Perplexity Open-Sourced SPACE, the Sandbox Running Every Computer Session

Perplexity open-sourced SPACE on October 15 under the Apache 2.0 license — the sandbox platform it says powers every session of its Computer agent. Built on Firecracker microVMs, SPACE has run all Computer sessions since July and handles millions of sandbox creations per day, according to the company. Perplexity describes it as the first component of a broader Agentic Runtime Platform: a bet that agent security should be enforced at the runtime level, not bolted on afterward.

If you build AI agents, this is the most useful kind of open source: not a demo, not a research artifact, but production infrastructure a company claims to run at real scale.

What the Perplexity SPACE sandbox actually is

The core idea is simple. An AI agent that uses a computer needs somewhere to act — a place where it can open browsers, run code, and manipulate files without those actions touching the host system. SPACE provides that somewhere: lightweight Firecracker microVMs that spin up fast, isolate each session, and get torn down when the work is done. Millions of creations per day means the startup and teardown path has been optimized under real load, which is exactly the part most DIY agent sandboxes get wrong.

The Apache 2.0 license matters as much as the architecture. It means you can use SPACE commercially, modify it, and ship it inside your own products. For a startup building an agent product, that's the difference between spending three months building sandbox infrastructure and spending a weekend integrating someone else's.

Firecracker's track record helps

SPACE builds on Firecracker, the microVM technology AWS open-sourced in 2018 and uses under the hood of Lambda and Fargate. That's a meaningful pedigree: Firecracker was designed to launch thousands of tiny, isolated virtual machines per host with minimal overhead, and it has years of production hardening behind it. Perplexity isn't asking you to trust a brand-new isolation primitive — it's packaging a proven one for the agent era, with the session lifecycle and tooling that agent workloads need. That choice lowers the audit burden considerably.

Why runtime-level security is the right bet

The agent security conversation has been stuck between two unsatisfying options: prompt-level guardrails that clever inputs bypass, and human-in-the-loop approvals that defeat the purpose of automation. SPACE represents a third option — containment. The agent can do whatever it wants inside the sandbox, because the sandbox defines what "whatever" can touch.

This aligns with what the tooling data keeps telling us. Developer surveys this year show AI coding tool usage climbing while developer trust lags, and researchers keep demonstrating agents bypassing security controls in testing. Containment doesn't require trusting the model. It requires trusting the boundary, which is a much smaller and more testable claim.

What to try this week

If you run agents anywhere near production, SPACE is worth an afternoon. Spin it up, throw your agent's typical workload at it, and watch what the isolation boundary actually catches. Pay attention to the networking controls — exfiltration through a sandbox's network path is the attack that matters most, and it's where homegrown solutions are weakest.

Two caveats. First, "powers every Computer session since July" is Perplexity's claim about its own scale, and production-hardened at one company doesn't mean production-hardened for your threat model. Audit the code; it's open source, that's the point. Second, sandboxing solves containment, not correctness — your agent can still do the wrong thing confidently inside a perfectly secure box. Pair this with the kind of agent orchestration discipline that tools like VS Code's agent control center and Gemini in Copilot are pushing toward, and with serious API hygiene on the data side.

The open-source agent stack is filling in fast: runtimes, routers, sandboxes. The teams that win won't be the ones with the cleverest prompts. They'll be the ones with the most boring, most reliable infrastructure underneath.