“Stateful systems are incredibly hard to build”: How Perplexity thinks about AI agent sandboxes
The New Stack Frederic Lardinois
Perplexity built its own agent sandbox, SPACE, instead of buying one off the shelf. Turns out the hard part wasn't isolation - it's keeping sessions alive for weeks.
Based on reporting by The New Stack, Frederic Lardinois — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
Everyone assumed sandboxing for AI agents was basically solved. Firecracker handles isolation, a pile of startups sell managed sandboxes, done. Perplexity looked at that landscape of options and decided the real problem was somewhere else entirely, which is why on July 15 the company shipped SPACE, the sandbox layer now running under its Computer agent platform.
According to Nate Kupp, Perplexity's VP of infrastructure, the team didn't touch the lowest layers much. Firecracker is still the core building block, Kubernetes still handles cloud deployment. What ate the engineering budget was the control plane above that: pausing, resuming, and forking sessions that can run for days or weeks across millions of sandboxes, not the neat hours-long tasks most agent platforms are built around.
The piece that made this workable was Btrfs, the Linux copy-on-write filesystem. Because snapshots and forks become cheap metadata operations instead of full copies, Perplexity could build rolling snapshots of an entire session, live memory and all, happening as often as once a minute, with the ability to rewind a session up to a week. Kupp says early prototypes on Btrfs clicked fast enough that the team just committed to it. The payoff, he claims, is speedups of 3x or more on the performance metrics Perplexity tracks, plus meaningful cost savings, on top of deliberate tuning of P95 and P99 tail latencies since sandbox lag sits right in the user's path.
Security, in Kupp's telling, isn't really a trade-off against performance so much as a question of exposing the right knobs. Every customer wires Computer into a different mix of systems like Salesforce, Slack, or Snowflake, each carrying its own risk, so beyond standard RBAC the team built agentic controls down to individual tool calls. An admin can hard-block write access at the platform level rather than trusting model behavior, and sensitive actions get kicked up for user approval. Confidential computing with hardware backing isn't in there yet, though Kupp says Perplexity works closely with Nvidia across the stack.
Today SPACE runs one standard sandbox size tuned for Computer's own workloads, but Kupp says that changes as it becomes an API product with more flexible sizing, building on the narrower Sandbox API the company previewed back in March. Computer is also headed toward supporting third-party sandboxes, not just SPACE, and toward hybrid local-cloud deployments, including work with Nvidia's RTX Spark platform. Perplexity's research preview of a GLM 5.2-based orchestrator, post-trained for its harness, is part of that push, with Kupp citing results at a third of the cost of some frontier models. His bigger warning is about what's coming next: as agent sessions stretch from hours into weeks, he expects CPUs, not just GPUs, to become the scarce resource everyone is fighting over.
My take — AI-written commentary, not fact-checked reporting
The obsession with GPU scarcity has made it easy to forget that keeping a stateful agent alive for a week is its own infrastructure problem, and Perplexity's bet on Btrfs snapshots over reinventing isolation looks like the smarter place to spend engineering effort. Kupp's CPU warning deserves more attention than it will get, since the industry has spent two years arguing about chips that render images and almost none arguing about the machinery that just has to sit there holding a session open. Betting an orchestrator on a post-trained open Chinese model, GLM 5.2, while talking up cost efficiency is also a quiet signal about where the economics of agent routing are heading, regardless of what frontier labs want that conversation to be about.
Read more about this at: The New Stack