Editorial illustration for Perplexity Open-Sources SPACE Firecracker MicroVM Sandbox for AI Agents
Perplexity Open-Sources SPACE Sandbox for AI Agents
Perplexity pushed its agent sandbox into the open on GitHub this week, releasing SPACE under an Apache 2.0 license. The platform, whose name stands for Sandboxed Platform for Agentic Code Execution, is the same system that runs every task inside Perplexity Computer, the company's agentic coding and browsing product. Built in Rust and tagged at version 0.8.0, SPACE gives each agent task its own Firecracker microVM, with credentials and outbound network traffic managed from outside that VM rather than inside it.
The numbers Perplexity published point to a system shaped by real production load. Median sandbox creation latency dropped from 185 milliseconds to 60 milliseconds after the company moved off its previous provider. It runs on Linux x86_64 hosts with KVM access, btrfs, and Docker, either through a local Kind cluster or in direct mode. No macOS support exists yet.
What stands out is how Perplexity frames the engineering problem: agents need root access inside their sandbox to install packages and run arbitrary commands, but the host has to stay completely out of reach. That tension between agent freedom and host security is what the rest of the design addresses.
Perplexity has open-sourced SPACE, the sandbox platform behind every task in Perplexity Computer. The Perplexity SPACE sandbox gives each agent task its own Firecracker microVM. Credentials and outbound traffic are controlled from outside that VM.
Why this matters
Perplexity just handed out the plumbing it built to keep its own agents from torching production systems, and that's worth paying attention to. Release 0.8.0 is a real baseline, not a demo: Rust, Apache 2.0, HTTP API with server-sent events, and the credential/traffic controls live outside the VM rather than bolted onto the agent itself. That separation matters more than it sounds.
Most teams building coding or browsing agents are still improvising sandboxing with Docker and a prayer, which works fine until an agent decides to curl something it shouldn't or a long-running task dies mid-branch and loses state. SPACE was built for exactly that failure mode, stateful, branching, root-access work that has to survive restarts. We'd treat the "production-tested" label with the usual skepticism until outside teams put load on it, but the design is sound and the license removes any excuse not to try.
Watch whether other labs adopt it outright versus fork it quietly, that'll tell you how good the isolation really is.
Related Reading
Open Source D&B rebuilds 642 million‑business database after AI agents hit limits
Open Source Box CEO Aaron Levie Says AI Will Drive "Biggest Cybersecurity Upgrade
Open Source Study: 6.7% of Deepfake Requests on Hugging Face Targeted Children
From Archives Nvidia Says Nemotron 3.5 Super VL Outperforms Gemini Ultra in Agent Tests
From Archives openKylin Outlines Vision for Reimagining Linux in AI Era at Open Source Summit
Common Questions Answered
What is SPACE and how does it work with Firecracker microVMs?
SPACE, which stands for Sandboxed Platform for Agentic Code Execution, is Perplexity's open-source sandbox platform built in Rust that gives each agent task its own isolated Firecracker microVM. This architecture ensures that credentials and outbound network traffic are managed from outside the VM rather than being controlled by the agent itself, providing enhanced security and isolation for agentic operations.
Why is the separation of credential and traffic controls outside the VM significant for AI agents?
Separating credential and traffic controls from outside the VM is crucial because it prevents agents from directly accessing sensitive credentials or controlling network traffic themselves, reducing the risk of malicious or compromised agents from causing damage. This architectural approach is more secure than traditional methods where sandboxing controls are bolted directly onto the agent, as it creates a fundamental security boundary that cannot be bypassed by agent code.
What license and version was SPACE released under, and what does it replace for teams building agents?
SPACE was released under an Apache 2.0 license at version 0.8.0, making it freely available for teams to use and modify. It provides a production-ready alternative to the improvised sandboxing solutions that most teams building coding or browsing agents currently use with Docker, offering a more robust and purpose-built platform for secure agent execution.
How does SPACE relate to Perplexity Computer and why did Perplexity open-source it?
SPACE is the same sandbox system that powers every task inside Perplexity Computer, the company's agentic coding and browsing product. By open-sourcing SPACE, Perplexity shared the production-grade infrastructure it built to safely isolate and manage AI agents, providing the broader development community with battle-tested plumbing for keeping agents from causing damage to production systems.
What technical features does SPACE include as a production-ready baseline?
SPACE release 0.8.0 includes several production-ready features: it is built in Rust for performance and safety, provides an HTTP API with server-sent events for communication, and implements the critical security architecture of managing credentials and traffic controls outside the VM. These components work together to create a comprehensive sandbox solution rather than a simple demonstration or proof-of-concept.
