perplexityai/SPACE?ref=tao.media) contains a Rust implementation accessed over HTTP and server-sent events, along with setup instructions, warm pools, base snapshots, and an E2B compatibility wrapper. Warm pools keep booted sandboxes ready to avoid a cold start. The documented local installation uses Kubernetes and Kind, although SPACE can also manage workers directly without Kubernetes.

SPACE is the first component of Perplexity's Agentic Runtime Platform. Akamai has tested and launched SPACE on its cloud platform, Crusoe is working with Perplexity to add it to Managed AI Services, and CoreWeave has published deployment guidance for evaluation on its Kubernetes service.

Developers can access the code, installation guides, and API reference through the public repository.