On October 15, 2026, Perplexity officially released its internal sandbox platform, dubbed SPACE (Safe Platform for Agent Code Execution), on the open-source repository GitHub. This isolation environment software was developed in-house by the company to replace commercial security solution vendors starting in July 2026, serving as the core operational infrastructure for its personal assistant feature, Computer.
Perplexity’s move comes with backing from a lineup of leading cloud infrastructure providers, including CoreWeave, Akamai, and Crusoe, which have signed agreements to make SPACE readily available to their enterprise customer bases.
MicroVM Architecture and Out-of-Bounds Control
Each sandbox in the SPACE system is designed as an independent microVM with its own operating system, establishing an absolute isolation barrier between the agent’s code execution space and the external physical host. A central control system outside the virtual machine is responsible for dynamically provisioning, pausing, resuming, or tearing down sessions.
Unlike traditional sandboxes that often store credentials inside the guest environment, SPACE treats the agent’s entire workspace as untrusted. All internet access, API keys, and user credentials are stored and controlled independently from the external control plane. When an agent needs to interact with an external service, the request is routed through a security proxy without exposing secret keys inside the execution environment.
Beyond security, Perplexity’s solution delivers impressive performance, spinning up workspaces 3 to 5 times faster than its previous commercial partner under identical real-world traffic. The ability to preserve state using differential snapshotting enables users to pause tasks for inspection and fork sessions without incurring significant computational overhead.
Real-World Stress Testing Against AI Breakout Risks
To prove the software’s reliability, Perplexity conducted extensive security evaluations across today’s most advanced AI models. According to a technical report published by the company, across a total of 108 test attempts by leading models intentionally trying to breach virtual machine boundaries (news outlet Semafor reported this figure as 118 attempts across 9 models), not a single model was able to escape the virtual machine to the host machine.
However, the report candidly acknowledged that some internal security engineers had previously found ways to bypass network restrictions in earlier iterations. Perplexity moved quickly to patch these vulnerabilities prior to releasing the code to the open-source community, stating that subsequent repeat attacks were fully blocked.
The decision to open-source SPACE comes amid a wave of AI safety incidents, where models have autonomously executed malicious code or accessed sensitive repositories without authorization. In practice, relying solely on behavioral alignment through training has proven insufficient to guarantee safety. The industry is beginning to shift decisively toward establishing hardware-level defense layers and rigorous isolation environments, viewing them as mandatory prerequisites before granting AI assistants greater autonomy in everyday workflows.