AI agents can write files, run commands and install software to complete a task. Those abilities also create a practical security question: where does that work happen, and what can it reach if the agent makes a mistake or behaves unexpectedly?
Perplexity’s answer is SPACE, short for Sandboxed Platform for Agentic Code Execution. The company has released the platform as open-source software under the Apache 2.0 license. SPACE provides an HTTP API for creating Linux execution environments, running commands, collecting output and managing sandbox lifecycles. Its underlying isolation unit is a Firecracker microVM, giving each sandbox its own virtual machine and writable filesystem.
Source note: Perplexity’s October 19, 2026 changelog is titled “Ultrafast Computer models, Decisions API, and connector controls”; it does not describe the SPACE open-source release. The SPACE announcement is in a separate Perplexity post about open-sourcing SPACE. This distinction matters when citing the announcement or its date.
What SPACE does
SPACE is an execution platform, not an AI model or a complete agent framework. An application chooses what work to send to a sandbox and what results to retain. SPACE manages the isolated environment, processes and command-output connection.
A template supplies a starting filesystem and runtime configuration. Creating a sandbox makes an instance of that template with its own microVM and writable filesystem. Multiple commands can run in that sandbox, so an agent can build on files or other work produced by earlier commands. The application communicates with SPACE through HTTP; it does not need to embed a Rust library, even though SPACE itself is implemented in Rust.
This architecture is intended for agent tasks that need somewhere separate to execute code or manipulate files. Perplexity points to examples such as cleaning a spreadsheet, calculating results, preparing charts, pausing while a person reviews a draft, and exploring alternative changes in separate workspace copies. These are possible application patterns, not prebuilt agent features that SPACE supplies on its own.
Why Firecracker microVMs matter
A container generally isolates processes while sharing the host operating-system kernel. A microVM instead runs a guest operating system with its own kernel. SPACE uses Firecracker microVMs to create a boundary between the code inside a sandbox and the host system. This can be useful when an agent runs generated code or handles files that should not be mixed with the application’s main environment.
That boundary is one layer of defense, not a guarantee that every risk disappears. A secure deployment also needs careful decisions about network access, credentials, templates, host configuration and operational monitoring. Perplexity describes SPACE as treating the sandbox as untrusted: platform-held credentials and network controls are managed outside the guest, so credentials do not have to be stored in the agent’s working environment. Developers still need to configure and test the controls for their own setup.
Perplexity says SPACE has powered Computer sessions and reports that its published security evaluation found no VM-to-host escape in 108 attempts. The company also disclosed that some agents initially bypassed network restrictions; it says it fixed the identified methods and they did not succeed in later testing. These are company-reported test results, not proof that any sandbox is invulnerable or that a deployment will be secure by default.
Pause, resume and preserve work
Long-running agent tasks may need to wait for a human, an external system or a later work session. SPACE supports lifecycle controls so an application can keep a sandbox, pause it, suspend it, wake it again or delete it. Perplexity also describes checkpoints and branching as capabilities used by Computer, enabling workflows that preserve progress or explore alternatives.
It is useful to distinguish pausing from suspending. In the current SPACE architecture guide, a paused sandbox stops execution while its VM memory remains resident and its filesystem stays on the worker; this is not a durable snapshot. Suspending saves a snapshot of VM memory, runtime state and the root filesystem, while releasing active VM resources. Waking a paused sandbox resumes it, while waking a suspended one restores it. Exact behavior and availability can depend on the deployment and supported API contract.
That distinction matters for reliability planning. If a process merely loses its client connection, the sandbox can outlive that connection. Conversely, a successful HTTP response or a closed command stream alone does not establish that the command finished successfully. Applications should inspect the process result and handle errors or incomplete output explicitly.
How to evaluate SPACE in practice
Start with a small, non-sensitive test task rather than giving an agent broad access to production systems. A practical first evaluation can follow this sequence:
- Review the host requirements. The documented local setup is for an apt-based Linux x86-64 host with KVM. It lists requirements including
/dev/kvm,/dev/net/tun, loop devices, Btrfs support and a local Docker daemon that permits privileged containers. The guide says its setup does not run directly on macOS. - Deploy the local test environment. SPACE’s installation guide walks through a Kubernetes Kind deployment, setup and authentication. Treat this as a real infrastructure project: the microVM runtime and its supporting services require host-level capabilities and configuration.
- Create a sandbox from a template. Templates define the starting environment. For repeatable experiments, record which template or digest you used rather than relying on an untracked environment.
- Wait for the lifecycle operation and guest readiness. Sandbox creation and other lifecycle changes are asynchronous. Poll the returned operation and confirm the sandbox is ready before trying to execute a command.
- Run a narrow command and check its result. The documented flow creates a command session and then attaches to its event stream to start the process and read output. Check the process-exit event and exit code; do not equate a successful API request with a successful command.
- Test interruption and cleanup. Try the lifecycle actions your product needs, such as pause and wake or suspend and restore. Verify what state is retained, then delete test sandboxes when finished.
The official first-sandbox walkthrough provides a Python example using the standard library rather than a required SDK. The architecture guide explains the relationship between templates, sandboxes, processes, command sessions and lifecycle operations.
Important limitations and questions to resolve
Open source does not mean managed hosting. Publishing source code lets teams inspect, modify and deploy the platform, but it does not by itself provide a hosted service, remove infrastructure work or guarantee a particular support arrangement. Teams should review the repository, installation guide, license and security policy before adopting it.
Host compatibility is specific. The documented local setup relies on Linux and virtualization support, including KVM. Developers evaluating it on a laptop or cloud instance should check whether the environment exposes the required devices and supports the needed virtualization features.
Lifecycle and output handling need application logic. Operations are asynchronous, and command execution uses a separate data-plane connection. Applications need to poll operations, handle connection errors, verify process outcomes and make safe choices about retries. Repeating a command can repeat its side effects.
Check which features are supported in your release. SPACE’s repository notes that fields or operations marked “incubating” are outside the supported contract, and some capabilities may be hidden unless enabled in a deployment. Confirm the current API reference and release documentation rather than assuming every feature discussed in the product announcement is available in every installation.
Isolation still needs a policy. MicroVMs help separate guest execution from the host, but teams must decide which network destinations are allowed, how credentials are injected, what data enters a sandbox and how outputs are handled. Test these policies under realistic threat scenarios, and keep secrets out of logs, metadata and command output.
What the Apache 2.0 release means
The repository lists the Apache License, Version 2.0. In practical terms, developers can inspect and build on the published project subject to that license’s terms. The open-source release may make it easier for platform and security teams to review implementation details, test a self-managed deployment and propose changes. It does not remove the need to assess dependencies, operating requirements, security updates or the suitability of the system for a particular workload.
Perplexity says SPACE handles millions of sandbox creations per day in Computer and reports that creation was three to five times faster than its previous provider in a comparison using the same production traffic. Those figures describe Perplexity’s own deployment and comparison; they should not be treated as a performance promise for another organization’s hardware or configuration.
For developers building agents that execute untrusted or generated code, SPACE is a concrete platform to evaluate rather than a theoretical security pattern. Its combination of Firecracker microVMs, an HTTP lifecycle API and mechanisms to preserve or resume work addresses real infrastructure needs. The fit depends on whether a team can meet the host requirements, operate the components and configure security controls appropriate to its threat model.
FAQ
What does SPACE stand for?
SPACE stands for Sandboxed Platform for Agentic Code Execution. It runs code in isolated Firecracker microVMs and provides an API for managing Linux sandboxes and their processes.
Is SPACE an AI agent or model?
No. SPACE provides the execution environment. An application or agent decides what commands to run and what to do with their results.
Does a sandbox keep its state when paused?
According to the current architecture guide, pausing retains the resident VM memory and filesystem on the worker, but is not a durable snapshot. Suspending captures VM memory, runtime state and the root filesystem while releasing active VM resources. Check the documentation for the specific release and deployment you use.
Can I run SPACE on macOS?
The documented local installation guide is for an apt-based Linux x86-64 host and says it does not run directly on macOS. Check the current deployment options and host prerequisites before planning a setup on another operating system.
Is SPACE guaranteed to prevent agent escapes?
No sandbox should be treated as an absolute guarantee. Perplexity reports encouraging results from its own security tests, while also describing network bypasses it found and later addressed. Test the isolation and network policies in your own environment and use defense in depth.
Where can developers start?
Read the SPACE repository, then review the official guide, installation requirements and first-sandbox walkthrough. The repository identifies Apache 2.0 as the project license.
