Perplexity Open-Sources SPACE, Its Production Agent Sandbox

30-Second Summary

Perplexity open-sourced SPACE on 15 October 2026 under the Apache 2.0 licence. SPACE is the Firecracker microVM platform that runs every Computer agent session, creating and destroying an isolated virtual machine per task. It has processed millions of sandboxes per day in production since July 2026. CoreWeave, Akamai, and Crusoe will offer SPACE to enterprise customers. Perplexity says it will also launch SPACE as a paid API product.

At a Glance

• Topic: AI Infrastructure
• Company: Perplexity
• Date: 15 October 2026
• Announcement: Open-source release of SPACE, the microVM sandbox platform behind Computer
• What Changed: The isolation layer that makes Computer agents safe to run at scale is now inspectable, forkable, and self-hostable by any organisation
• Why It Matters: Agent security has been a black box. SPACE makes the architecture public and verifiable, and it sets a new floor for what production agent isolation should look like
• Who Should Care: Engineering and security teams evaluating agent platforms, operators building internal automation at scale, and any organisation handling sensitive data with AI agents

Key Facts

• SPACE is built on Firecracker, the microVM technology originally developed by AWS for Lambda
• Median sandbox creation latency is approximately 60 milliseconds, down from 185 milliseconds previously
• Each task runs in its own VM. Credentials are held outside the sandbox, with the host controlling network access
• Rolling snapshots allow sessions to be paused, resumed, or branched into multiple sandboxes
• SPACE tested isolation with nine models attempting to escape the VM across 108 attempts. None reached the host, though four bypassed some network restrictions, which Perplexity says it has since fixed
• Distribution partners confirmed: CoreWeave, Akamai, and Crusoe
• Platform is written in Rust and managed through an HTTP API with an E2B-compatible interface
• Perplexity describes SPACE as the first component of a broader Agentic Runtime Platform

What Happened

Perplexity published the SPACE source code to GitHub on 15 October 2026 under the Apache 2.0 licence, making the microVM platform behind its Computer agent available for anyone to inspect, fork, or deploy. The release came with hosted documentation and a public explanation of the architecture from the engineering team.

SPACE uses Firecracker, an open-source virtualisation technology originally built by AWS to power Lambda functions. Every agent task gets a fresh VM at creation and the VM is destroyed when the work ends, preventing one session's credentials or outputs from reaching another. Network access is controlled by the host, and credentials sit outside the sandbox entirely, so an agent that is compromised in one session cannot reach the authentication tokens needed to touch external services.

The platform entered production in mid-2026 and has handled millions of sandbox creations per day, powering all Computer sessions since July. Perplexity says median sandbox creation time has dropped to approximately 60 milliseconds, compared to 185 milliseconds under the previous architecture. Sessions can be paused and resumed via rolling snapshots kept for up to one week, and a single session can be branched into multiple parallel sandboxes.

Perplexity also announced that CoreWeave, Akamai, and Crusoe have agreed to offer SPACE to their enterprise customers. The company says it will offer SPACE as a paid API product, giving organisations an option to use the managed service rather than self-hosting. An E2B-compatible HTTP API is included in the release.

Why It Matters

The isolation problem has been the blocker for enterprise agent adoption. Most organisations that have evaluated AI agents in the past 18 months have hit the same wall: the agent needs access to real systems, real data, and real credentials. Without a credible isolation architecture, giving an agent those permissions creates unacceptable risk. SPACE is the first open-source production system that demonstrates a viable answer at scale.

Open-sourcing the security layer is a credibility move. A vendor claiming their sandbox is secure is different from a vendor whose sandbox architecture has been public and scrutinised for months. Perplexity's decision to release the code means security teams can audit the isolation model rather than accept it on trust. That matters particularly for regulated industries where vendor assurance letters are rarely sufficient.

The credential design pattern matters beyond Perplexity. The decision to hold credentials outside the sandbox, with the host controlling access, is an architectural choice other teams building agent infrastructure can adopt directly. SPACE does not teach a new concept, but it provides a production-tested reference implementation of a concept most teams are still figuring out from first principles.

CoreWeave, Akamai, and Crusoe as distribution partners signals where enterprise agent compute is heading. These are infrastructure companies with existing relationships with regulated-industry customers. Their decision to offer SPACE suggests they are seeing demand for managed agent sandboxing from customers who need it as a cloud service rather than a self-managed deployment.

The session snapshot feature solves a real workflow problem. Most agent frameworks assume a task runs to completion uninterrupted. Regulated workflows rarely can. An agent processing a loan application may need to pause for a compliance review before executing a downstream step. SPACE's pause-resume architecture makes that pattern technically viable in a way that most current agent platforms cannot match.

The gap in confidential computing is worth noting. SPACE does not yet use hardware-backed confidential computing, which means the host can in theory see inside the VM. For organisations handling particularly sensitive data, that gap is relevant. Perplexity acknowledges it as a known limitation.

The David and Goliath View

The agent security conversation in most organisations is happening at the wrong level. Teams are debating which model to use, which framework to build on, and which APIs to connect. The isolation layer, the part that determines whether one agent session can leak credentials into another or escape into the host environment, is usually an afterthought or a vendor promise.

SPACE changes that, not because it is the only microVM platform ever built, but because it is the first one released by a company running it at production scale for a consumer-visible product. The 108 escape attempts, the four network restriction bypasses, the fixed and retested architecture: that is not a lab exercise. That is a real adversarial test on a system running millions of sessions a day. The fact that it is now public means other teams building agent infrastructure have something concrete to learn from rather than rebuilding the same hard lessons themselves.

For operators running lean teams with Claude, the practical implication is this: when you evaluate agent vendors, start asking about the sandbox architecture. Specifically, ask where credentials are stored relative to the agent execution environment, what happens to the VM after a task completes, and whether sessions can be paused for human review. Those questions now have a clear reference answer from a system you can inspect on GitHub.

Where This Fits in the AI Stack

SPACE sits at the infrastructure layer between cloud compute and agent frameworks. It is the layer most enterprise teams currently have no visibility into.

In a standard agent deployment today, a framework such as LangGraph or the Claude Agent SDK orchestrates the logic, a model provides the reasoning, and tools connect the agent to external systems. The sandbox, the thing that determines whether those tool calls can reach credentials from another session or escape the execution environment, is typically handled by the cloud provider or left to the operator to figure out.

SPACE proposes a specific architecture for that layer: one VM per task, credentials outside the sandbox, network access controlled by the host, rolling snapshots for session management. The E2B-compatible API means existing agent frameworks can integrate without major changes. For operators building on Claude via the Agent SDK, SPACE could sit between the framework and the cloud compute layer.

Questions Operators Are Asking

Can I use SPACE with my existing agent framework? Yes. SPACE exposes an E2B-compatible HTTP API, which means it can integrate with frameworks that already support E2B, including several popular options. The underlying Rust platform can also be called directly via the HTTP API if you prefer not to go through the compatibility layer.

Does open-sourcing the sandbox create a security risk by exposing the architecture to attackers? Perplexity's position is the opposite: open architecture is more secure than security through obscurity. The company ran 108 escape attempts before the release and fixed the four network bypasses that were found. Security researchers can now audit the code independently. Perplexity says this external scrutiny makes the platform more secure, not less.

What does the CoreWeave, Akamai, and Crusoe partnership mean in practice? These companies have agreed to offer SPACE to their enterprise customers, which means organisations that are already using CoreWeave, Akamai, or Crusoe for AI compute may be able to add SPACE as a managed service rather than self-hosting. Pricing and availability have not yet been announced.

How does SPACE handle multi-step workflows that need human review mid-task? SPACE supports session snapshots, which allow a session to be paused at any point and resumed later. A branching feature also allows a single session to fork into multiple parallel sandboxes. For workflows that require a compliance or legal review step before proceeding, this architecture supports a pause-and-resume pattern that most current agent platforms cannot handle natively.

What is the cost of running SPACE compared to current sandboxing approaches? Perplexity has not published pricing for the managed API product. The open-source version can be self-hosted on any infrastructure that supports Firecracker, which is available on most major cloud providers. The 60 millisecond median creation time suggests the overhead per task is minimal at scale, though operational costs depend heavily on the underlying compute.

Citable Summary

Perplexity open-sourced SPACE, its Firecracker microVM sandbox for AI agents, on 15 October 2026 under the Apache 2.0 licence. The platform isolates each agent task in its own virtual machine, holds credentials outside the sandbox, and has handled millions of sessions per day since entering production in mid-2026. Median sandbox creation time is approximately 60 milliseconds. CoreWeave, Akamai, and Crusoe will offer SPACE to enterprise customers, and Perplexity plans a paid API product. The release provides the first open-source reference architecture for production-grade agent sandboxing, addressing a gap that has been a recurring blocker for enterprise AI agent deployments.