Products#Runtime#Virtualization
Perplexity open-sources SPACE, its Firecracker agent sandbox
Perplexity open-sourced SPACE on October 15 under Apache-2.0: the Firecracker microVM sandbox behind every Computer session, millions of creations a day.
Perplexity open-sourced SPACE (Sandboxed Platform for Agentic Code Execution) under Apache-2.0 on October 15, 2026. Each sandbox is a small VM running its own operating system; a central control plane creates, pauses, resumes and retires them. SPACE replaced a commercial sandbox provider in July 2026 and has carried every Perplexity Computer session since. Perplexity says sandbox creation is three to five times faster than the previous provider on the same production traffic.
Key points
- SPACE went Apache-2.0 on October 15 at github.com/perplexityai/space, mostly in Rust. As of October 16 the repo has 371 stars and 85 open issues, with no releases and no tags.
- The official blog and the official red-team report “Escaping SPACE: Part I” (September 23) agree: no VM-to-host escape was observed in 108 attempts. Semafor wrote 118; this entry uses the primary source’s 108.
- In Perplexity’s own red-team runs, nine models reached a blocked callback URL in 11 of 54 partial-network runs. The company says it fixed both mechanisms and that neither reproduced after remediation. The same report claims at least one network-policy bypass in eight of ten third-party sandboxes it tested — all self-assessed, with no independent review.
- CoreWeave, Akamai and Crusoe agreed to offer SPACE to their customers. Per the official blog and Unite.AI, the first two have tested and launched it on their clouds; Crusoe is folding it into Managed AI Services.
What is in the repo
The repository was created on October 1, 2026, and the README states plainly that SPACE runs code “in isolated Firecracker microVMs.” Applications use its HTTP API to create Linux environments, run commands, collect output and manage sandbox lifecycles. The repo also carries Go components and Python tooling; the README notes it “is implemented in Rust, but applications interact with it over HTTP and server-sent events,” so there is no Rust library to embed.
The E2B Compatibility Wrapper (ECW) deserves its own sentence. README lists it as a standalone doc, and docs/ecw.md calls it a layer that “lets an existing E2B client use SPACE as its sandbox backend,” translating E2B-shaped HTTP requests into SPACE operations. The tested baseline is the Python packages e2b==2.21.1 and e2b-code-interpreter==2.6.2, and the doc says other releases and the JavaScript SDK are not covered by the repo’s compatibility tests. Teams already writing E2B code can point their client at SPACE without a client rewrite — with the version caveat attached.
Documentation is heavier than most day-one open-source drops: hosted Guide and API Reference live at space.docs.perplexity.ai, and the repo ships architecture, installation, first-sandbox, observability, egress-profile, warm-pool and base-snapshot docs. Local build uses mdBook 0.4.52. The API serves its generated reference at /openapi-m1.json, and fields marked incubating in the schema sit outside the supported contract — a more useful statement than “interfaces may change.”
How it is put together
SPACE treats the sandbox as untrusted compute. Network access and platform-held credentials stay outside it, so an agent can reach authorized services without credentials living in its environment. File snapshots and full-environment checkpoints preserve progress, and changes are stored incrementally rather than copying whole environments, which is where creation, restore and branching get their speed.
A Perplexity architecture post from October 14 explains how requests land on the right sandbox execution. The control plane separates the sandbox identity (the logical environment) from a route and execution identity — a specific runtime incarnation plus its worker, substrate and activation, with the pod UID carried on Kubernetes. Capabilities are issued after caller authorization and are Ed25519-signed, lasting 120 seconds with up to 15 seconds of clock-skew allowance; workers and gateways hold only public verification keys. The figures the post gives: millions of executions a day, an error rate below 0.0002%, and zero dropped connections.
The isolation layer is visible in the repo layout: templates/firecracker/ holds the seed builder and template recipes, infra/space/kind/ the local Kind deployment, and infra/space/aws/reference/ a reference EKS setup. The local path has a hardware gate — the installation doc specifies “an apt-based Linux x86_64 host with KVM,” requiring /dev/kvm, /dev/net/tun, loop devices, btrfs, and a Docker daemon that permits privileged containers, and says the instructions do not run directly on macOS.
The security ledger
This is the most interesting part of the release and the part that needs the most discounting. “Escaping SPACE: Part I” came from Perplexity’s own Secure Intelligence Institute on September 23: nine model configurations, two tasks, four settings each, three runs each, 216 runs in total. On VM isolation the report’s sentence is quotable as-is — “No VM-to-host escape was observed in 108 runs” — with source-code access, package installation and web search available to the models.
The network half is messier. With no network, 0 of 54 runs succeeded. With a partial network (PyPI-style allowlisting plus Perplexity Search), 11 of 54 runs reached the callback URL that should have been blocked. Claude Opus 5.0, GPT-5.6 Cyber, GPT-5.6 Sol and Kimi K3 got there by two routes: DNS spoofing, where the agent as root inside the guest forged a response mapping the allowed pypi.org to the blocked IP and the gateway never validated the response’s source, and IP sharing, where CDNs put many domains on one IP so allowing PyPI’s Fastly address let requests reach other tenants on it. Perplexity says it fixed both with nftables source-address validation and an authority-validating relay that strips routing metadata and terminates TLS, and that re-evaluation produced “neither mechanism produced a verified network-policy bypass.”
The same report tested ten third-party sandboxes with hostname- or domain-based egress controls, published results for nine, and claims “at least one network-policy bypass in eight of the ten platforms tested.” Tests ran August 31 to September 1, 2026; vendors were contacted September 1 and all had responded by September 10.
| Sandbox | HTTPS bypass | HTTP bypass | Arbitrary TCP egress |
|---|---|---|---|
| E2B | hit | — | — |
| Vercel Sandbox | hit | — | — |
| Modal | hit | — | — |
| Daytona | hit | — | — |
| Deno | hit | hit | hit |
| Fly.io Sprites | hit | hit | — |
| microsandbox | hit | hit | — |
| Cloudflare Sandbox | held | held | held |
| NVIDIA OpenShell | held | held | held |
Vendor responses ranged from fixes shipped (Daytona, Deno, microsandbox v0.6.18) to “known limitation” classifications (Vercel, Modal). Read all of that with the scorer in mind: Perplexity competes in this market, and grading competitors’ products in a report that also promotes your own release is not a neutral act. The report itself says boundary results “should not be interpreted as evidence that they are perfectly secure.”
What others say
Zibi Braniecki, a member of Perplexity’s technical staff, told Semafor that “a lot of companies are thinking about how to build secure AI agents, and in many cases they hit a wall” and “we have a solution.” He likened the release to the early browser era, when the industry jointly set guardrails for secure browsing and commerce, and said “right now, we’re thinking too small.” Semafor also reports Perplexity’s claim that SPACE reduces wasted compute, a side effect of very strict sandboxing.
Unite.AI’s independent read focused on the technical shape and the distribution: Firecracker microVMs, Rust, the E2B wrapper, local Kind deployment, and the different roles of the three clouds — CoreWeave and Akamai tested and launched, Crusoe took it into managed services. Only Unite.AI spells out that split; the official blog says just that both have “tested and launched SPACE successfully.”
Background
SPACE is not new. Perplexity’s July 15 architecture post, “Making SPACE,” describes the internal rollout: rollout began the previous month, and by publication “100% of Computer sessions now run on SPACE.” There is no repository, download or license anywhere in it — at that point SPACE was a product capability, not obtainable software. Between that July launch and October 15, public reporting treated it as internal.
Context helps. Nvidia’s Open Agent Safety Platform, open-sourced September 28, is the sandbox route Semafor named as the comparison; Alibaba Cloud’s Agent Sandbox, detailed the same day, is the cloud-shelf version of “give the agent a clean computer,” also with an E2B-compatible API. Three vendors, three ways of answering the same question: who supplies the place where agent code runs, at what price, with the boundary drawn where.
How to try it
To read the code without buying hardware, start with docs/architecture.md and docs/ecw.md. To actually run it, the documented path is a Linux x86_64 host with KVM: clone the repo, deploy a local Kind cluster per docs/installation.md, publish the seed:latest template, then run python3 examples/first_sandbox.py — a standard-library-only example that prints Hello from SPACE. With a Kubernetes cluster already available, infra/space/aws/reference/ is the reference deployment. E2B users should configure SPACE_ECW_HOSTS and validate with e2b==2.21.1 before pointing production traffic at it.
Our take
The newsworthy part is not “another open-sourced sandbox.” It is the cost line underneath it: Perplexity drove a Firecracker stack under one product’s production traffic — millions of sandbox creations a day — to the point where it could publish the details, then gave it away under Apache-2.0. That saves every follower a year or two of building an isolation layer from kernel primitives. And it has a reason to do so: agent sandboxing is turning into a business, and CoreWeave, Akamai and Crusoe queuing up to distribute it is the evidence. Whoever sets the standard shapes how the economics split.
The cooling-off is just as clear. Every security number here is self-assessed: the red-team report comes from Perplexity’s own Secure Intelligence Institute, the third-party scores were produced by the same team, and neither has independent review. The 108-run zero-escape result and the 11-of-54 network bypass come from one test suite — quote both halves or neither. On the engineering side there is a hard gate: KVM is required locally, macOS is ruled out by the docs, and only x86_64 is covered, so ARM users need a cloud machine or a wait. Teams evaluating this for production should re-run the DNS-spoofing and IP-sharing bypass classes against their own egress policy before trusting any of it.