Perplexity SPACE Verdict: The Agent Sandbox Is Now Open Source
Perplexity just put their internal 'prison for agents' on GitHub. It's Rust, it's fast, and it might just kill the managed sandbox market.
- Perplexity open-sourced SPACE (Sandboxed Platform for Agentic Code Execution) under Apache 2.0 on October 15, 2026.
- The system uses Firecracker microVMs to isolate agent code, hitting a median spin-up time of 60ms.
- Internal red-teaming reported zero VM-to-host escapes across 108 adversarial attempts by frontier models.
- It includes an E2B compatibility wrapper, making it a direct threat to managed sandbox providers.
Perplexity SPACE is a secure, Rust-based environment for running AI agents. It isolates untrusted code inside Firecracker microVMs, preventing agents from escaping to your host system while maintaining 60ms latency. Because it is open source (Apache 2.0), you can self-host it on Linux to avoid the high monthly fees and latency of managed providers.
If you are building autonomous AI agents that actually do work—not just yapping, but running terminal commands and touching files—you have a massive security problem. You are essentially giving a hallucinating intern root access to a box and hoping they don’t accidentally (or intentionally) nuke your production environment.
I keep saying this: the ‘hallucination’ problem is a product problem, but the ‘execution’ problem is an SRE problem. On October 15, 2026, Perplexity decided to stop being the only one with the keys to the kingdom. They open-sourced SPACE (Sandboxed Platform for Agentic Code Execution), the exact infrastructure that has powered every Perplexity Computer task since July.
It is a Rust-based, hardware-virtualized roll cage for your agents. And based on the receipts they just dropped, it is currently the fastest way to put an AI in a cage without killing your performance.
Is Perplexity SPACE actually secure?
The short answer is yes, and they have the red-team reports to prove it. In an industry full of ‘trust us’ marketing, Perplexity published results from their ‘Escaping SPACE’ report on September 23, 2026, where they ran 108 escape attempts across nine different frontier models per the official blog.
The result? Zero VM-to-host escapes.
Unlike standard Docker containers that share a kernel with the host—leaving you open to ‘Leaky Vessel’ style exploits—SPACE uses Firecracker microVMs. Each agent gets its own dedicated Linux kernel instance. If the agent tries to crawl out of the guest and into your host filesystem, it hits a wall of hardware virtualization that has zero interest in its prompts.
They did find some egress bypasses early on where models used DNS spoofing to reach blocked endpoints, but the repo shows those were patched using nftables source-address validation and TLS termination according to the GitHub release notes. This is the level of precision you want when you’re letting a LLM write code in your stack.
How fast is the SPACE sandbox?
If you’ve used managed sandbox providers, you know the pain: you wait 700ms or even two seconds for a environment to spin up, and by then, the user has already refreshed the page. In the production AI stack, latency is the silent killer of agentic UX.
Perplexity claims that since moving to SPACE, their median sandbox create latency dropped from 185ms (with their previous provider) down to just 60ms as reported by Techzine. That is fast enough to feel like a native function call.
They also solved the ‘goldfish memory’ problem. SPACE supports pause and resume with rolling snapshots that persist for up to one week. This means your agent can go to sleep, and when it wakes up for the next turn in the loop, its terminal history and file changes are exactly where it left them.
Where does Perplexity SPACE lose?
It isn’t a silver bullet. If you are a Mac-only shop, you are out of luck for local testing. SPACE requires a Linux host with KVM support—meaning it is built for the data center, not your MacBook Pro.
There is also the ‘Kubernetes tax.’ While the docs mention a direct mode, the architecture is clearly designed for Kubernetes deployments per the internal documentation. If you aren’t comfortable managing a cluster or at least a Linux box with btrfs, you’re better off sticking to a managed provider like E2B or Vercel.
| Feature | Perplexity SPACE | E2B | Vercel Sandbox | Docker (Standard) |
|---|---|---|---|---|
| Isolation | Firecracker microVM | Firecracker microVM | Firecracker microVM | Linux Container |
| Create Latency | ~60ms | ~717ms | ~1852ms | <50ms |
| Persistence | Snapshot/Suspend | Pause/Resume | Persistent by default | Ephemeral |
| Where it loses | Needs Linux/KVM | $150/mo floor | Vendor lock-in | Kernel escape risk |
The Verdict: Should you switch?
If you are currently paying a monthly ‘sandbox tax’ and your volume is high enough to justify a dedicated Linux node, the answer is a loud yes. The inclusion of an E2B Compatibility Wrapper means you can swap the backend without rewriting your entire agentic loop.
Perplexity just commoditized the sandbox layer. By giving away the tech that makes their ‘Computer’ agent possible, they are forcing every other provider to either drop their prices or find a new moat.
For the builders in my group chat: this is the truth. Stop building on shaky ground. If you want your agents to survive production, you need a prison that actually holds. SPACE is that prison.
It is fast. It is safe. It is finally open.
#TheAIMogul
Bottom linePerplexity SPACE is the new gold standard for self-hosted agent infrastructure. If you have the Linux/KVM hardware to run it, there is zero reason to pay a middleman for managed sandboxes that are three times slower. It is the most 'production-ready' code execution layer we have seen in the agentic era. Period.