Perplexity Open-Sources SPACE to Help Developers Build Safer AI Agents

Perplexity AI has announced the open-source release of SPACE, a security platform designed to provide isolated environments in which artificial intelligence agents can execute code, manipulate files and perform computer-based tasks. Announced on October 15, 2026, SPACE stands for Sandboxed Platform for Agentic Code Execution. The platform was developed to address a major challenge in modern AI: allowing agents to perform useful work without giving them unrestricted access to the computers, credentials and networks they interact with. Perplexity says it has used SPACE to power sessions in its Computer product since July, replacing an external sandbox provider with its own infrastructure. By releasing the technology publicly, the company hopes other developers can examine its design, adapt it to their systems and contribute improvements to AI-agent security.

At the centre of SPACE is a technology known as a micro-virtual machine, or microVM. Each sandbox runs inside its own lightweight virtual machine using Firecracker, an open-source virtualisation technology originally developed by Amazon Web Services. This creates a separate computing environment for an AI agent’s work, reducing the risk that a process inside the sandbox could directly interfere with the host system. Developers can create Linux environments, execute commands, collect outputs and manage the lifecycle of individual sessions through an application programming interface. These capabilities allow AI agents to perform tasks such as analysing datasets, modifying files, running software and testing code in a controlled workspace rather than directly on a user’s primary computer.

Another important feature is the platform’s handling of credentials and network access. Perplexity says sensitive credentials and outbound network policies are managed outside the sandbox, rather than being stored directly inside the environment where an agent executes code. This separation is intended to limit the damage that could occur if an agent encounters malicious instructions or attempts an unauthorised action. Such protections are increasingly important because AI agents may browse webpages, read documents and interact with external tools, all of which can expose them to prompt-injection attacks. In these attacks, malicious instructions are hidden within information an agent processes in an attempt to make it disregard its intended task or security restrictions. Perplexity says its internal testing found SPACE resilient against network-bypass techniques associated with the reported OpenAI/Hugging Face agent incident. However, no sandbox can be assumed to be completely secure, and independent testing remains important.

SPACE also includes features designed to preserve work when an AI task is interrupted. Its infrastructure supports pausing and resuming environments, restoring previous states and creating branches of existing sessions. Frequent snapshots and checkpoints help preserve files and running-state information, allowing a task to continue without starting again from the beginning. These functions are particularly useful for agents working on lengthy research projects, software development or data analysis, where progress may need to be reviewed by a person before the agent continues. Perplexity says its production infrastructure handles millions of sandbox creations per day. The company has also reported an error rate below 0.0002%, although this figure reflects its own operational measurements rather than an independent industry-wide evaluation.

The release comes amid growing concern about the security implications of autonomous AI systems. Technology companies are increasingly developing agents capable of using browsers, executing code, accessing business applications and completing multi-step tasks with limited supervision. While these abilities can improve productivity, they also create new risks if an agent misunderstands instructions, accesses sensitive information or interacts with an unsafe external service. Perplexity has previously released other security tools, including BrowseSafe, which is designed to detect malicious instructions in webpages, and Numbat, a toolkit for identifying and investigating potentially dangerous agent behaviour on computers. Making SPACE available for public inspection extends this approach by giving developers access to the underlying environment where agent tasks are executed.

Perplexity says SPACE is available under the Apache 2.0 open-source licence, which permits developers and organisations to use, modify and distribute the software subject to the licence’s conditions. The company is also working with infrastructure providers, including Akamai and Crusoe, to expand deployment options, while CoreWeave has published guidance for evaluating the platform. Importantly, opening SPACE’s source code does not mean Perplexity has made its entire Computer AI product open source; the sandbox is the security infrastructure beneath the agent, not the complete agent itself. The release nevertheless gives developers a practical starting point for building more controlled AI systems. Its long-term value will depend on how widely the platform is adopted, how effectively independent researchers test its protections and how quickly the community addresses newly discovered vulnerabilities.