Perplexity Open-Sources SPACE, a Firecracker MicroVM Sandbox for AI Agents

Perplexity has open-sourced SPACE, the sandbox system it uses for every task in Perplexity Computer. The release puts the same isolation layer behind its agent work into the open under Apache 2.0, with the code published on GitHub.

SPACE is built around Firecracker microVMs, one per sandbox, so each agent task gets its own Linux environment and writable disk. Applications talk to it through an HTTP API, with server-sent events for streaming output. A template provides the starting filesystem, and multiple commands can run inside the same sandbox.

The point of the design is clear enough: let agents run as root inside the guest while keeping the host out of reach. Credentials never enter the VM itself. Instead, Perplexity injects them at the network layer, and a host-side gateway enforces outbound policy on every connection. The credential store also adds hierarchical scoping, rate limits and audit logging.

SPACE is a Rust codebase at release 0.8.0. It runs on a Linux x86_64 host with KVM, needs /dev/kvm, btrfs and Docker, and supports local Kind clusters or direct mode. No macOS. For quicker startup, Kubernetes deployments can use warm pools of booted sandboxes, while single-node setups use base snapshots instead.

Perplexity says the system now backs 100% of Computer sessions. In production, median create latency fell from 185 ms to 60 ms compared with its previous provider, and the 90th percentile dropped from 447 ms to 89 ms. The red-team numbers are just as blunt: 0 of 108 escape attempts reached the host, though before fixes 11 of 54 partial-network runs bypassed the egress policy. After Perplexity added source-address validation through nftables and tightened TLS checks, the retest found no verified bypass.