AI NewsInfrastructureAnnouncement
Perplexity open-sources SPACE, its Firecracker sandbox for AI agents
Perplexity open-sourced SPACE, the Firecracker microVM platform it uses in production to isolate code that AI agents run, under Apache-2.0.
Image: Perplexity
Why it mattersA team building an autonomous agent can now adopt a production-tested isolation layer with built-in network controls, instead of trusting the model alone to respect boundaries or writing a sandbox from scratch.
Running agent-written code inside the same operating system as the laptop or server is the easy way to let one bad command take everything with it. Perplexity has open-sourced SPACE, the sandbox platform it has been using in production since July to put each agent's code in its own virtual machine. The repository is at 665 stars on GitHub and ships under Apache-2.0.
SPACE stands for Sandboxed Platform for Agentic Code Execution. Each sandbox is a small virtual machine built with Firecracker, with its own operating system and writable filesystem. A central control plane creates, pauses, resumes and deletes sandboxes through an HTTP API, and command output is read on a separate connection with a session-scoped token. The platform treats the sandbox as untrusted and holds network access and credentials outside it, so an agent can call an approved service without the key sitting next to the code it is running.
What Perplexity says it has measured
Perplexity says SPACE has powered every session of its Computer agent since July and has handled "millions of sandbox creations per day" in that time. On the same production traffic, the company says sandbox creation is three to five times faster than with the commercial provider it replaced. Those figures are Perplexity's own, from the launch post.
The company also ran a red-team evaluation. It reports 108 attempts to escape the virtual machine to the host, with none succeeding. Some attempts bypassed network restrictions; Perplexity says those weaknesses were fixed and did not succeed in a second round. The post adds that Perplexity disclosed related weaknesses it found in other sandbox platforms to their vendors.
Where it fits for a team today
SPACE deploys on Kubernetes through a Kind cluster locally and ships an operator CLI for larger setups. The platform supports pause and resume with full state snapshots, session branching for trying two paths in parallel, and base snapshots for faster boot. An E2B compatibility wrapper lets code written against the E2B Python SDK run against a SPACE cluster, so a team already using E2B can test the swap without a rewrite.
Akamai has launched SPACE on its cloud platform and is partnering with Perplexity on customer rollouts, Crusoe is adding it to its Managed AI Services, and CoreWeave has published deployment guidance on CKS. SPACE joins three other security tools the company has open-sourced this year: BrowseSafe, a detector for prompt-injection in web pages; Numbat, a toolkit for watching agent behaviour on a user's computer, released in July; and Bumblebee, a scanner for risky developer-machine configurations, released in May.
For a team building an agent that writes and runs code, the choice until now has been to use a commercial sandbox provider, run containers and hope the kernel holds, or build the microVM layer from scratch. A production-tested, Apache-licensed Firecracker platform with an active vendor behind it is a new option.
Source
Perplexity blog post announcing the release and the perplexityai/SPACE repository.
This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.
Get AI News in your inbox
New developer tools, model and agent releases, and how teams are actually using them to release software. Short, and only when there is something worth reading.
