Perplexity open-sources SPACE, its sandbox for isolating AI agent tasks

Perplexity has open-sourced SPACE, the sandbox system that runs every task inside Perplexity Computer, the company’s AI agent product. The code is now public on GitHub under the Apache 2.0 license, terms permissive enough to let anyone use, modify, and redistribute it freely.

SPACE isolates each agent task inside its own Firecracker microVM, a lightweight virtual machine that runs a separate kernel from the host. Instead of letting an agent act directly on the machine it runs on, SPACE places a boundary around every task: the credentials an agent needs and any outbound network traffic it sends are managed from outside that virtual machine, rather than handed to the agent to control on its own.

That separation addresses a specific risk. Agents that browse the web or run code are, by design, acting on instructions that come from outside sources, a web page, a file, a tool’s output, and some of that material is unverified. If one of those sources turns out to be malicious or simply broken, isolation limits the damage: the agent cannot step outside its microVM to reach the host system, pull credentials it was not given, or send network traffic nobody approved.

MarkTechPost, which first reported the release, calls SPACE “production-tested isolation” for teams building coding or browsing agents. Perplexity ran the system internally as the infrastructure behind Perplexity Computer before deciding to publish it.

What the release leaves open

The announcement lays out the core design: a microVM per task, with credentials and network access controlled externally. It does not detail how those credentials are scoped for an individual task, what overhead comes from starting a fresh microVM for every task, or how SPACE stacks up against other sandboxing approaches teams may already be running. Those are the kinds of details that would shape an actual adoption decision, and the source material released so far does not include them. Open-sourcing a piece of infrastructure like this differs from open-sourcing a model: it hands over the scaffolding Perplexity built for its own product rather than a trained artifact, which makes it something other companies could plug directly into their own agent systems rather than just study.

What to watch next is whether other teams building coding or browsing agents adopt SPACE or fork it, and whether Perplexity follows up with documentation or benchmarks showing how the sandbox performs under workloads beyond its own.